Method and system for identifying data ransomware based on process behavior

Abstract

The invention provides a method and system for identifying data ransomware based on process behaviors, and relates to the technical field of computers.The method comprises the steps that bait files are created under a key directory, the bait files comprise entity bait files and virtual bait files, the entity bait files are used for attracting the attention of ransomware, and the virtual bait files are used for attracting the attention of ransomware; the virtual bait file is used for capturing a preliminary probing behavior for the sensitive directory; acquiring an access behavior to the bait file in real time, and processing and analyzing the access behavior to obtain an access behavior analysis result; and a security decision instruction is generated based on the monitoring data and the access behavior analysis result, so that normal behaviors and malicious behaviors are effectively distinguished, the false alarm rate is reduced, a new ransomware strategy can be adapted, comprehensive and prospective protection measures can be provided, and data security is ensured to be prevented from being invaded.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and system for identifying data extortion based on process behavior. Background Art

[0002] With the rapid development of information technology, data has become one of the most valuable assets for enterprises and individuals, and plays a core role in the digital transformation of all industries. From cloud computing to the Internet of Things, from big data analysis to artificial intelligence applications, the sharp increase in data volume and the continuous increase in value have brought unprecedented opportunities to enterprises. However, this trend is also accompanied by a significant increase in data security risks, especially new network threats such as ransomware attacks, which have become a major challenge to enterprise data security.

[0003] Ransomware is a type of malicious software that infiltrates the system, encrypts key data files, and demands that the victim pay a ransom in exchange for a decryption key. This type of attack not only targets personal computers, but is also increasingly spreading to corporate servers and public infrastructure, causing huge economic losses and reputation damage to the victims. The mechanism of ransomware attacks usually includes steps such as propagation, execution, encryption, display of ransom information, and decryption. The degree of variation and customization of ransomware is constantly increasing, making it difficult for traditional defense strategies such as firewalls and antivirus software to effectively respond.

[0004] Traditional defense strategies, such as firewalls and antivirus software, mainly rely on known virus definitions and behavior patterns for protection. However, in the face of the continuous evolution of ransomware, these measures have problems such as slow response, high false alarm rate, and poor adaptability. Malicious processes often evade detection by imitating normal software behavior or exploiting zero-day vulnerabilities. Therefore, traditional methods based on signature recognition and static rules can no longer meet the needs of modern network security.

[0005] There are many data security solutions on the market, such as Symantec Endpoint Protection, Kaspersky Anti-Ransomware Tool, and Microsoft Defender for Endpoint. These solutions combine signature recognition, behavior monitoring, and machine learning technologies to improve protection. However, they still face many challenges, such as low recognition rates for new or customized ransomware, insufficient response time to provide effective protection when facing new or highly customized ransomware attacks, overly strict behavior analysis standards and reliance on cloud services may lead to high false positive rates, affecting user experience, and system performance may be affected when processing large amounts of data, especially in enterprise environments. Summary of the invention

[0006] The purpose of the present invention is to provide a method and system for identifying data ransomware based on process behavior, so as to solve the technical problems of low recognition efficiency, insufficient response time and high false alarm rate in data security solutions existing in the prior art.

[0007] In a first aspect, an embodiment of the present invention provides a method for identifying data ransomware based on process behavior, comprising:

[0008] Create bait files in key directories. The bait files include physical bait files and virtual bait files. Physical bait files are used to attract the attention of ransomware, and virtual bait files are used to capture preliminary exploration behaviors of sensitive directories.

[0009] Obtain access behavior to the bait file in real time, process and analyze the access behavior, and obtain access behavior analysis results;

[0010] Generate security decision instructions based on monitoring data and access behavior analysis results.

[0011] In an optional embodiment, the access behavior to the bait file is obtained in real time, and the access behavior is processed and analyzed to obtain the access behavior analysis result, including:

[0012] Obtain all access behaviors to the bait files in real time;

[0013] Based on the analysis strategy, all access behaviors are processed and analyzed to obtain the access behavior analysis results;

[0014] According to the first preset rule, it is determined whether the access behavior analysis result is a malicious behavior, and if so, the access behavior analysis result is determined to be an abnormal behavior.

[0015] In an optional embodiment, the first preset rule includes similarity with known ransomware behavior, detection of abnormal access frequency and access time.

[0016] In an optional embodiment, before generating a security decision instruction based on the monitoring data and the behavior analysis result, the method further includes:

[0017] Get the encryption behavior of all key files;

[0018] According to the second preset rule, it is determined whether the encryption behavior is an abnormal behavior, and if so, the encryption behavior is determined to be an abnormal behavior.

[0019] In an optional embodiment, the encryption behavior of all key files is obtained, including:

[0020] Get encryption function information and key file information;

[0021] The encryption behavior is determined based on the encryption function information and the key file information, wherein the encryption function information includes the encryption function call time and number of times, and the key file information includes the before and after change status of the encrypted file and the type of the encrypted file.

[0022] In an optional embodiment, based on the monitoring data and behavior analysis results, a security decision instruction is generated, including:

[0023] Generate security decision instructions based on the results of encryption behavior and access behavior analysis.

[0024] In an optional embodiment, the security decision instructions include process isolation, permission adjustment, and process termination.

[0025] In a second aspect, an embodiment of the present invention provides a system for identifying data ransomware based on process behavior, including:

[0026] A bait file generation module is used to create bait files in key directories. The bait files include physical bait files and virtual bait files. The physical bait files are used to attract the attention of the ransomware, and the virtual bait files are used to capture the initial exploration behavior of sensitive directories.

[0027] The behavior monitoring module is used to obtain the access behavior to the bait file in real time, and process and analyze the access behavior to obtain the access behavior analysis results;

[0028] The response control module is used to generate security decision instructions based on monitoring data and access behavior analysis results.

[0029] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0030] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0031] The present invention provides a method and system for data ransomware based on behavior recognition. The method and system create bait files in key directories, wherein the bait files include physical bait files and virtual bait files. The physical bait files are used to attract the attention of ransomware, and the virtual bait files are used to capture preliminary exploration behaviors of sensitive directories. The access behaviors to the bait files are obtained in real time, and the access behaviors are processed and analyzed to obtain access behavior analysis results. Based on monitoring data and access behavior analysis results, security decision instructions are generated, thereby effectively distinguishing normal behaviors from malicious behaviors, reducing false alarm rates, and being able to adapt to emerging ransomware strategies, and providing comprehensive and forward-looking protection measures to ensure data security from infringement. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A flowchart of a method for identifying data extortion based on process behavior provided by an embodiment of the present invention;

[0034] Figure 2 A flow chart of behavior monitoring and analysis provided by an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of a process for monitoring encryption behavior provided by an embodiment of the present invention;

[0036] Figure 4 A schematic diagram of the structure of a system for identifying data ransomware based on process behavior provided by an embodiment of the present invention;

[0037] Figure 5 A response control timing diagram provided for an embodiment of the present invention;

[0038] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0040] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Currently, there are a variety of data security solutions such as Symantec Endpoint Protection, Kaspersky Anti-Ransomware Tool and Microsoft Defender for Endpoint. These solutions combine signature recognition, behavior monitoring and machine learning technologies to prevent, detect and respond to various malware attacks, but they still face many challenges. Specifically, these solutions often rely heavily on known virus definitions and behavior patterns, have low recognition rates for new or customized ransomware, and do not respond quickly enough. For example, Symantec Endpoint Protection may not be able to provide effective protection when facing new or highly customized ransomware attacks due to insufficient response time. Similarly, although Kaspersky tools use cloud-based intelligent recognition technology, their overly strict behavior analysis standards and reliance on cloud services may lead to high false alarm rates and weakened protection when cloud services are unreachable. In addition, although Microsoft Defender for Endpoint provides users with convenient protection as a built-in component of the operating system, it still has problems with insufficient recognition accuracy and slow response when dealing with complex attack scenarios, especially highly customized and rapidly mutating ransomware.

[0042] Among them, Cybereason's anti-ransomware software adopts a behavior analysis-based approach. Its core technology involves deep learning algorithms, which are used to monitor and analyze processes in the system in real time. This technology collects a large amount of process behavior data in the system and uses deep learning models to train and analyze this data to identify possible malicious activities. The system pays special attention to behaviors that may cause data to be encrypted or tampered, such as abnormal file system operations and network connections. In this way, Cybereason can predict and block possible attacks before the ransomware performs malicious operations, thereby protecting user data from damage. This solution shows strong adaptability in dynamic environments, but it still has some limitations. Its main problems are processing speed and algorithm resource consumption, which may affect system performance, especially in enterprise environments with extremely large data volumes. In addition, for zero-day attacks and highly customized ransomware, its reliance on analysis of known behavior patterns may result in insufficient detection rates. Based on this, an embodiment of the present invention provides a method and system for identifying data ransomware based on process behavior. The method creates a bait file in a key directory, and the bait file includes a physical bait file and a virtual bait file. The physical bait file is used to attract the attention of the ransomware, and the virtual bait file is used to capture the initial exploration behavior of the sensitive directory; the access behavior to the bait file is obtained in real time, and the access behavior is processed and analyzed to obtain the access behavior analysis result; based on the monitoring data and the access behavior analysis result, a security decision instruction is generated, so as to effectively distinguish normal behavior from malicious behavior, reduce the false alarm rate, and be able to adapt to the emerging ransomware strategy, so as to provide comprehensive and forward-looking protection measures to ensure data security from infringement.

[0043] Figure 1 A flowchart of a method for identifying data extortion based on process behavior provided by an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0044] Step S110: Create a bait file in a key directory. The bait file includes a physical bait file and a virtual bait file. The physical bait file is used to attract the attention of the ransomware, and the virtual bait file is used to capture the initial exploration behavior of the sensitive directory.

[0045] Among them, the physical bait files are stored directly on the disk and located in the sensitive directories of the system. They are used to simulate various attributes of critical business files, such as file size, type, modification date, file attributes and content mode, etc., making them extremely attractive to malware such as ransomware.

[0046] Virtual bait files do not occupy actual disk space and only simulate existence at the file system layer. They are used to capture preliminary exploration behaviors of sensitive directories. When a specific process accesses a sensitive directory, the virtual bait file responds, thus realizing implicit monitoring of potential malicious behaviors.

[0047] This application forms a double-layer defense mechanism by combining physical bait files and virtual bait files, which can capture the detection and attack behaviors of ransomware at different levels, from early detection to direct attack, greatly increasing the difficulty for attackers and reducing the possibility of successful attacks. Even highly adaptable ransomware can be effectively identified and responded to.

[0048] Among them, physical bait files can simulate the behavior of real data files to attract malware to operate, and virtual bait files can provide invisible monitoring at the file system level, increasing the difficulty for attackers to identify and bypass security mechanisms. Through the double-layer defense mechanism, the initial detection actions of ransomware can be detected before the ransomware behavior causes substantial damage, so that the attacker is blocked before the authenticity of the target file is confirmed, greatly increasing the cost and difficulty of ransomware attacks, thereby effectively improving the security of data protection.

[0049] Step S120: Acquire access behavior to the bait file in real time, and process and analyze the access behavior to obtain access behavior analysis results.

[0050] In a possible embodiment, in step S120, the access behavior to the bait file is obtained in real time, and the access behavior is processed and analyzed to obtain the access behavior analysis result, including:

[0051] Obtain all access behaviors to the bait files in real time;

[0052] Based on the analysis strategy, all access behaviors are processed and analyzed to obtain the access behavior analysis results;

[0053] According to the first preset rule, it is determined whether the access behavior analysis result is a malicious behavior, and if so, the access behavior analysis result is determined to be an abnormal behavior.

[0054] In one possible embodiment, the analysis strategy includes a data analysis algorithm and a machine learning algorithm.

[0055] In a possible embodiment, the first preset rule includes similarity with known ransomware behaviors, detection of abnormal access frequency and access time.

[0056] In this application, by considering the various behavioral characteristics of the process, a multi-dimensional comprehensive evaluation framework is constructed, which can capture the behavior of the process more comprehensively, thereby more accurately identifying potential malicious behavior. Among them, the various behavioral characteristics include but are not limited to file operation frequency, process communication, memory usage, etc. The framework takes into account a variety of process behaviors, including but not limited to file operation frequency, process communication, memory usage, etc. Through deep learning and machine learning technology, it can update and optimize its behavior recognition algorithm in real time, and automatically adapt to new attack patterns and behaviors. The behavioral analysis framework of this recognition algorithm allows the system to learn from a continuous data stream and identify atypical behavior patterns, even subtle changes will be identified. The framework can adjust defense strategies based on real-time data feedback and provide targeted response measures, thereby effectively reducing false positives and false negatives, and ensuring business continuity and data integrity.

[0057] Specifically, all access behaviors to the bait files are obtained in real time, and the operational characteristics of the process are recorded in detail, including but not limited to the operation type, time, frequency and related network activities; based on data analysis algorithms and machine learning algorithms, the obtained access behaviors are processed and analyzed to obtain analysis results. The processing and analysis process includes but is not limited to the similarity between the access behavior and known ransomware behaviors, detection of abnormal access frequencies and potential malicious attempts, etc., so as to determine whether the access behavior is malicious behavior.

[0058] like Figure 2 As shown in the figure, the behavior monitoring and analysis flowchart clearly describes the complete process from the process access detection to the bait file to the final security response:

[0059] First, all process behaviors that attempt to access the bait files are captured in real time. These process behaviors include but are not limited to operations such as reading, writing, or modifying files. Then, advanced data analysis technology and machine learning algorithms are used to analyze and process the captured process behaviors to determine whether there are any abnormalities in the process behaviors. The analysis and processing process includes comparing the similarity between the behaviors and known ransomware behaviors, detecting abnormal access frequencies and potential malicious attempts, and finally, if the process behaviors are determined to be malicious behaviors, security measures are taken.

[0060] Furthermore, taking security measures is to implement measures including but not limited to process isolation, permission adjustment or process termination based on the analysis results and security policies, so as to quickly and effectively prevent any potential ransomware activities.

[0061] By continuously analyzing process behavior data through deep learning algorithms in behavior monitoring and analysis, its process behavior judgment model can be automatically updated to adapt to new threat scenarios, thereby improving the ability to identify new and variant ransomware. The real-time response mechanism ensures that once suspicious behavior is detected, defensive measures can be immediately executed, such as isolating the process, restricting its operating permissions, or directly terminating the process, thereby preventing data loss and minimizing the impact on the business.

[0062] Step S130: Generate a security decision instruction based on the monitoring data and access behavior analysis results.

[0063] In a possible embodiment, in step S130, generating a security decision instruction based on monitoring data and access behavior analysis results includes:

[0064] Get the encryption behavior of all key files;

[0065] According to the second preset rule, it is determined whether the encryption behavior is an abnormal behavior, and if so, the encryption behavior is determined to be an abnormal behavior.

[0066] In a possible embodiment, the encryption behavior of all key files is obtained, including:

[0067] Get encryption function information and key file information;

[0068] The encryption behavior is determined based on the encryption function information and the key file information, wherein the encryption function information includes the encryption function call time and number of times, and the key file information includes the before and after change status of the encrypted file and the type of the encrypted file.

[0069] Among them, obtaining the encryption behavior of all key files includes encryption behavior monitoring, which is used to identify and prevent ransomware attacks through encryption function calls and related API monitoring. This method not only monitors the encryption operation itself, but also pays attention to the behavior before and after the encryption operation, such as file access mode, network communication and permission usage. When capturing preliminary encryption attempts, it can respond quickly, block malicious operations in time, and effectively prevent data from being encrypted. It can quickly identify potential threats and take corresponding measures for advanced persistent threats and attacks that exploit emerging vulnerabilities, so as to intervene in advance before the ransomware actually locks the files and protect the security of key assets.

[0070] like Figure 3As shown, the principle of encryption behavior monitoring is: whenever an encryption function is called, detailed information of the recorded call is obtained, which includes but is not limited to process ID, call time, encrypted target file and status changes before and after. Based on the detailed information, the context environment related to the encryption behavior is evaluated, such as the system permissions of the calling process, associated network requests and other system calls. Through this information, the encryption behavior and its legality and security can be fully analyzed. If the analysis reveals any abnormal or potential extortion behavior, preventive measures are taken immediately, including interrupting the encryption operation, isolating the process involved or alerting the system administrator.

[0071] By monitoring encryption behavior activities, it is possible to issue an early warning before ransomware performs encryption operations, effectively identify and block advanced persistent threats and ransomware that exploits zero-day vulnerabilities, and through sophisticated behavioral analysis, distinguish between normal encryption operations and ransomware behaviors, reduce false alarms, and maintain business continuity.

[0072] In a possible embodiment, generating a security decision instruction based on monitoring data and behavior analysis results includes:

[0073] Generate security decision instructions based on the results of encryption behavior and access behavior analysis.

[0074] Specifically, based on the results of encryption behavior and access behavior analysis, preset security measures are implemented, including but not limited to process isolation, permission restriction, or complete termination of suspicious processes, etc., to prevent further expansion of ransomware behavior and protect critical data.

[0075] In a possible embodiment, the method further includes:

[0076] Report security decision instructions to the log.

[0077] The method and system for identifying data ransomware based on process behavior in this application have the following beneficial effects:

[0078] 1. By real-time monitoring of the behavior of processes within the system, especially the read and write operations of the set bait files, it is possible to identify potential ransomware behaviors before any substantial damage occurs. This preventive strategy allows system administrators to take timely measures, such as isolating suspicious processes or directly terminating their operation, thereby preventing data from being encrypted or tampered with, greatly improving the timeliness and effectiveness of data protection;

[0079] 2. By using advanced deep learning technology to learn and analyze a large amount of behavioral data, it can accurately distinguish normal and abnormal behaviors. This method not only improves the accuracy of detection, but also reduces false positives caused by environmental changes through continuous learning and adaptation to environmental changes, thereby maintaining the stability of the system and the high trust of users;

[0080] 3. Monitor the encryption function calls in the system and conduct strict behavior analysis on the processes that call such functions. By judging the frequency and pattern of encryption operations, it can effectively identify abnormal encryption behaviors, thereby preventing ransomware from encrypting before it can do so. This method is particularly effective in defending against custom and zero-day ransomware attacks, significantly improving the system's security protection capabilities.

[0081] 4. Utilize continuous behavior monitoring and machine learning technology to continuously learn from new attack cases, update and optimize the recognition model. Through this dynamic learning process, the present invention can adapt to emerging attack patterns and prevent unknown ransomware strategies, providing a comprehensive and forward-looking security protection measure to ensure that user data can still be reliably protected when ransomware attack strategies are updated.

[0082] Figure 4 A schematic diagram of the structure of a system for identifying data ransomware based on process behavior provided by an embodiment of the present invention. Figure 4 As shown, the system includes:

[0083] The bait file generation module 210 is used to create bait files in key directories. The bait files include physical bait files and virtual bait files. The physical bait files are used to attract the attention of the ransomware, and the virtual bait files are used to capture the initial exploration behavior of sensitive directories.

[0084] The behavior monitoring module 220 is used to obtain the access behavior to the bait file in real time, and process and analyze the access behavior to obtain the access behavior analysis result.

[0085] The response control module 230 is used to generate security decision instructions based on the monitoring data and access behavior analysis results.

[0086] In a possible embodiment, the bait file generating module 210 is further used for:

[0087] Obtain all access behaviors to the bait files in real time;

[0088] Based on the analysis strategy, all access behaviors are processed and analyzed to obtain the access behavior analysis results;

[0089] According to the first preset rule, it is determined whether the access behavior analysis result is a malicious behavior, and if so, the access behavior analysis result is determined to be an abnormal behavior.

[0090] In a possible embodiment, the first preset rule includes similarity with known ransomware behaviors, detection of abnormal access frequency and access time.

[0091] In a possible embodiment, the behavior monitoring module 220 is further used to:

[0092] Get the encryption behavior of all key files;

[0093] According to the second preset rule, it is determined whether the encryption behavior is an abnormal behavior, and if so, the encryption behavior is determined to be an abnormal behavior.

[0094] In a possible embodiment, the behavior monitoring module 220 is further used to:

[0095] Get encryption function information and key file information;

[0096] The encryption behavior is determined based on the encryption function information and the key file information, wherein the encryption function information includes the encryption function call time and number of times, and the key file information includes the before and after change status of the encrypted file and the type of the encrypted file.

[0097] In a possible embodiment, the response control module 230 is further configured to:

[0098] Generate security decision instructions based on the results of encryption behavior and access behavior analysis.

[0099] In one possible embodiment, the security decision instructions include process isolation, permission adjustment, and process termination.

[0100] like Figure 5 As shown in the figure, the response control timing diagram depicts in detail the time sequence and logical steps from detecting suspicious ransomware behavior to executing corresponding security measures, showing how the system responds quickly after confirming the characteristics of malicious behavior, including generating security alerts, assessing the scope of impact, and taking specific measures based on the severity of the process behavior. Measures may include blocking the process's network communication, restricting file system access rights, or immediately terminating the process to eliminate the threat. In addition, the timing diagram also shows how the system records and feedbacks the response effect in real time to ensure that all security measures are executed correctly, while adjusting future defense strategies to deal with similar or more complex threats.

[0101] Specifically, the response control sequence includes a behavior monitoring module, a behavior analysis module, a response decision module and a response execution module, wherein the behavior monitoring module is used to obtain the access behavior to the bait file in real time, and its access behavior is mainly the file encryption behavior; the behavior analysis module is used to process and analyze the access behavior based on advanced data analysis technology and machine learning algorithms to determine whether the access behavior is malicious behavior; the response decision module is used to generate security decision instructions based on the encryption behavior and access behavior analysis results; the response execution module is used to execute the security decision instructions and report the security decision instructions to the log.

[0102] The implementation principle and technical effects of the system provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the system embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0103] like Figure 6 As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, the memory 602 stores machine-readable instructions executable by the processor 601, and when the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the method for identifying data ransomware based on process behavior as described above.

[0104] Specifically, the above-mentioned memory 602 and processor 601 can be general-purpose memories and processors, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, the above-mentioned method of identifying data ransomware based on process behavior can be executed.

[0105] The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 601. The above processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0106] Corresponding to the above-mentioned method for identifying data ransomware based on process behavior, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned method for identifying data ransomware based on process behavior.

[0107] The system for identifying data extortion based on process behavior provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0108] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0109] For another example, the flowchart and block diagram in the accompanying drawings show the possible architecture, functions and operations of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0112] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions for an electronic device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0113] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0114] Finally, it should be noted that the above embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application. They should all be covered within the protection scope of the present application.

Claims

1. A method for identifying data extortion based on process behavior, characterized in that: include: Creating bait files in key directories, wherein the bait files include physical bait files and virtual bait files, wherein the physical bait files are used to attract the attention of the ransomware, and the virtual bait files are used to capture preliminary exploration behaviors of sensitive directories; Acquire access behavior to the bait file in real time, and process and analyze the access behavior to obtain access behavior analysis results; Based on the monitoring data and the access behavior analysis results, a security decision instruction is generated.

2. The method according to claim 1, characterized in that The real-time acquisition of the access behavior to the bait file, and processing and analyzing the access behavior to obtain the access behavior analysis result include: Acquire all access behaviors to the bait file in real time; Based on the analysis strategy, all the access behaviors are processed and analyzed to obtain access behavior analysis results; According to the first preset rule, it is determined whether the access behavior analysis result is a malicious behavior, and if so, it is determined that the access behavior analysis result is an abnormal behavior.

3. The method according to claim 2, characterized in that The first preset rule includes similarity with known ransomware behavior, detection of abnormal access frequency and access time.

4. The method according to claim 1, characterized in that: Before generating a security decision instruction based on the monitoring data and the behavior analysis result, the method further includes: Get the encryption behavior of all key files; According to the second preset rule, it is determined whether the encryption behavior is an abnormal behavior, and if so, it is determined that the encryption behavior is an abnormal behavior.

5. The method according to claim 4, characterized in that The encryption behavior of obtaining all key files includes: Obtaining encryption function information and information of the key file; The encryption behavior is determined based on the encryption function information and the key file information, wherein the encryption function information includes the encryption function call time and number of times, and the key file information includes the before and after change status of the encrypted file and the type of the encrypted file.

6. The method according to claim 4, characterized in that The generating of a security decision instruction based on the monitoring data and the behavior analysis result includes: Based on the encryption behavior and the access behavior analysis results, a security decision instruction is generated.

7. The method according to claim 1 or 6, characterized in that: The security decision instructions include process isolation, permission adjustment and process termination.

8. A system for identifying data extortion based on process behavior, characterized in that: include: A bait file generation module, used to create a bait file in a key directory, wherein the bait file includes a physical bait file and a virtual bait file, wherein the physical bait file is used to attract the attention of the ransomware, and the virtual bait file is used to capture the initial exploration behavior of the sensitive directory; A behavior monitoring module is used to obtain access behaviors to the bait files in real time, and process and analyze the access behaviors to obtain access behavior analysis results; The response control module is used to generate a security decision instruction based on the monitoring data and the access behavior analysis result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images