Linkage processing method and device based on ransomware virus, equipment and storage medium

Abstract

The invention relates to the technical field of internet security, and discloses a ransomware-based linkage processing method, device and equipment and a storage medium, and the method comprises the steps: obtaining virus feature information corresponding to a ransomware when the ransomware is detected; acquiring virus external connection information when the ransomware attacks according to the virus feature information; determining a virus disposal strategy and a safety linkage device according to the virus external connection information; and carrying out linkage disposal on the ransomware virus according to the virus disposal strategy through the safety linkage equipment. Compared with the prior art that a user needs to monitor the ransomware in real time and only obtains a decryption private key corresponding to the ransomware can recover the file, the method has the advantages that the virus handling strategy and the safety linkage equipment are directly determined according to the virus external connection information; and then linkage disposal is performed on the ransomware according to the virus disposal strategy through the security linkage equipment, so that the disposal efficiency of the ransomware is improved, and the integrity of file recovery is ensured.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a linkage disposal method, device, equipment and storage medium based on ransomware. Background Art

[0002] Ransomware is a new type of virus Trojan that accompanies the rise of digital currency. Once a machine is attacked by a ransomware, most files will be modified by encryption algorithms and a special suffix will be added, and the victim will not be able to read the original normal files. In the existing technology, most ransomware cannot be decrypted by technical means. It is necessary to manually obtain the decryption private key corresponding to the ransomware to restore the encrypted files, resulting in low efficiency in handling ransomware.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a linkage disposal method, device, equipment and storage medium based on ransomware, aiming to solve the technical problem of how to improve the disposal efficiency of ransomware.

[0005] To achieve the above object, the present invention provides a linkage disposal method based on ransomware virus, and the linkage disposal method based on ransomware virus comprises the following steps:

[0006] When a ransomware virus is detected, obtaining virus feature information corresponding to the ransomware virus;

[0007] Obtain virus external connection information when the ransomware virus attacks according to the virus feature information;

[0008] Determine a virus handling strategy and a security linkage device according to the virus external connection information;

[0009] The ransomware virus is linked and disposed of according to the virus disposal strategy through the security linkage device.

[0010] Optionally, before the step of acquiring virus feature information corresponding to the ransomware virus when the ransomware virus is detected, the step further includes:

[0011] Obtain access traffic information through traffic devices;

[0012] Analyze the access traffic information to obtain the access traffic type;

[0013] Determining whether the access traffic type is consistent with the preset traffic type;

[0014] When the access traffic type is consistent with the preset traffic type, it is determined that a ransomware virus is detected.

[0015] Optionally, the step of determining a virus handling strategy and a security linkage device according to the virus external connection information includes:

[0016] Analyze the virus external connection information according to the preset joint attack strategy to obtain the virus external connection analysis result;

[0017] The virus processing strategy and security linkage equipment are determined according to the virus external connection analysis result.

[0018] Optionally, the step of determining a virus handling strategy and a security linkage device according to the virus external connection analysis result includes:

[0019] When the virus external connection analysis result is a virus external connection failure, sending the virus external connection analysis result to a corresponding management object, so that the management object feeds back a virus detection result based on the virus external connection analysis result;

[0020] A virus handling strategy and a security linkage device are determined according to the virus detection result.

[0021] Optionally, the step of determining a virus handling strategy and a security linkage device according to the virus detection result includes:

[0022] Determining whether the virus detection result meets a virus misjudgment condition;

[0023] When the virus detection result does not meet the preset virus misjudgment condition, obtaining the attack device operation information corresponding to the ransomware virus;

[0024] Determine an initial linkage device according to the attack device operation information;

[0025] According to the attack device operation information, the ransomware virus is blocked through the initial linkage device to obtain a virus blocking result;

[0026] When the virus blocking result is a successful blocking, a virus processing strategy and a security linkage device are determined according to the virus blocking result.

[0027] Optionally, after the step of determining whether the virus detection result meets a virus misjudgment condition, the step further includes:

[0028] When the virus detection result meets the preset virus misjudgment condition, generating a virus misjudgment report according to the virus external connection information and the virus detection result;

[0029] A virus warning strategy is determined based on the virus misjudgment report.

[0030] Optionally, after the step of blocking the ransomware virus through the initial linkage device according to the attacking device information to obtain a virus blocking result, the step further includes:

[0031] When the virus blocking result is a blocking failure, obtaining Internet interconnection protocol information and domain name information corresponding to the ransomware virus;

[0032] The internet protocol information and the domain name information are blocked by the initial linkage device, and a virus blocking log is generated according to the internet protocol information and the domain name information.

[0033] Optionally, the step of determining a virus handling strategy and a security linkage device according to the virus external connection analysis result includes:

[0034] When the virus external connection analysis result is that the virus external connection is successful, determining the attack device host information corresponding to the ransomware virus;

[0035] Isolating the attack device host information and extracting virus sample information from the virus external connection information;

[0036] A virus processing strategy and a security linkage device are determined according to the virus sample information.

[0037] Optionally, after the step of performing linkage treatment on the ransomware virus according to the virus treatment strategy by the security linkage device, the method further includes:

[0038] Obtaining the linkage disposal result of the ransomware virus;

[0039] Determine the virus attack file according to the virus external connection information;

[0040] Data recovery is performed on the virus-attacked file according to the linkage processing result.

[0041] Optionally, after the step of performing linkage treatment on the ransomware virus according to the virus treatment strategy by the security linkage device, the method further includes:

[0042] Obtain virus infection process information according to the linkage disposal result of the ransomware virus;

[0043] Determine a vulnerability asset library based on the virus external connection information;

[0044] The vulnerability of the virus-attacked device is repaired through the vulnerability asset library according to the virus infection process information.

[0045] Optionally, the step of repairing the vulnerability of the virus-attacked device through the vulnerability asset library according to the virus infection process information includes:

[0046] Analyze the virus infection process information to obtain virus infection node information;

[0047] The vulnerability of the virus-attacked device is repaired through the vulnerability asset library according to the virus-infected node information.

[0048] Optionally, after the step of repairing the vulnerability of the virus-attacked device through the vulnerability asset library according to the virus-infected node information, the step further includes:

[0049] Generate a ransomware virus infection log according to the virus external connection information, the virus disposal strategy, the security linkage device, the virus infection process information, and the virus infection node information;

[0050] The ransomware virus infection log is stored in a preset virus infection library.

[0051] In addition, to achieve the above-mentioned purpose, the present invention also proposes a linkage disposal device based on ransomware virus, and the linkage disposal device based on ransomware virus includes:

[0052] An acquisition module is used to acquire virus feature information corresponding to the ransomware virus when the ransomware virus is detected;

[0053] The acquisition module is further used to acquire virus external connection information when the ransomware virus attacks according to the virus feature information;

[0054] A determination module, used to determine a virus handling strategy and a security linkage device according to the virus external connection information;

[0055] A disposal module is used to perform linkage disposal on the ransomware virus according to the virus disposal strategy through the security linkage device.

[0056] Optionally, the linkage disposal device based on ransomware virus further includes a detection module;

[0057] The detection module is used to obtain access flow information through a flow device;

[0058] The detection module is further used to analyze the access traffic information to obtain the access traffic type;

[0059] The detection module is further used to determine whether the access traffic type is consistent with the preset traffic type;

[0060] The detection module is further configured to determine that a ransomware virus is detected when the access traffic type is consistent with the preset traffic type.

[0061] Optionally, the determination module is further used to analyze the virus external connection information according to a preset joint attack strategy to obtain a virus external connection analysis result;

[0062] The determination module is also used to determine the virus processing strategy and security linkage equipment according to the virus external connection analysis result.

[0063] Optionally, the determination module is further configured to send the virus external connection analysis result to a corresponding management object when the virus external connection analysis result is a virus external connection failure, so that the management object feeds back a virus detection result based on the virus external connection analysis result;

[0064] The determination module is further used to determine a virus processing strategy and a security linkage device according to the virus detection result.

[0065] Optionally, the determination module is further configured to determine the attack device host information corresponding to the ransomware virus when the virus external connection analysis result is that the virus external connection is successful;

[0066] The determination module is further used to isolate the attack device host information and extract virus sample information from the virus external connection information;

[0067] The determination module is further used to determine a virus processing strategy and a security linkage device according to the virus sample information.

[0068] Optionally, the linkage disposal device based on ransomware virus further includes a recovery module;

[0069] The recovery module is used to obtain the linkage disposal result of the ransomware virus;

[0070] The recovery module is further used to determine the virus attack file according to the virus external connection information;

[0071] The recovery module is further used to perform data recovery on the virus attack file according to the linkage processing result.

[0072] In addition, to achieve the above-mentioned purpose, the present invention also proposes a linkage disposal device based on ransomware, the device comprising: a memory, a processor, and a linkage disposal program based on ransomware stored on the memory and executable on the processor, the linkage disposal program based on ransomware being configured to implement the steps of the linkage disposal method based on ransomware as described above.

[0073] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a linkage disposal program based on a ransomware virus is stored. When the linkage disposal program based on a ransomware virus is executed by a processor, the steps of the linkage disposal method based on a ransomware virus as described above are implemented.

[0074] When the ransomware virus is detected, the present invention first obtains the virus feature information corresponding to the ransomware virus, then obtains the virus external connection information when the ransomware virus attacks according to the virus feature information, and determines the virus disposal strategy and the security linkage device according to the virus external connection information, and then the ransomware virus is linked to the virus disposal strategy through the security linkage device. Compared with the prior art that requires users to monitor the ransomware virus in real time, only the decryption private key corresponding to the ransomware virus can be recovered, and the present invention directly determines the virus disposal strategy and the security linkage device according to the virus external connection information, and then the ransomware virus is linked to the virus disposal strategy through the security linkage device, thereby improving the disposal efficiency of the ransomware virus, thereby ensuring the integrity of file recovery, and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 It is a structural schematic diagram of a linkage disposal device based on a ransomware virus in a hardware operating environment involved in an embodiment of the present invention;

[0076] Figure 2 It is a flow chart of the first embodiment of the linkage disposal method based on ransomware virus of the present invention;

[0077] Figure 3 This is a flow chart of a second embodiment of a linkage disposal method based on ransomware virus according to the present invention;

[0078] Figure 4 It is a flow chart of the third embodiment of the linkage disposal method based on ransomware virus of the present invention;

[0079] Figure 5 This is a structural block diagram of the first embodiment of the linkage disposal device based on ransomware virus of the present invention.

[0080] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0081] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0082] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the structure of a linkage disposal device based on a ransomware virus in a hardware operating environment according to an embodiment of the present invention.

[0083] like Figure 1As shown, the linkage disposal device based on ransomware may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0084] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation on the linkage disposal device based on ransomware, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0085] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a linkage disposal program based on the ransomware virus.

[0086] exist Figure 1 In the ransomware-based linkage disposal device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the ransomware-based linkage disposal device of the present invention can be set in the ransomware-based linkage disposal device, and the ransomware-based linkage disposal device calls the ransomware-based linkage disposal program stored in the memory 1005 through the processor 1001, and executes the ransomware-based linkage disposal method provided by the embodiment of the present invention.

[0087] The embodiment of the present invention provides a linkage disposal method based on ransomware virus, referring to Figure 2 , Figure 2 The figure is a flow chart of the first embodiment of the linkage disposal method based on ransomware virus of the present invention.

[0088] In this embodiment, the linkage disposal method based on ransomware virus includes the following steps:

[0089] Step S10: When a ransomware virus is detected, virus feature information corresponding to the ransomware virus is obtained.

[0090] It is easy to understand that the execution subject of this embodiment can be a ransomware-based linkage disposal device with functions such as data processing, network communication and program running, or it can be other computer devices with similar functions, and this embodiment is not limited.

[0091] It is understandable that ransomware is a new type of virus Trojan that accompanies the rise of digital currency. Once a machine is attacked by a ransomware virus, most files will be modified by the encryption algorithm and a special suffix will be added, causing confusion in the virus-attacked files.

[0092] It should be understood that when a ransomware virus is perceived or detected, virus feature information corresponding to the ransomware virus is obtained, where the ransomware virus feature information includes threat intelligence, Sky Eye and Ruiyan traffic logs, and sandbox detection information, etc.

[0093] Furthermore, in order to accurately perceive the ransomware, access traffic information can be obtained through traffic devices, and then the access traffic information is analyzed to obtain the access traffic type, and it is determined whether the access traffic type is consistent with the preset traffic type. When the access traffic type is consistent with the preset traffic type, it is determined that the ransomware is detected.

[0094] It should be noted that the access traffic information may be Inversion Of Control (IOC) traffic information, etc. The access traffic type may be an IOC type, and the preset traffic type may be an IOC type, etc.

[0095] In the specific implementation, access traffic information can be discovered through traffic devices. The traffic device can be a network threat detection and response NDR device or a firewall device, etc. It is necessary to analyze the access traffic information to obtain the access traffic type. If the access traffic type is the IOC type and the preset traffic type is the IOC type, the access traffic type is consistent with the preset traffic type, and it is determined that a ransomware virus is perceived.

[0096] In this embodiment, the ransomware virus can be detected and killed or the server abnormality can be manually discovered through the terminal device. The terminal device can be an endpoint detection and response (EDR) device or anti-virus software.

[0097] Step S20: Obtain virus external connection information when the ransomware virus attacks according to the virus feature information.

[0098] It should also be noted that virus external connection information includes Internet Protocol (IP) information, domain name information, associated family information, attack method, related port information and attack feature information.

[0099] In the specific implementation, threat intelligence, Sky Eye and Ruiyan traffic logs and sandbox detection information can be used to obtain IP information, domain name information, associated family information, attack methods, related port information and attack feature information when the ransomware attacks.

[0100] Step S30: determining a virus handling strategy and a security linkage device according to the virus external connection information.

[0101] Furthermore, in order to accurately obtain virus handling strategies and security linkage devices, the processing method for determining virus handling strategies and security linkage devices based on virus external connection information can be to analyze the virus external connection information according to a preset joint attack strategy to obtain the virus external connection analysis results, and then determine the virus handling strategies and security linkage devices based on the virus external connection analysis results.

[0102] It should be understood that the results of virus external connection analysis include virus external connection failure and virus external connection success, etc. The preset joint attack strategy can be customized by the user, and multiple detection methods are used to determine whether the attack is successful. The multiple detection methods include judging whether there is external connection traffic based on the results of security detection equipment, the alarm feedback of terminal EDR, the matching results of intelligence information, and the joint judgment of multiple device alarm results.

[0103] In this embodiment, the virus external connection information can be attacked and detected in a variety of ways, such as according to the analysis results of the security detection equipment and / or according to the alarm feedback of the terminal EDR and / or according to the matching results of the intelligence information and / or the joint judgment results of the alarm results of multiple devices and / or whether there is external connection traffic, so as to determine the corresponding virus external connection analysis results.

[0104] In a specific implementation, when the virus external connection analysis result is a virus external connection failure, the virus external connection analysis result is sent to the corresponding management object, so that the management object can feedback the virus detection result based on the virus external connection analysis result, and determine the virus processing strategy and security linkage device according to the virus detection result.

[0105] It should be noted that the management object may be the person responsible for the ransomware, and the virus detection result may be information on whether the ransomware is a false positive, etc.

[0106] Furthermore, in order to improve the processing efficiency of virus external connection failure, the processing method of determining the virus processing strategy and the security linkage device according to the virus detection result can be to determine whether the virus detection result meets the virus misjudgment condition. When the virus detection result does not meet the preset virus misjudgment condition, the attack device operation information corresponding to the ransomware virus is obtained, and then the initial linkage device is determined according to the attack device operation information. The ransomware virus is blocked through the initial linkage device according to the attack device operation information to obtain the virus blocking result. When the virus blocking result is a successful blocking, the virus processing strategy and the security linkage device are determined according to the virus blocking result; when the virus blocking result is a blocking failure, the network interconnection protocol information and domain name information corresponding to the ransomware virus are obtained, and then the internet interconnection protocol information and domain name information are blocked through the initial linkage device, and a virus blocking log is generated according to the internet interconnection protocol information and domain name information.

[0107] It should also be understood that the initial linkage device may be a firewall device, and the attack device operation information may be the operation information of the device currently attacked by the ransomware virus, etc. The virus blocking log includes ransomware virus related information, ransomware virus blocking results, Internet interconnection protocol information and domain name information corresponding to the ransomware virus, etc.

[0108] Furthermore, in order to improve the efficiency of virus misjudgment, when the virus detection result meets the preset virus misjudgment condition, a misjudgment report is generated according to the virus external connection information and the virus detection result, and then the virus alarm strategy is determined according to the virus misjudgment report.

[0109] Assuming that the result of the virus external connection analysis is that the virus external connection fails, the virus external connection analysis result will be notified to the relevant personnel via SMS. After that, the relevant personnel need to manually check the virus external connection information to determine whether there is a misjudgment of the ransomware virus. If there is a misjudgment of the ransomware virus, the relevant personnel also need to optimize the relevant virus detection equipment, etc.; when there is no misjudgment of the ransomware virus, the firewall device can be linked to ban the ransomware virus. If it is detected that the firewall device has not banned the ransomware virus, the IP information and domain name information of the ransomware virus need to be banned; if it is detected that the firewall device has banned the ransomware virus, it is necessary to link the TianQing device to perform antivirus, etc.

[0110] In a specific implementation, when the virus external connection analysis result is that the virus external connection is successful, the attack device host information corresponding to the ransomware virus is determined, the attack device host information is isolated, and the virus sample information is extracted from the virus external connection information, and the virus processing strategy and security linkage device are determined based on the virus sample information.

[0111] Assuming that the ransomware is successfully connected to the outside world, it is necessary to enter the emergency disposal process and promptly block the IP information and domain name information of the ransomware. At the same time, the victim host, that is, the attacking device host, is identified and isolated. The virus sample information is randomly extracted from the virus external connection information, and the virus handling strategy and security linkage equipment are determined based on the virus sample information.

[0112] It should be noted that the security linkage device can be a TianQing device and a sandbox device, and the virus processing strategy can be to link the TianQing device to disinfect the ransomware, or to link the sandbox device to analyze the ransomware.

[0113] Step S40: Linkage processing is performed on the ransomware virus according to the virus processing strategy through the security linkage device.

[0114] In the specific implementation, when the virus sample information is extracted, the sandbox device can be linked to analyze the ransomware virus; when the virus sample information is not extracted, the TianQing device can be linked to clear the ransomware virus.

[0115] Furthermore, in order to improve the processing efficiency of ransomware, after the steps of linking and disposing the ransomware according to the virus disposal strategy through the security linkage device, it is also necessary to obtain the virus infection process information according to the linkage disposal result of the ransomware, and determine the vulnerability asset library according to the virus external connection information. Finally, the virus infection process information is analyzed to obtain the virus infection node information, and the vulnerability of the virus attack device is repaired through the vulnerability asset library according to the virus infection node information.

[0116] In this embodiment, when the ransomware is successfully handled, a manual process is entered to try to restore the data. The virus infection and spread process can also be restored based on logs and traffic through Sky Eye devices, Ruiyan devices, System on Chip (SoC) devices, local brain devices, terminal log information, etc. to find security vulnerabilities, and the vulnerability asset library is linked to repair the vulnerabilities through patching, software upgrades, etc.

[0117] Furthermore, in order to facilitate real-time understanding of the changes in the ransomware, after the vulnerability of the virus attack device is repaired through the vulnerability asset library according to the virus infection node information, the ransomware infection log can be generated according to the virus external connection information, virus disposal strategy, security linkage equipment, virus infection process information and virus infection node information, and the ransomware infection log can be stored in the preset virus infection library, so that the user can timely view the ransomware infection log in the preset virus infection library.

[0118] It should also be noted that relevant personnel can also summarize and review the reasons for the intrusion and the deficiencies in recovering data or business based on the ransomware infection logs, and improve the overall security capabilities based on the current situation.

[0119] In this embodiment, when a ransomware virus is detected, the virus feature information corresponding to the ransomware virus is first obtained, and then the virus external connection information when the ransomware virus attacks is obtained according to the virus feature information, and the virus disposal strategy and the security linkage device are determined according to the virus external connection information, and then the ransomware virus is linked to the virus disposal strategy through the security linkage device. Compared with the prior art, which requires users to monitor the ransomware virus in real time, only the decryption private key corresponding to the ransomware virus can be recovered, and in this embodiment, the virus disposal strategy and the security linkage device are directly determined according to the virus external connection information, and then the ransomware virus is linked to the virus disposal strategy through the security linkage device, thereby improving the disposal efficiency of the ransomware virus and ensuring the integrity of the file recovery.

[0120] refer to Figure 3 , Figure 3 It is a flow chart of the second embodiment of the linkage disposal method based on ransomware virus of the present invention.

[0121] Based on the above first embodiment, in this embodiment, step S30 includes:

[0122] Step S301: Analyze the virus external connection information according to a preset joint attack strategy to obtain a virus external connection analysis result.

[0123] It should be understood that the results of virus external connection analysis include virus external connection failure and virus external connection success, etc. The preset joint attack strategy can be customized by the user, and multiple detection methods are used to determine whether the attack is successful. The multiple detection methods include judging whether there is external connection traffic based on the results of security detection equipment, the alarm feedback of terminal EDR, the matching results of intelligence information, and the joint judgment of multiple device alarm results.

[0124] In this embodiment, the virus external connection information can be attacked and detected in a variety of ways, such as according to the analysis results of the security detection equipment and / or according to the alarm feedback of the terminal EDR and / or according to the matching results of the intelligence information and / or the joint judgment results of the alarm results of multiple devices and / or whether there is external connection traffic, so as to determine the corresponding virus external connection analysis results.

[0125] Step S302: Determine a virus processing strategy and a security linkage device according to the virus external connection analysis result.

[0126] In a specific implementation, when the virus external connection analysis result is a virus external connection failure, the virus external connection analysis result is sent to the corresponding management object, so that the management object can feedback the virus detection result based on the virus external connection analysis result, and determine the virus processing strategy and security linkage device according to the virus detection result.

[0127] It should be noted that the management object may be the person responsible for the ransomware, and the virus detection result may be information on whether the ransomware is a false positive, etc.

[0128] Furthermore, in order to improve the processing efficiency of virus external connection failure, the processing method of determining the virus processing strategy and the security linkage device according to the virus detection result can be to determine whether the virus detection result meets the virus misjudgment condition. When the virus detection result does not meet the preset virus misjudgment condition, the attack device operation information corresponding to the ransomware virus is obtained, and then the initial linkage device is determined according to the attack device operation information. The ransomware virus is blocked through the initial linkage device according to the attack device operation information to obtain the virus blocking result. When the virus blocking result is a successful blocking, the virus processing strategy and the security linkage device are determined according to the virus blocking result; when the virus blocking result is a blocking failure, the network interconnection protocol information and domain name information corresponding to the ransomware virus are obtained, and then the internet interconnection protocol information and domain name information are blocked through the initial linkage device, and a virus blocking log is generated according to the internet interconnection protocol information and domain name information.

[0129] It should also be understood that the initial linkage device may be a firewall device, and the attack device operation information may be the operation information of the device currently attacked by the ransomware virus, etc. The virus blocking log includes ransomware virus related information, ransomware virus blocking results, Internet interconnection protocol information and domain name information corresponding to the ransomware virus, etc.

[0130] Furthermore, in order to improve the efficiency of virus misjudgment, when the virus detection result meets the preset virus misjudgment condition, a misjudgment report is generated according to the virus external connection information and the virus detection result, and then the virus alarm strategy is determined according to the virus misjudgment report.

[0131] Assuming that the result of the virus external connection analysis is that the virus external connection fails, the virus external connection analysis result will be notified to the relevant personnel via SMS. After that, the relevant personnel need to manually check the virus external connection information to determine whether there is a misjudgment of the ransomware virus. If there is a misjudgment of the ransomware virus, the relevant personnel also need to optimize the relevant virus detection equipment, etc.; when there is no misjudgment of the ransomware virus, the firewall device can be linked to ban the ransomware virus. If it is detected that the firewall device has not banned the ransomware virus, the IP information and domain name information of the ransomware virus need to be banned; if it is detected that the firewall device has banned the ransomware virus, it is necessary to link the TianQing device to perform antivirus, etc.

[0132] In a specific implementation, when the virus external connection analysis result is that the virus external connection is successful, the attack device host information corresponding to the ransomware virus is determined, the attack device host information is isolated, and the virus sample information is extracted from the virus external connection information, and the virus processing strategy and security linkage device are determined based on the virus sample information.

[0133] Assuming that the ransomware is successfully connected to the outside world, it is necessary to enter the emergency disposal process and promptly block the IP information and domain name information of the ransomware. At the same time, the victim host, that is, the attacking device host, is identified and isolated. The virus sample information is randomly extracted from the virus external connection information, and the virus handling strategy and security linkage equipment are determined based on the virus sample information.

[0134] It should be noted that the security linkage device can be a TianQing device and a sandbox device, and the virus processing strategy can be to link the TianQing device to disinfect the ransomware, or to link the sandbox device to analyze the ransomware.

[0135] In this embodiment, the virus external connection information is analyzed according to the preset joint attack strategy to obtain the virus external connection analysis results, and then the virus processing strategy and the security linkage device are determined according to the virus external connection analysis results. Compared with the prior art that directly disinfects the virus, this embodiment needs to first analyze the virus external connection information, and then determine the virus processing strategy and the security linkage device according to the obtained virus external connection analysis results, thereby realizing the accurate determination of the virus processing measures, thereby improving the virus processing efficiency.

[0136] refer to Figure 4 , Figure 4 It is a flow chart of the third embodiment of the linkage disposal method based on ransomware virus of the present invention.

[0137] Based on the first embodiment above, in this embodiment, after step S40, the following steps are further included:

[0138] Step S50: Obtain virus infection process information according to the linkage processing result of the ransomware virus.

[0139] It should be noted that the linkage disposal results of ransomware include successful ransomware disposal and failed ransomware disposal, etc. The virus infection process information can be understood as the process information from the start of the ransomware attack to the completion of ransomware removal.

[0140] In this embodiment, when the ransomware is successfully handled, a manual process is entered to try to restore the data. The virus infection and spread process can also be restored based on the logs and traffic through the Sky Eye device, the Ruiyan device, the SoC device, the local brain device, the terminal log information, etc.

[0141] Step S60: Determine a vulnerability asset library according to the virus external connection information.

[0142] It should be understood that the vulnerability asset library can be understood as the linkage devices corresponding to the ransomware virus, etc.

[0143] Step S70: repairing the vulnerability of the virus-attacked device through the vulnerability asset library according to the virus infection process information.

[0144] Furthermore, in order to speed up the vulnerability repair efficiency, the method for repairing the vulnerability of the virus attack device through the vulnerability asset library according to the virus infection process information can be to analyze the virus infection process information, obtain the virus infection node information, and then repair the vulnerability of the virus attack device through the vulnerability asset library according to the virus infection node information.

[0145] In the specific implementation, security vulnerabilities can be found according to the virus infection and spread process, and the vulnerability asset library can be linked to repair the vulnerabilities through patching, software upgrades, etc.

[0146] Furthermore, in order to facilitate real-time understanding of the changes in the ransomware, after the vulnerability of the virus attack device is repaired through the vulnerability asset library according to the virus infection node information, the ransomware infection log can be generated according to the virus external connection information, virus disposal strategy, security linkage equipment, virus infection process information and virus infection node information, and the ransomware infection log can be stored in the preset virus infection library, so that the user can timely view the ransomware infection log in the preset virus infection library.

[0147] It should also be noted that relevant personnel can also summarize and review the reasons for the intrusion and the deficiencies in recovering data or business based on the ransomware infection logs, and improve the overall security capabilities based on the current situation.

[0148] In this embodiment, the virus infection process information is obtained according to the linkage disposal result of the ransomware virus, and the vulnerability asset library is determined according to the virus external connection information. Finally, the vulnerability of the virus attack device is repaired through the vulnerability asset library according to the virus infection process information. Compared with the prior art, the vulnerability of the virus attack device is not repaired, and the virus attack device is only marked. In this embodiment, the virus infection process information can be analyzed, and then the vulnerability of the virus attack device is repaired through the vulnerability asset library, thereby improving the vulnerability repair efficiency and ensuring the security of the virus attack device.

[0149] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the linkage disposal device based on ransomware virus of the present invention.

[0150] like Figure 5 As shown, the linkage disposal device based on ransomware virus proposed in the embodiment of the present invention includes:

[0151] The acquisition module 5001 is used to acquire virus feature information corresponding to the ransomware virus when the ransomware virus is detected.

[0152] It is understandable that ransomware is a new type of virus Trojan that accompanies the rise of digital currency. Once a machine is attacked by a ransomware virus, most files will be modified by the encryption algorithm and a special suffix will be added, causing confusion in the virus-attacked files.

[0153] It should be understood that when a ransomware virus is perceived or detected, virus feature information corresponding to the ransomware virus is obtained, where the ransomware virus feature information includes threat intelligence, Sky Eye and Ruiyan traffic logs, and sandbox detection information, etc.

[0154] Furthermore, in order to accurately perceive the ransomware, access traffic information can be obtained through traffic devices, and then the access traffic information is analyzed to obtain the access traffic type, and it is determined whether the access traffic type is consistent with the preset traffic type. When the access traffic type is consistent with the preset traffic type, it is determined that the ransomware is detected.

[0155] It should be noted that the access traffic information may be Inversion Of Control (IOC) traffic information, etc. The access traffic type may be an IOC type, and the preset traffic type may be an IOC type, etc.

[0156] In the specific implementation, access traffic information can be discovered through traffic devices. The traffic device can be an NDR device or a firewall device, etc. The access traffic information needs to be analyzed to obtain the access traffic type. If the access traffic type is the IOC type and the preset traffic type is the IOC type, the access traffic type is consistent with the preset traffic type, and it is determined that a ransomware virus is sensed.

[0157] In this embodiment, the ransomware virus can be checked and killed or server anomalies can be manually discovered through the terminal device, and the terminal device can be an EDR device or anti-virus software.

[0158] The acquisition module 5001 is further used to acquire virus external connection information when the ransomware virus attacks according to the virus feature information.

[0159] It should also be noted that virus external connection information includes IP information, domain name information, associated family information, attack method, related port information and attack feature information, etc.

[0160] In the specific implementation, threat intelligence, Sky Eye and Ruiyan traffic logs and sandbox detection information can be used to obtain IP information, domain name information, associated family information, attack methods, related port information and attack feature information when the ransomware attacks.

[0161] The determination module 5002 is used to determine the virus handling strategy and security linkage equipment according to the virus external connection information.

[0162] Furthermore, in order to accurately obtain virus handling strategies and security linkage devices, the processing method for determining virus handling strategies and security linkage devices based on virus external connection information can be to analyze the virus external connection information according to a preset joint attack strategy to obtain the virus external connection analysis results, and then determine the virus handling strategies and security linkage devices based on the virus external connection analysis results.

[0163] It should be understood that the results of virus external connection analysis include virus external connection failure and virus external connection success, etc. The preset joint attack strategy can be customized by the user, and multiple detection methods are used to determine whether the attack is successful. The multiple detection methods include judging whether there is external connection traffic based on the results of security detection equipment, the alarm feedback of terminal EDR, the matching results of intelligence information, and the joint judgment of multiple device alarm results.

[0164] In this embodiment, the virus external connection information can be attacked and detected in a variety of ways, such as according to the analysis results of the security detection equipment and / or according to the alarm feedback of the terminal EDR and / or according to the matching results of the intelligence information and / or the joint judgment results of the alarm results of multiple devices and / or whether there is external connection traffic, so as to determine the corresponding virus external connection analysis results.

[0165] In a specific implementation, when the virus external connection analysis result is a virus external connection failure, the virus external connection analysis result is sent to the corresponding management object, so that the management object can feedback the virus detection result based on the virus external connection analysis result, and determine the virus processing strategy and security linkage device according to the virus detection result.

[0166] It should be noted that the management object may be the person responsible for the ransomware, and the virus detection result may be information on whether the ransomware is a false positive, etc.

[0167] Furthermore, in order to improve the processing efficiency of virus external connection failure, the processing method of determining the virus processing strategy and the security linkage device according to the virus detection result can be to determine whether the virus detection result meets the virus misjudgment condition. When the virus detection result does not meet the preset virus misjudgment condition, the attack device operation information corresponding to the ransomware virus is obtained, and then the initial linkage device is determined according to the attack device operation information. The ransomware virus is blocked through the initial linkage device according to the attack device operation information to obtain the virus blocking result. When the virus blocking result is a successful blocking, the virus processing strategy and the security linkage device are determined according to the virus blocking result; when the virus blocking result is a blocking failure, the network interconnection protocol information and domain name information corresponding to the ransomware virus are obtained, and then the internet interconnection protocol information and domain name information are blocked through the initial linkage device, and a virus blocking log is generated according to the internet interconnection protocol information and domain name information.

[0168] It should also be understood that the initial linkage device may be a firewall device, and the attack device operation information may be the operation information of the device currently attacked by the ransomware virus, etc. The virus blocking log includes ransomware virus related information, ransomware virus blocking results, Internet interconnection protocol information and domain name information corresponding to the ransomware virus, etc.

[0169] Furthermore, in order to improve the efficiency of virus misjudgment, when the virus detection result meets the preset virus misjudgment condition, a misjudgment report is generated according to the virus external connection information and the virus detection result, and then the virus alarm strategy is determined according to the virus misjudgment report.

[0170] Assuming that the result of the virus external connection analysis is that the virus external connection fails, the virus external connection analysis result will be notified to the relevant personnel via SMS. After that, the relevant personnel need to manually check the virus external connection information to determine whether there is a misjudgment of the ransomware virus. If there is a misjudgment of the ransomware virus, the relevant personnel also need to optimize the relevant virus detection equipment, etc.; when there is no misjudgment of the ransomware virus, the firewall device can be linked to ban the ransomware virus. If it is detected that the firewall device has not banned the ransomware virus, the IP information and domain name information of the ransomware virus need to be banned; if it is detected that the firewall device has banned the ransomware virus, it is necessary to link the TianQing device to perform antivirus, etc.

[0171] In a specific implementation, when the virus external connection analysis result is that the virus external connection is successful, the attack device host information corresponding to the ransomware virus is determined, the attack device host information is isolated, and the virus sample information is extracted from the virus external connection information, and the virus processing strategy and security linkage device are determined based on the virus sample information.

[0172] Assuming that the ransomware is successfully connected to the outside world, it is necessary to enter the emergency disposal process and promptly block the IP information and domain name information of the ransomware. At the same time, the victim host, that is, the attacking device host, is identified and isolated. The virus sample information is randomly extracted from the virus external connection information, and the virus handling strategy and security linkage equipment are determined based on the virus sample information.

[0173] It should be noted that the security linkage device can be a TianQing device and a sandbox device, and the virus processing strategy can be to link the TianQing device to disinfect the ransomware, or to link the sandbox device to analyze the ransomware.

[0174] The handling module 5003 is used to perform linkage handling on the ransomware virus according to the virus handling strategy through the security linkage device.

[0175] In the specific implementation, when the virus sample information is extracted, the sandbox device can be linked to analyze the ransomware virus; when the virus sample information is not extracted, the TianQing device can be linked to clear the ransomware virus.

[0176] Furthermore, in order to improve the processing efficiency of ransomware, after the steps of linking and disposing the ransomware according to the virus disposal strategy through the security linkage device, it is also necessary to obtain the virus infection process information according to the linkage disposal result of the ransomware, and determine the vulnerability asset library according to the virus external connection information. Finally, the virus infection process information is analyzed to obtain the virus infection node information, and the vulnerability of the virus attack device is repaired through the vulnerability asset library according to the virus infection node information.

[0177] In this embodiment, when the ransomware is successfully handled, a manual process is entered to try to restore the data. The virus infection and spread process can also be restored based on logs and traffic through Sky Eye devices, Ruiyan devices, SoC devices, local brain devices, terminal log information, etc. to find security vulnerabilities, and the vulnerability asset library is linked to repair vulnerabilities through patching, software upgrades, etc.

[0178] Furthermore, in order to facilitate real-time understanding of the changes in the ransomware, after the vulnerability of the virus attack device is repaired through the vulnerability asset library according to the virus infection node information, the ransomware infection log can be generated according to the virus external connection information, virus disposal strategy, security linkage equipment, virus infection process information and virus infection node information, and the ransomware infection log can be stored in the preset virus infection library, so that the user can timely view the ransomware infection log in the preset virus infection library.

[0179] It should also be noted that relevant personnel can also summarize and review the reasons for the intrusion and the deficiencies in recovering data or business based on the ransomware infection logs, and improve the overall security capabilities based on the current situation.

[0180] In this embodiment, when a ransomware virus is detected, the virus feature information corresponding to the ransomware virus is first obtained, and then the virus external connection information when the ransomware virus attacks is obtained according to the virus feature information, and the virus disposal strategy and the security linkage device are determined according to the virus external connection information, and then the ransomware virus is linked to the virus disposal strategy through the security linkage device. Compared with the prior art, which requires users to monitor the ransomware virus in real time, only the decryption private key corresponding to the ransomware virus can be recovered, and in this embodiment, the virus disposal strategy and the security linkage device are directly determined according to the virus external connection information, and then the ransomware virus is linked to the virus disposal strategy through the security linkage device, thereby improving the disposal efficiency of the ransomware virus and ensuring the integrity of the file recovery.

[0181] Furthermore, the linkage disposal device based on ransomware virus also includes a detection module;

[0182] The detection module is used to obtain access flow information through a flow device;

[0183] The detection module is further used to analyze the access traffic information to obtain the access traffic type;

[0184] The detection module is further used to determine whether the access traffic type is consistent with the preset traffic type;

[0185] The detection module is further configured to determine that a ransomware virus is detected when the access traffic type is consistent with the preset traffic type.

[0186] Furthermore, the determination module 5002 is further configured to analyze the virus external connection information according to a preset joint attack strategy to obtain a virus external connection analysis result;

[0187] The determination module 5002 is further used to determine a virus processing strategy and a security linkage device according to the virus external connection analysis result.

[0188] Furthermore, the determination module 5002 is further configured to send the virus external connection analysis result to a corresponding management object when the virus external connection analysis result is a virus external connection failure, so that the management object feeds back a virus detection result based on the virus external connection analysis result;

[0189] The determination module 5002 is further configured to determine a virus handling strategy and a security linkage device according to the virus detection result.

[0190] Furthermore, the determination module 5002 is further configured to determine the attacking device host information corresponding to the ransomware virus when the virus external connection analysis result is that the virus external connection is successful;

[0191] The determination module 5002 is further used to isolate the attack device host information and extract virus sample information from the virus external connection information;

[0192] The determination module 5002 is further configured to determine a virus processing strategy and a security linkage device according to the virus sample information.

[0193] Furthermore, the linkage disposal device based on ransomware virus also includes a recovery module;

[0194] The recovery module is used to obtain the linkage disposal result of the ransomware virus;

[0195] The recovery module is further used to determine the virus attack file according to the virus external connection information;

[0196] The recovery module is further used to perform data recovery on the virus attack file according to the linkage processing result.

[0197] Other embodiments or specific implementations of the linkage disposal device based on ransomware virus of the present invention can refer to the above-mentioned method embodiments, which will not be repeated here.

[0198] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0199] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0200] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0201] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0202] The present invention also discloses A1, a linkage disposal method based on ransomware virus, the linkage disposal method based on ransomware virus comprising the following steps:

[0203] When a ransomware virus is detected, obtaining virus feature information corresponding to the ransomware virus;

[0204] Obtain virus external connection information when the ransomware virus attacks according to the virus feature information;

[0205] Determine a virus handling strategy and a security linkage device according to the virus external connection information;

[0206] The ransomware virus is linked and disposed of according to the virus disposal strategy through the security linkage device.

[0207] A2. The method as described in A1, before the step of obtaining virus feature information corresponding to the ransomware virus when the ransomware virus is detected, further comprising:

[0208] Obtain access traffic information through traffic devices;

[0209] Analyze the access traffic information to obtain the access traffic type;

[0210] Determining whether the access traffic type is consistent with the preset traffic type;

[0211] When the access traffic type is consistent with the preset traffic type, it is determined that a ransomware virus is detected.

[0212] A3. As described in A1, the step of determining the virus handling strategy and the security linkage device according to the virus external connection information comprises:

[0213] Analyze the virus external connection information according to the preset joint attack strategy to obtain the virus external connection analysis result;

[0214] The virus processing strategy and security linkage equipment are determined according to the virus external connection analysis result.

[0215] A4. The method as described in A3, wherein the step of determining the virus processing strategy and the security linkage device according to the virus external connection analysis result comprises:

[0216] When the virus external connection analysis result is a virus external connection failure, sending the virus external connection analysis result to a corresponding management object, so that the management object feeds back a virus detection result based on the virus external connection analysis result;

[0217] A virus handling strategy and a security linkage device are determined according to the virus detection result.

[0218] A5. The method as described in A4, wherein the step of determining the virus handling strategy and the security linkage device according to the virus detection result comprises:

[0219] Determining whether the virus detection result meets a virus misjudgment condition;

[0220] When the virus detection result does not meet the preset virus misjudgment condition, obtaining the attack device operation information corresponding to the ransomware virus;

[0221] Determine an initial linkage device according to the attack device operation information;

[0222] According to the attack device operation information, the ransomware virus is blocked through the initial linkage device to obtain a virus blocking result;

[0223] When the virus blocking result is a successful blocking, a virus processing strategy and a security linkage device are determined according to the virus blocking result.

[0224] A6. The method as described in A5, after the step of determining whether the virus detection result meets the virus misjudgment condition, further comprising:

[0225] When the virus detection result meets the preset virus misjudgment condition, generating a virus misjudgment report according to the virus external connection information and the virus detection result;

[0226] A virus warning strategy is determined based on the virus misjudgment report.

[0227] A7. The method as described in A5, after the step of blocking the ransomware virus through the initial linkage device according to the attacking device information to obtain the virus blocking result, further includes:

[0228] When the virus blocking result is a blocking failure, obtaining Internet interconnection protocol information and domain name information corresponding to the ransomware virus;

[0229] The internet protocol information and the domain name information are blocked by the initial linkage device, and a virus blocking log is generated according to the internet protocol information and the domain name information.

[0230] A8. The method as described in A3, wherein the step of determining the virus processing strategy and the security linkage device according to the virus external connection analysis result comprises:

[0231] When the virus external connection analysis result is that the virus external connection is successful, determining the attack device host information corresponding to the ransomware virus;

[0232] Isolating the attack device host information and extracting virus sample information from the virus external connection information;

[0233] A virus processing strategy and a security linkage device are determined according to the virus sample information.

[0234] A9. The method as described in any one of A1 to A8, after the step of using the security linkage device to perform linkage treatment on the ransomware virus according to the virus treatment strategy, further comprising:

[0235] Obtaining the linkage disposal result of the ransomware virus;

[0236] Determine the virus attack file according to the virus external connection information;

[0237] Data recovery is performed on the virus-attacked file according to the linkage processing result.

[0238] A10. The method as described in any one of A1 to A8, after the step of performing linkage treatment on the ransomware virus according to the virus treatment strategy by the security linkage device, further comprising:

[0239] Obtain virus infection process information according to the linkage disposal result of the ransomware virus;

[0240] Determine a vulnerability asset library based on the virus external connection information;

[0241] The vulnerability of the virus-attacked device is repaired through the vulnerability asset library according to the virus infection process information.

[0242] A11. The method as described in A10, wherein the step of repairing the vulnerability of the virus-attacked device through the vulnerability asset library according to the virus infection process information comprises:

[0243] Analyze the virus infection process information to obtain virus infection node information;

[0244] The vulnerability of the virus-attacked device is repaired through the vulnerability asset library according to the virus-infected node information.

[0245] A12. The method as described in A11, after the step of repairing the vulnerability of the virus-attacked device through the vulnerability asset library according to the virus-infected node information, further comprising:

[0246] Generate a ransomware virus infection log according to the virus external connection information, the virus disposal strategy, the security linkage device, the virus infection process information, and the virus infection node information;

[0247] The ransomware virus infection log is stored in a preset virus infection library.

[0248] The present invention also discloses B13, a linkage processing device based on a ransomware virus, the linkage processing device based on a ransomware virus comprising:

[0249] An acquisition module is used to acquire virus feature information corresponding to the ransomware virus when the ransomware virus is detected;

[0250] The acquisition module is further used to acquire virus external connection information when the ransomware virus attacks according to the virus feature information;

[0251] A determination module, used to determine a virus handling strategy and a security linkage device according to the virus external connection information;

[0252] A disposal module is used to perform linkage disposal on the ransomware virus according to the virus disposal strategy through the security linkage device.

[0253] B14. The device as described in B13, wherein the linkage disposal device based on ransomware virus further includes a detection module;

[0254] The detection module is used to obtain access flow information through a flow device;

[0255] The detection module is further used to analyze the access traffic information to obtain the access traffic type;

[0256] The detection module is further used to determine whether the access traffic type is consistent with the preset traffic type;

[0257] The detection module is further configured to determine that a ransomware virus is detected when the access traffic type is consistent with the preset traffic type.

[0258] B15. In the device described in B13, the determination module is further used to analyze the virus external connection information according to a preset joint attack strategy to obtain a virus external connection analysis result;

[0259] The determination module is also used to determine the virus processing strategy and security linkage equipment according to the virus external connection analysis result.

[0260] B16. The device as described in B15, wherein the determining module is further used to send the virus external connection analysis result to the corresponding management object when the virus external connection analysis result is a virus external connection failure, so that the management object feeds back a virus detection result based on the virus external connection analysis result;

[0261] The determination module is further used to determine a virus processing strategy and a security linkage device according to the virus detection result.

[0262] B17. The device as described in B15, wherein the determination module is further used to determine the attack device host information corresponding to the ransomware virus when the virus external connection analysis result is that the virus external connection is successful;

[0263] The determination module is further used to isolate the attack device host information and extract virus sample information from the virus external connection information;

[0264] The determination module is further used to determine a virus processing strategy and a security linkage device according to the virus sample information.

[0265] B18. The device as described in any one of B13 to B17, wherein the linkage disposal device based on ransomware virus further includes a recovery module;

[0266] The recovery module is used to obtain the linkage disposal result of the ransomware virus;

[0267] The recovery module is further used to determine the virus attack file according to the virus external connection information;

[0268] The recovery module is further used to perform data recovery on the virus attack file according to the linkage processing result.

[0269] The present invention also discloses C19, a linkage disposal device based on ransomware virus, the linkage disposal device based on ransomware virus comprising: a memory, a processor, and a linkage disposal program based on ransomware virus stored in the memory and executable on the processor, the linkage disposal program based on ransomware virus being configured with steps for implementing the linkage disposal method based on ransomware virus as described above.

[0270] The present invention also discloses D20, a storage medium, on which a linkage disposal program based on a ransomware virus is stored. When the linkage disposal program based on a ransomware virus is executed by a processor, the steps of the linkage disposal method based on a ransomware virus as described above are implemented.

Claims

1. A linkage disposal method based on ransomware, characterized in that: The linkage disposal method based on ransomware virus includes the following steps: When a ransomware virus is detected, obtaining virus feature information corresponding to the ransomware virus; Obtain virus external connection information when the ransomware virus attacks according to the virus feature information; Determine a virus handling strategy and a security linkage device according to the virus external connection information; The ransomware virus is linked and disposed of according to the virus disposal strategy through the security linkage device.

2. The method according to claim 1, characterized in that Before the step of obtaining virus feature information corresponding to the ransomware virus when the ransomware virus is detected, the method further includes: Obtain access traffic information through traffic devices; Analyze the access traffic information to obtain the access traffic type; Determining whether the access traffic type is consistent with the preset traffic type; When the access traffic type is consistent with the preset traffic type, it is determined that a ransomware virus is detected.

3. The method according to claim 1, characterized in that The step of determining a virus handling strategy and a security linkage device according to the virus external connection information includes: Analyze the virus external connection information according to the preset joint attack strategy to obtain the virus external connection analysis result; The virus processing strategy and security linkage equipment are determined according to the virus external connection analysis result.

4. The method according to claim 3, characterized in that The step of determining a virus processing strategy and a security linkage device according to the virus external connection analysis result includes: When the virus external connection analysis result is a virus external connection failure, sending the virus external connection analysis result to a corresponding management object, so that the management object feeds back a virus detection result based on the virus external connection analysis result; A virus handling strategy and a security linkage device are determined according to the virus detection result.

5. The method according to claim 4, characterized in that The step of determining a virus handling strategy and a security linkage device according to the virus detection result includes: Determining whether the virus detection result meets a virus misjudgment condition; When the virus detection result does not meet the preset virus misjudgment condition, obtaining the attack device operation information corresponding to the ransomware virus; Determine an initial linkage device according to the attack device operation information; According to the attack device operation information, the ransomware virus is blocked through the initial linkage device to obtain a virus blocking result; When the virus blocking result is a successful blocking, a virus processing strategy and a security linkage device are determined according to the virus blocking result.

6. The method according to any one of claims 1 to 5, characterized in that: After the step of performing linkage treatment on the ransomware virus according to the virus treatment strategy by the security linkage device, the method further includes: Obtaining the linkage disposal result of the ransomware virus; Determine the virus attack file according to the virus external connection information; Data recovery is performed on the virus-attacked file according to the linkage processing result.

7. The method according to any one of claims 1 to 5, characterized in that: After the step of performing linkage treatment on the ransomware virus according to the virus treatment strategy by the security linkage device, the method further includes: Obtain virus infection process information according to the linkage disposal result of the ransomware virus; Determine a vulnerability asset library based on the virus external connection information; The vulnerability of the virus-attacked device is repaired through the vulnerability asset library according to the virus infection process information.

8. A linkage disposal device based on ransomware, characterized in that: The linkage disposal device based on ransomware virus includes: An acquisition module is used to acquire virus feature information corresponding to the ransomware virus when the ransomware virus is detected; The acquisition module is further used to acquire virus external connection information when the ransomware virus attacks according to the virus feature information; A determination module, used to determine a virus handling strategy and a security linkage device according to the virus external connection information; A disposal module is used to perform linkage disposal on the ransomware virus according to the virus disposal strategy through the security linkage device.

9. A linkage disposal device based on ransomware, characterized in that: The ransomware-based linkage disposal device includes: a memory, a processor, and a ransomware-based linkage disposal program stored in the memory and executable on the processor, wherein the ransomware-based linkage disposal program is configured with steps for implementing the ransomware-based linkage disposal method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a linkage disposal program based on a ransomware virus, and when the linkage disposal program based on a ransomware virus is executed by a processor, the steps of the linkage disposal method based on a ransomware virus according to any one of claims 1 to 7 are implemented.

Images