Ransomware blocking method and device suitable for industrial control environment

Abstract

The invention discloses a ransomware blocking method and device suitable for an industrial control environment. The method comprises the following steps: determining a behavior characteristic generated by executing a first abnormal operation by a ransomware sample in a ransomware sample library as a first target behavior characteristic; determining a behavior feature generated when the ransomware sample in the ransomware sample library executes the second abnormal operation as a second target behavior feature; according to the first target behavior feature and the second target behavior feature, an engine behavior library of the ransomware samples is constructed, and the engine behavior library is a set containing behavior features of multiple ransomware samples; performing ransomware monitoring on the ransomware according to the engine behavior library to obtain a monitoring result; and when the monitoring result shows that the ransomware ransomware operation behavior exists, blocking the ransomware operation behavior. According to the method and the device, the technical problem of low monitoring efficiency caused by low relevance due to the fact that independent equipment is taken as a target when a traditional method is used for monitoring and implementing in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a ransomware blocking method and device suitable for an industrial control environment. Background Art

[0002] Ransomware works by attacking the user's computer or device, using encryption to prevent the user from accessing their files, and threatening the victim to pay a ransom for decryption. Existing network asset analysis and supervision methods all target individual devices, which are not highly correlated, and the analysis and supervision methods are single, resulting in low analysis and supervision efficiency and poor results.

[0003] In view of the problem that the traditional methods used in the above-mentioned related technologies for monitoring and implementation all target individual devices and have weak correlation, resulting in low monitoring efficiency, no effective solution has been proposed so far. Summary of the invention

[0004] The embodiments of the present invention provide a ransomware blocking method and device suitable for an industrial control environment, so as to at least solve the technical problem in the related art that the traditional methods used for monitoring and implementation are all targeted at individual devices, with weak correlation, resulting in low monitoring efficiency.

[0005] According to one aspect of an embodiment of the present invention, a ransomware blocking method suitable for an industrial control environment is provided, comprising: determining a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation as a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware samples represent the behavior features of different ransomware software in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation performed by the ransomware sample at the bottom layer of an operating system; determining the behavior feature generated by the ransomware sample in the ransomware sample library executing a second abnormal operation as a second target behavior feature, wherein the second abnormal operation The operation refers to the abnormal operation performed by the ransomware sample during the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware performs the ransom operation behavior, and the source file refers to the file that the ransomware extorts; the engine behavior library of the ransomware sample is constructed according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of the behavior features of multiple ransomware virus samples; the ransomware is monitored for ransom according to the engine behavior library to obtain a monitoring result; when the monitoring result indicates the existence of the ransomware operation behavior of the ransomware, the ransom operation behavior is blocked.

[0006] Optionally, before determining that a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation is a first target behavior feature, the ransomware blocking method suitable for an industrial control environment further includes at least one of the following: obtaining the ransomware sample library; obtaining a plurality of the ransomware samples, and constructing the ransomware sample library based on the plurality of the ransomware samples.

[0007] Optionally, determining that a behavior feature generated by a ransomware sample in a ransomware sample library performing a first abnormal operation is a first target behavior feature includes one of the following: determining that the behavior feature generated by the ransomware sample performing a target serialization operation multiple times is the first target behavior feature, wherein the target serialization operation refers to an operation in which the ransomware sample replaces the source file with an encrypted file and deletes the source file, and the encrypted file is a file obtained by encrypting the source file by the ransomware sample; determining that the behavior feature in which an entropy change of the encrypted file compared to the source file after the ransomware sample performs the target serialization operation is greater than an entropy change threshold is the first target behavior feature; determining that the behavior feature generated by the ransomware sample performing a process injection operation is the first target behavior feature, wherein the process injection operation refers to the ransomware sample injecting its own code into a normal The operation of injecting the own code into the running process or the process; determining that the behavior characteristic generated by the ransomware sample performing a registry modification operation is the first target behavior characteristic, wherein the registry modification operation refers to the operation of the ransomware sample modifying the registry of the operating system; determining that the behavior characteristic generated by the ransomware sample performing a backup deletion operation is the first target behavior characteristic, wherein the backup deletion operation refers to the operation of the ransomware sample deleting the shadow backup of the operating system, and the shadow backup refers to the operation for restoring encrypted or deleted files in the operating system; determining that the behavior characteristic generated by the ransomware sample performing an abnormal file operation is the first target behavior characteristic, wherein the abnormal file operation includes at least: an operation of changing file attributes, an operation of abnormally moving files, and an operation of abnormally accessing files.

[0008] Optionally, determining that the behavior feature generated by the ransomware sample in the ransomware sample library performing the second abnormal operation is the second target behavior feature includes: determining that the behavior feature in which the number of encryptions of the ransomware sample in the process of encrypting the source file is greater than a first encryption threshold is the second target behavior feature, wherein the first encryption threshold is used to determine whether there is an abnormality in the number of encryptions in the encryption process, and the encryption process refers to the process in which the ransomware sample encrypts the source file; determining that the behavior feature in which the number of cryptographic primitives detected by the ransomware sample in the process of encrypting the source file is greater than a second encryption threshold is the second target behavior feature, wherein the second encryption threshold is used to determine whether there is an abnormality in the number of cryptographic primitives in the encryption process.

[0009] Optionally, the ransomware is monitored for ransom according to the engine behavior library to obtain a monitoring result, including: monitoring the file system behavior and / or process behavior according to the engine behavior library to determine whether the first target behavior feature exists in the file system behavior and / or the process behavior to obtain a first judgment result; monitoring the encryption operations and cryptographic primitives in the file system behavior and / or the process behavior according to the engine behavior library to determine whether the second target behavior feature exists in the file system behavior and / or the process behavior to obtain a second judgment result; determining the first judgment result and the second judgment result as the monitoring result, wherein, when the first judgment result indicates that the first target behavior feature exists in the file system behavior and / or the process behavior, and / or the second target behavior feature exists in the file system behavior and / or the process behavior, the monitoring result indicates that the ransomware has the ransom operation behavior.

[0010] Optionally, when the monitoring result indicates that there is a ransomware operation behavior of the ransomware, the ransomware operation behavior is blocked, including at least one of the following: the ransomware operation behavior is blocked by bait delivery, wherein the bait delivery refers to using a specific file or information as bait to make the ransomware ransom a false file to block the ransomware from ransoming a real file, the false file refers to the specific file or information used as bait, and the real file refers to a file that needs to be prevented from being ransomed by the ransomware; the ransomware operation behavior is blocked by process blocking, wherein the process blocking refers to monitoring and blocking the malicious process of the ransomware; the ransomware operation behavior is blocked by file write operation blocking, wherein the file write operation blocking refers to blocking the ransomware from ransom on the real file by monitoring the write operation of the file system; the ransomware operation behavior is blocked by encryption operation blocking, wherein the encryption operation blocking refers to preventing the encryption behavior of the ransomware to block the ransomware from ransom on the real file.

[0011] Optionally, the ransomware blocking method suitable for an industrial control environment further includes: using a monitoring and blocking strategy to monitor the ransomware in real time, so as to block the ransomware operation behavior when the ransomware has the ransomware operation behavior, wherein the monitoring and blocking strategy includes at least: a loose strategy, a normal strategy, a sensitive strategy and a strict strategy.

[0012] According to another aspect of an embodiment of the present invention, a ransomware blocking device suitable for an industrial control environment is further provided, comprising: a first determining unit, configured to determine that a behavior characteristic generated by a ransomware sample in a ransomware sample library executing a first abnormal operation is a first target behavior characteristic, wherein the ransomware sample library is a collection of a plurality of ransomware samples, and the ransomware sample represents the behavior characteristics of different ransomware software in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation performed by the ransomware sample at the bottom layer of an operating system; a second determining unit, configured to determine that a behavior characteristic generated by a ransomware sample in the ransomware sample library executing a second abnormal operation is a second target behavior characteristic, wherein the second abnormal operation Refers to the abnormal operation performed by the ransomware virus sample during the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware software performs the ransom operation behavior, and the source file refers to the file extorted by the ransomware software; a construction unit is used to construct an engine behavior library of the ransomware virus sample according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of the behavior features of multiple ransomware virus samples; an acquisition unit is used to perform ransom monitoring on the ransomware according to the engine behavior library to obtain a monitoring result; a blocking unit is used to block the ransom operation behavior when the monitoring result indicates the existence of the ransomware software's ransom operation behavior.

[0013] Optionally, the ransomware blocking device suitable for an industrial control environment further includes at least one of the following: a first acquisition unit, used to acquire the ransomware sample library before determining that a behavior feature generated by a ransomware sample in the ransomware sample library executing a first abnormal operation is a first target behavior feature; and a second acquisition unit, used to acquire a plurality of the ransomware samples and construct the ransomware sample library based on the plurality of the ransomware samples.

[0014] Optionally, the first determination unit includes one of the following: a first determination module, used to determine that the behavior feature generated by the ransomware virus sample performing a target serialization operation multiple times is the first target behavior feature, wherein the target serialization operation refers to the operation of the ransomware virus sample replacing the source file with an encrypted file and deleting the source file, and the encrypted file is a file obtained by the ransomware virus sample encrypting the source file; a second determination module, used to determine that the behavior feature in which the entropy change of the encrypted file compared to the source file after the ransomware virus sample performs the target serialization operation is greater than an entropy change threshold is the first target behavior feature; a third determination module, used to determine that the behavior feature generated by the ransomware virus sample performing a process injection operation is the first target behavior feature, wherein the process injection operation refers to the ransomware virus sample injecting its own code into a running process or having injected its own code into the process an operation of injecting into the process; a fourth determination module, used to determine that the behavior characteristic generated by the ransomware virus sample performing a registry modification operation is the first target behavior characteristic, wherein the registry modification operation refers to the operation of the ransomware virus sample to modify the registry of the operating system; a fifth determination module, used to determine that the behavior characteristic generated by the ransomware virus sample performing a backup deletion operation is the first target behavior characteristic, wherein the backup deletion operation refers to the operation of the ransomware virus sample to delete the shadow backup of the operating system, and the shadow backup refers to the operation for restoring encrypted or deleted files in the operating system; a sixth determination module, used to determine that the behavior characteristic generated by the ransomware virus sample performing an abnormal file operation is the first target behavior characteristic, wherein the abnormal file operation includes at least: an operation of changing file attributes, an operation of abnormally moving files, and an operation of abnormally accessing files.

[0015] Optionally, the second determination unit includes: a seventh determination module, used to determine that the behavior feature of the ransomware sample in the process of encrypting the source file, in which the number of encryptions is greater than a first encryption threshold, is the second target behavior feature, wherein the first encryption threshold is used to determine whether there is an abnormality in the number of encryptions in the encryption process, and the encryption process refers to the process of the ransomware sample encrypting the source file; an eighth determination module, used to determine that the behavior feature of the ransomware sample in the process of encrypting the source file, in which the number of cryptographic primitives detected is greater than a second encryption threshold, is the second target behavior feature, wherein the second encryption threshold is used to determine whether there is an abnormality in the number of cryptographic primitives in the encryption process.

[0016] Optionally, the acquisition unit includes: a first acquisition module, used to monitor the file system behavior and / or process behavior according to the engine behavior library to determine whether the first target behavior feature exists in the file system behavior and / or the process behavior, and obtain a first judgment result; a second acquisition module, used to monitor the encryption operations and cryptographic primitives in the file system behavior and / or the process behavior according to the engine behavior library to determine whether the second target behavior feature exists in the file system behavior and / or the process behavior, and obtain a second judgment result; a ninth determination module, used to determine that the first judgment result and the second judgment result are the monitoring results, wherein, when the first judgment result indicates that the first target behavior feature exists in the file system behavior and / or the process behavior, and / or the second target behavior feature exists in the file system behavior and / or the process behavior, the monitoring result indicates that the ransomware exists the ransom operation behavior.

[0017] Optionally, the blocking unit includes at least one of the following: a first blocking module, used to block the ransomware operation behavior by bait delivery, wherein the bait delivery refers to using a specific file or information as bait to make the ransomware extort a false file so as to block the ransomware from extorting a real file, the false file refers to the specific file or information used as bait, and the real file refers to a file that needs to be prevented from being extorted by the ransomware; a second blocking module, used to block the ransomware operation behavior by process blocking, wherein the process blocking refers to monitoring and blocking the malicious process of the ransomware; a third blocking module, used to block the ransomware operation behavior by file write operation blocking, wherein the file write operation blocking refers to blocking the ransomware from extorting the real file by monitoring the write operation of the file system; a fourth blocking module, used to block the ransomware operation behavior by encryption operation blocking, wherein the encryption operation blocking refers to preventing the encryption behavior of the ransomware from extorting the real file by the ransomware.

[0018] Optionally, the ransomware blocking device suitable for an industrial control environment further includes: a monitoring unit, configured to monitor the ransomware in real time using a monitoring and blocking strategy, so as to block the ransomware operation behavior when the ransomware has the ransomware operation behavior, wherein the monitoring and blocking strategy includes at least: a loose strategy, a normal strategy, a sensitive strategy, and a strict strategy.

[0019] According to another aspect of an embodiment of the present invention, a ransomware blocking system applicable to an industrial control environment is further provided. The ransomware blocking system applicable to an industrial control environment uses any of the above-described ransomware blocking methods applicable to an industrial control environment.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned ransomware blocking methods applicable to an industrial control environment.

[0021] According to another aspect of an embodiment of the present invention, a processor is further provided, the processor being used to run a program, wherein when the program is run, any one of the above-mentioned ransomware blocking methods applicable to an industrial control environment is executed.

[0022] According to another aspect of an embodiment of the present invention, a computer program product is further provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned ransomware blocking methods applicable to an industrial control environment.

[0023] In an embodiment of the present invention, a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation is determined as a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware sample represents the behavior features of different ransomware in the process of implementing ransom, and the first abnormal operation refers to the abnormal operation performed by the ransomware sample at the bottom layer of the operating system; a behavior feature generated by a ransomware sample in the ransomware sample library executing a second abnormal operation is determined as a second target behavior feature, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample in the encryption process, the encryption process refers to the process of encrypting a source file when the ransomware performs a ransomware operation behavior, and the source file refers to a file ransomed by the ransomware; an engine behavior library of the ransomware sample is constructed according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of behavior features including multiple ransomware samples; ransomware is monitored for ransom according to the engine behavior library to obtain a monitoring result; and when the monitoring result indicates that there is a ransomware operation behavior of the ransomware, the ransomware operation behavior is blocked. Through the above technical scheme, the purpose of building an engine behavior library according to the behavioral characteristics of the ransomware samples in the ransomware sample library when performing abnormal operations is achieved, and monitoring whether the ransomware has ransomware operation behavior based on the engine behavior library and blocking the existing ransomware operation behavior is achieved. The ransomware operation behavior is directly monitored and blocked based on the engine behavior library, which is not limited to the technical effect of the supervision method of equipment and specific viruses. It can realize the comprehensive supervision of different equipment in the industrial control environment in different ways, improve the analysis and supervision efficiency, and thus solve the technical problem that the traditional methods used in related technologies are used to monitor and implement individual devices, the correlation is not strong, and the monitoring efficiency is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0025] Figure 1 It is a hardware structure block diagram of a computer device of a ransomware blocking method applicable to an industrial control environment according to an embodiment of the present invention;

[0026] Figure 2 is a flow chart of a ransomware blocking method applicable to an industrial control environment according to an embodiment of the present invention;

[0027] Figure 3 is a flow chart of an optional ransomware blocking method applicable to an industrial control environment according to an embodiment of the present invention;

[0028] Figure 4 is a schematic diagram of a ransomware blocking system applicable to an industrial control environment according to an embodiment of the present invention;

[0029] Figure 5 is a flow chart of performing ransomware monitoring on ransomware according to an embodiment of the present invention;

[0030] Figure 6 is a schematic diagram of a ransomware blocking device applicable to an industrial control environment according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] As introduced in the background technology, the traditional methods used in the related art for monitoring and implementation are all targeted at individual devices, which are not highly correlated and result in low monitoring efficiency. In view of the above defects, a ransomware blocking method and device suitable for an industrial control environment are provided in an embodiment of the present invention.

[0034] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0035] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure diagram of a computer device for a ransomware blocking method suitable for an industrial control environment according to an embodiment of the present invention. The computer device may be a server or a terminal, and its internal structure diagram is as follows: Figure 1 As shown, the computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface, wherein the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface; the processor of the computer device is used to provide computing and control capabilities, the memory of the computer device includes a non-volatile storage medium and an internal memory, the non-volatile storage medium stores an operating system, a computer program and a database, the internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium, the database of the computer device is used to store data determined by complementarity, the input / output interface of the computer device is used to exchange information between the processor and an external device, the communication interface of the computer device is used to communicate with an external terminal through a network connection, and when the computer program is executed by the processor, a ransomware blocking method suitable for an industrial control environment is implemented.

[0036] According to an embodiment of the present invention, a method embodiment of a ransomware blocking method suitable for an industrial control environment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] Figure 2 is a flow chart of a ransomware blocking method applicable to an industrial control environment according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0038] Step S202, determining that a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation is a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware samples represent behavior features of different ransomware in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation performed by the ransomware sample at the bottom layer of the operating system.

[0039] Combine the following Figure 3 and Figure 4 The above embodiments of the present invention are described in detail. Figure 3 is a flowchart of an optional ransomware blocking method applicable to an industrial control environment according to an embodiment of the present invention. Figure 4 is a schematic diagram of a ransomware blocking system applicable to an industrial control environment according to an embodiment of the present invention.

[0040] In this embodiment, if Figure 3 and Figure 4 As shown, the behavior characteristics of abnormal operations (first abnormal operations) performed by the ransomware samples in the ransomware sample library on the bottom layer of the operating system can be first analyzed and determined as the first target behavior characteristics.

[0041] According to the above embodiment of the present invention, before the above step S202, that is, before determining that the behavior feature generated by the ransomware sample in the ransomware sample library executing the first abnormal operation is the first target behavior feature, the ransomware blocking method suitable for the industrial control environment also includes at least one of the following: obtaining a ransomware sample library; obtaining multiple ransomware samples, and constructing a ransomware sample library based on the multiple ransomware samples.

[0042] As above Figure 3 And Figure 4 As shown, before analyzing and determining the first target behavior feature, it is necessary to construct a ransomware sample library. The ransomware sample library can directly adopt an existing ransomware sample library, or it can be constructed based on a variety of known ransomware samples to obtain a ransomware sample library.

[0043] According to the above embodiment of the present invention, in the above step S202, determining that the behavior feature generated by the ransomware sample in the ransomware sample library performing the first abnormal operation is the first target behavior feature includes one of the following: determining that the behavior feature generated by the ransomware sample performing the target serialization operation multiple times is the first target behavior feature, wherein the target serialization operation refers to the operation of the ransomware sample replacing the source file with the encrypted file and deleting the source file, and the encrypted file is the file obtained by the ransomware sample encrypting the source file; determining that the behavior feature that the entropy change of the encrypted file compared to the source file after the ransomware sample performs the target serialization operation is greater than the entropy change threshold as the first target behavior feature; determining that the behavior feature generated by the ransomware sample performing the process injection operation is the first target behavior feature, wherein the process injection operation refers to the ransomware sample replacing itself with the encrypted file. The operation of injecting the ransomware sample's own code into a running process or injecting its own code into a process; determining the behavioral characteristics generated by the ransomware sample's registry modification operation as the first target behavioral characteristics, wherein the registry modification operation refers to the operation of the ransomware sample modifying the operating system's registry; determining the behavioral characteristics generated by the ransomware sample's backup deletion operation as the first target behavioral characteristics, wherein the backup deletion operation refers to the operation of the ransomware sample deleting the operating system's shadow backup, and the shadow backup refers to the operation used to restore encrypted or deleted files in the operating system; determining the behavioral characteristics generated by the ransomware sample's abnormal file operation as the first target behavioral characteristics, wherein the abnormal file operation at least includes: an operation of changing file attributes, an operation of abnormally moving files, and an operation of abnormally accessing files.

[0044] Specifically, the first target behavior characteristics that can be considered as the ransomware sample performing abnormal operations on the underlying operating system include but are not limited to: 1) Multiple occurrences of target serialization operations: This means that before the ransomware encrypts the file, it may first read the original file (source file), then create and write an encrypted file (target file), and finally delete the original file; 2) The change in entropy of the target file compared to the source file is greater than the entropy change threshold and the source file is deleted: After the ransomware encrypts the file, the file's entropy (a measure of the uncertainty or complexity of information) usually increases significantly. If a significant change in file entropy is detected and the original file is deleted, this may be a sign of ransomware operation; 3) The behavior of processes attempting to inject other processes: The ransomware may try to inject its code into other processes. 4) The behavior of a process being injected by other processes: This may indicate that the ransomware has been successfully injected into a process, or that a process has been infected by malware; 5) The behavior of a process attempting to write to the registry to achieve persistence: Ransomware may modify the operating system's registry so that it can still run after the system is restarted; 6) The behavior of a process attempting to delete Shadow backups: The operating system's Shadow backups (i.e., shadow backups) are system restore points that can be used to restore encrypted or deleted files. Ransomware may try to delete these backups to prevent users from restoring files; 7) The behavior of abnormal file operations in the process: This may include abnormal file access modes, changes in file attributes, or abnormal movement of files.

[0045] Step S204, determining that the behavior feature generated by the ransomware sample in the ransomware sample library executing the second abnormal operation is the second target behavior feature, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample during the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware performs the ransomware operation behavior, and the source file refers to the file extorted by the ransomware.

[0046] In this embodiment, as above Figure 3 And Figure 4 As shown, the behavior characteristics of the abnormal operation (ie, the second abnormal operation) performed by the ransomware virus sample during the process of encrypting the source file when the ransomware performs the ransomware operation behavior can be analyzed and determined as the second target behavior characteristics.

[0047] According to the above embodiment of the present invention, in the above step S204, determining the behavior feature generated by the ransomware sample in the ransomware sample library performing the second abnormal operation as the second target behavior feature includes: determining the behavior feature that the number of encryptions of the ransomware sample in the process of encrypting the source file is greater than the first encryption threshold as the second target behavior feature, wherein the first encryption threshold is used to determine whether there is an abnormality in the number of encryptions in the encryption process, and the encryption process refers to the process of the ransomware sample encrypting the source file; determining the behavior feature that the number of cryptographic primitives detected by the ransomware sample in the process of encrypting the source file is greater than the second encryption threshold as the second target behavior feature, wherein the second encryption threshold is used to determine whether there is an abnormality in the number of cryptographic primitives in the encryption process.

[0048] Specifically, the second target behavior feature that can be considered as an abnormal operation performed by the ransomware virus sample in the process of encrypting the source file when the ransomware performs the ransom operation may include but is not limited to: the encryption behavior of the process is greater than the first encryption threshold, and the number of cryptographic primitives included is greater than the second encryption threshold.

[0049] The above-mentioned analysis process of abnormal operation of the bottom layer of the operating system and abnormal operation of the encryption process is also equivalent to the process of analyzing the data in the existing database.

[0050] Step S206: construct an engine behavior library of the ransomware virus sample according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of behavior features of multiple ransomware virus samples.

[0051] In this embodiment, as above Figure 3 And Figure 4 As shown, an engine behavior library of the ransomware can be constructed based on the first target behavior feature and the second target behavior feature obtained by analysis, so as to monitor the operation behavior of the ransomware based on the engine behavior library to determine whether there is a ransomware operation behavior.

[0052] Step S208, performing ransomware monitoring on the ransomware according to the engine behavior library to obtain monitoring results.

[0053] As above Figure 3 And Figure 4 As shown, ransomware monitoring can be performed based on the engine behavior library to determine whether there is ransomware operation behavior based on the detection results.

[0054] According to the above embodiment of the present invention, in the above step S208, ransomware is monitored according to the engine behavior library to obtain a monitoring result, including: monitoring the file system behavior and / or process behavior according to the engine behavior library to determine whether there is a first target behavior feature in the file system behavior and / or process behavior, and obtaining a first judgment result; monitoring the encryption operations and cryptographic primitives in the file system behavior and / or process behavior according to the engine behavior library to determine whether there is a second target behavior feature in the file system behavior and / or process behavior, and obtaining a second judgment result; determining the first judgment result and the second judgment result as the monitoring results, wherein, when the first judgment result indicates that the first target behavior feature exists in the file system behavior and / or process behavior, and / or, the second target behavior feature exists in the file system behavior and / or process behavior, the monitoring result indicates the presence of ransomware operation behavior.

[0055] Combine the following Figure 5 The above embodiments of the present invention are described in detail. Figure 5 The present invention is a flowchart of performing ransomware monitoring on ransomware according to an embodiment of the present invention.

[0056] like Figure 5 As shown, the file system behavior and / or process behavior can be monitored according to the engine behavior library to determine whether there is a first target behavior feature. If so, the file system behavior and / or process behavior with the first target behavior feature is determined as the ransomware operation behavior of the ransomware; the encryption operations and cryptographic primitives in the file system behavior and / or process behavior can also be monitored according to the engine behavior library to determine whether there is a second target behavior feature. If so, the file system behavior and / or process behavior with the second target behavior feature is determined as the ransomware operation behavior of the ransomware.

[0057] Monitoring file system behavior is one of the most important monitoring aspects of anti-ransomware. It mainly monitors key file-related behaviors in the operating system, including directory listing, directory traversal, file reading / writing, file renaming, file deletion, deletion of system backup volumes, etc. The purpose of monitoring these behaviors is to see which files have been abnormally operated; abnormally operated files will have some very unusual behavioral characteristics, for example, reading the source file, writing the target file, and then deleting the source file. Such serialized operations appear multiple times, which is very abnormal. Combined with the change in the file's entropy when writing the target file, if the change is large (that is, the file has a small entropy when reading, and a large entropy when writing), plus the behavior of deleting the source file, it can constitute a typical ransomware feature. File operation behaviors with such characteristics will be judged as implementing ransomware, or in more conservative rules, they will be further strengthened as key monitoring objects.

[0058] The monitoring of process behavior is divided into two aspects. On the one hand, it is the monitoring of general malicious behaviors. For example, a process attempts to inject other processes, a process has been injected by other processes, a process attempts to write to the registry to achieve persistent residence, a process attempts to delete Shadow backups, etc. Such process behaviors are closely related to malware. When such behaviors are discovered, even if the process is not terminated immediately, the relevant processes must be supervised more closely; on the other hand, it is necessary to associate file behaviors with processes. Specifically, what file behaviors are performed in a process or process group? For example, a process first enumerates the directory and then performs a directory traversal. During the directory traversal, it first reads a file, then writes the file, and then renames the file. The entropy of the file is greatly increased, and such behavior is performed multiple times (the specific frequency is related to the sensitivity setting of the anti-ransomware software). In this case, it is a typical ransomware operation behavior and constitutes a detection and killing element.

[0059] The analysis of encryption operations also includes two aspects. On the one hand, some commonly used encryption API calls in the Windows operating system, including the orderly calls of key APIs such as CSP acquisition, random number calls, and file encryption, are not common for unauthorized non-system-level applications and need to be paid special attention to. On the other hand, it is to combine file behavior and process (or process group) to comprehensively calculate the entropy increase of files (the entropy increase of files operated by processes, there are two types of entropy increase: encryption and compression). The measurement of file entropy changes involved in the above two aspects is completed during the analysis of encryption operations. The first aspect is system-level monitoring; the second aspect is kernel-level monitoring, which is completed by the file system small port filtering device driver; through the analysis of these two aspects, it is determined whether a specific process (or process group) has a large number of encryption behaviors; the appearance of encryption behavior is an important feature for determining ransomware.

[0060] Cryptographic primitive analysis is an important supplement to encryption operation analysis. For most ransomware, they do not call the encryption API at the operating system level, but write a relatively compact encryption microkernel to complete specific, high-speed encryption behaviors. For example, they use the high-speed and undiminished strength chacha20 streaming encryption algorithm. This is simple to implement, occupies little space, and is fast. It does not rely on a specific operating system and can be quickly ported. In this case, encryption primitive analysis is needed to determine whether the cryptographic features of a specific process are obvious. Cryptography determines a high-strength cryptographic algorithm, and there must be a large number of cryptographic primitives (referring to basic atomic operations related to cryptography), including but not limited to a large number of loop / shift operations, a large number of XOR operations, a large number of table lookup operations, fixed S-box information, random number acquisition instructions, and specific CPU instructions such as AES-NI instructions or vector operation acceleration instruction calls.

[0061] If a non-universal program has file behavior characteristics, encryption primitive features, and causes a large amount of file entropy to increase, then it can basically be determined to be an encryption ransomware and the possibility of being mistakenly killed is very small.

[0062] Step S210: When the monitoring result indicates that there is a ransomware operation, the ransomware operation is blocked.

[0063] As above Figure 3 And Figure 4 As shown, when there is a ransomware operation, an abnormal alarm can be issued, and the ransomware operation can be blocked by one or more of bait delivery, process blocking, file write operation blocking and encryption operation blocking.

[0064] According to the above embodiment of the present invention, in the above step S210, when the monitoring result indicates that there is a ransomware operation behavior, the ransomware operation behavior is blocked, including at least one of the following: the ransomware operation behavior is blocked by bait delivery, wherein the bait delivery refers to using a specific file or information as bait to make the ransomware extort a false file to block the ransomware from extorting a real file, the false file refers to a specific file or information used as bait, and the real file refers to a file that needs to be prevented from being extorted by the ransomware; the ransomware operation behavior is blocked by process blocking, wherein process blocking refers to monitoring and blocking the malicious process of the ransomware; the ransomware operation behavior is blocked by file write operation blocking, wherein file write operation blocking refers to blocking the ransomware from extorting a real file by monitoring the write operation of the file system; the ransomware operation behavior is blocked by encryption operation blocking, wherein encryption operation blocking refers to preventing the encryption behavior of the ransomware to block the ransomware from extorting a real file.

[0065] Specifically, the method of placing bait to block ransomware operations is to designate a specific directory as bait and place some user-defined files. If there is a write operation to the files in these directories, the related process is determined to be ransomware. However, this mechanism is too simple and is easy to be detected and bypassed when dealing with targeted ransomware gangs. In addition, if the set bait directory is inappropriate, a large number of files will be encrypted but the anti-ransomware has not responded. The set bait directory is too far ahead of the traversable directory and is very easy to be discovered. If the set bait file is not the target object of the ransomware, the bait is invalid. Therefore, when using bait placement to block ransomware operations, you need to pay attention to these issues.

[0066] The process blocking method is used to block the ransomware operation behavior. It is a process killing mechanism that targets the process group. It can "destroy" the series of processes constituted by the malicious ransomware in a very short time, including the startup process, encryption process, auxiliary process, etc., to prevent the malicious process from escaping the net and starting the encryption process again. Such destructive behaviors; however, the anti-ransomware process blocking behavior does not include the destruction and blocking of the malware's persistent hijacking / residence mechanism after the operating system is restarted. If the operating system has been invaded by the ransomware and the anti-ransomware has completed the process blocking, it is necessary to strictly carry out further comprehensive cleaning and backup of the system.

[0067] Blocking the ransomware operation by blocking file write operations occurs when the process is judged to be a possible ransomware. Direct blocking is implemented under strict policies; backup defense is implemented under other looser policies. If the process is finally judged to be non-ransomware, the backup is ignored. Otherwise, a part of the files encrypted by the process will be restored through the backup recovery mechanism to reduce user losses. Therefore, it must be emphasized that the backup mechanism provided by the anti-ransomware software does not implement full disk lossless backup, but only provides specific backup for ransomware to reduce losses, that is, it cannot completely avoid user losses; but from the actual protection effect, the number of files lost by users is relatively small.

[0068] Blocking ransomware operations by blocking encryption operations only targets calls to the operating system-level encryption API. It is generally only implemented after it is determined to be ransomware to reduce user losses. Generally, the priority of file write operation blocking is higher than encryption operation blocking, that is, encryption operation blocking is only implemented when file write operation blocking is not implemented, because encryption operation blocking will cause the behavior of the targeted process to be uncontrolled, which may cause unpredictable consequences. Under general strategies, this blocking behavior will be disabled. If the process is misjudged and blocked by encryption operations, it needs to be adjusted and adapted to ensure its normal operation.

[0069] In an optional embodiment of the present invention, the ransomware blocking method suitable for an industrial control environment further includes: using a monitoring and blocking strategy to monitor the ransomware in real time, so as to block the ransomware operation behavior when there is a ransomware operation behavior, wherein the monitoring and blocking strategy includes at least: a loose strategy, a normal strategy, a sensitive strategy and a strict strategy.

[0070] Specifically, the detailed process of ransomware blocking includes a variety of monitoring and blocking strategies, including loose strategy, normal strategy, sensitive strategy and strict strategy monitoring and blocking strategies; effective monitoring and blocking measures can be implemented according to different strategies (loose, normal, sensitive, strict) to prevent ransomware attacks.

[0071] The attack can be correlated and analyzed by combining process behavior, file behavior and password analysis, and the attack mode can be extracted. At the same time, the algorithm can be used to customize the chain of attack rules according to different sensitivity standards to form an engine behavior library. After configuring the sensitivity strategy suitable for the current industrial control environment, monitoring and blocking are carried out according to the currently configured sensitivity strategy, that is, according to the sensitivity strategy, it can be selected under which specific monitoring and blocking strategy to monitor and implement blocking; file write operation blocking occurs when the process is judged to be a possible ransomware, and direct blocking is implemented under strict strategies; backup defense is implemented under other looser strategies. If the process is finally judged to be non-ransomware, the backup is ignored; encryption operation blocking is only for the call of the operating system-level encryption API. After it is determined to be ransomware, encryption operation blocking is implemented only when file write operation blocking is not implemented; ransomware blocking adopts a process killing mechanism with process group as the target object, dividing a group of related processes into a process group. The processes in the process group are related, for example, processes will protect and start each other; ransomware may start multiple processes. If the corresponding attack mode of the process is matched on the terminal side, the series of processes constituted by the malicious ransomware, including the startup process, encryption process, auxiliary process, etc., will be blocked at the same time, and the driver will be used to force it to end its operation in the kernel state. In a very short time (such as 0.1 milliseconds), all processes of the entire process group can be killed and completely blocked to prevent the malicious process from escaping the net and starting the encryption process again and other destructive behaviors.

[0072] As can be seen from the above, through the technical solution provided by the above embodiment of the present invention, it is possible to first determine that the behavior characteristics generated by the ransomware sample in the ransomware sample library executing the first abnormal operation are the first target behavior characteristics, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware sample represents the behavior characteristics of different ransomware in the process of implementing the ransomware, and the first abnormal operation refers to the abnormal operation performed by the ransomware sample at the bottom layer of the operating system; determine that the behavior characteristics generated by the ransomware sample in the ransomware sample library executing the second abnormal operation are the second target behavior characteristics, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample in the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware performs the ransomware operation behavior, and the source file refers to the file extorted by the ransomware; according to the first target behavior characteristics and the second target behavior characteristics, The engine behavior library of ransomware samples is constructed based on the characteristics, wherein the engine behavior library is a collection of behavioral characteristics of multiple ransomware samples; ransomware is monitored according to the engine behavior library to obtain monitoring results; when the monitoring results indicate the existence of ransomware operation behavior, the ransomware operation behavior is blocked, thereby achieving the purpose of building an engine behavior library according to the behavioral characteristics of ransomware samples in the ransomware sample library when performing abnormal operations, and monitoring whether the ransomware has ransomware operation behavior based on the engine behavior library and blocking the existing ransomware operation behavior, realizing the technical effect of directly monitoring and blocking the ransomware operation behavior based on the engine behavior library, which is not limited to the supervision method of equipment and specific viruses, and can realize comprehensive supervision of different equipment in industrial control environments in different ways, thereby improving the efficiency of analysis and supervision.

[0073] Therefore, the technical solution provided by the above-mentioned embodiment of the present invention solves the technical problem in the related art that the traditional method used for monitoring and implementation targets a single device, has weak correlation, and leads to low monitoring efficiency.

[0074] By applying the technical solution provided by the above embodiment of the present invention, the following advantages are also obtained: 1) It is possible to go deep into the bottom layer of the file system, access and operate various types of files, and achieve efficient and fast file indexing and monitoring with a low system resource occupancy rate; 2) It is possible to scan the sensitive file flow operations of concern, and through in-depth analysis of the file operation correlation and the file content change characteristics, it is possible to discover abnormal encryption operations for files in near real time, capture the encryption process status for correlation analysis, and alarm and block according to the user's predefined configuration; 3) Based on the comprehensive analysis of the encryption primitive logic characteristics and encryption parameter characteristics, it is possible to discover whether the process has encryption capabilities. This technology is not limited by the specific cryptographic algorithm logic and the specific implementation of the cryptographic algorithm, and can discover whether there is a dedicated or special type of encryption logic, and has a good ability to pre-discover the encryption behavior of unknown cryptographic algorithms; 4) It summarizes the behavioral characteristics of fileless / scripted ransomware, implements targeted monitoring and defense blocking, and can resist and effectively block newer or even unknown ransomware families.

[0075] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0076] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0077] According to an embodiment of the present invention, there is also provided a ransomware blocking device applicable to an industrial control environment for implementing the above-mentioned ransomware blocking method applicable to an industrial control environment. Figure 6 is a schematic diagram of a ransomware blocking device applicable to an industrial control environment according to an embodiment of the present invention. Figure 6 As shown, the device includes: a first determining unit 61, a second determining unit 63, a constructing unit 65, an acquiring unit 67 and a blocking unit 69. The ransomware blocking device suitable for an industrial control environment is described in detail below.

[0078] The first determination unit 61 is used to determine that a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation is a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware samples represent behavior features of different ransomware in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation executed by the ransomware sample at the bottom layer of the operating system.

[0079] The second determination unit 63 is used to determine that the behavior feature generated by the ransomware sample in the ransomware sample library executing the second abnormal operation is the second target behavior feature, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample during the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware performs the ransom operation behavior, and the source file refers to the file extorted by the ransomware.

[0080] The construction unit 65 is used to construct an engine behavior library of the ransomware virus sample according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of behavior features of multiple ransomware virus samples.

[0081] The acquisition unit 67 is used to perform ransomware monitoring on the ransomware according to the engine behavior library to obtain monitoring results.

[0082] The blocking unit 69 is used to block the ransomware operation behavior when the monitoring result indicates that there is a ransomware operation behavior.

[0083] It should be noted here that the above-mentioned first determination unit 61, second determination unit 63, construction unit 65, acquisition unit 67 and blocking unit 69 correspond to steps S202 to S210 in the above-mentioned embodiments, and the five units are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0084] As can be seen from the above, in the scheme recorded in the above embodiment of the present invention, the first determination unit can be used to determine that the behavior characteristics generated by the ransomware sample in the ransomware sample library executing the first abnormal operation are the first target behavior characteristics, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware sample represents the behavior characteristics of different ransomware in the process of implementing the ransomware, and the first abnormal operation refers to the abnormal operation performed by the ransomware sample at the bottom layer of the operating system; then the second determination unit is used to determine that the behavior characteristics generated by the ransomware sample in the ransomware sample library executing the second abnormal operation are the second target behavior characteristics, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample in the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware performs the ransomware operation behavior, and the source file refers to the file extorted by the ransomware; then the construction unit is used to determine the behavior characteristics generated by the ransomware sample in the ransomware sample library according to the first target behavior characteristics and the second target The engine behavior library of the ransomware sample is constructed based on the behavioral characteristics, wherein the engine behavior library is a collection of behavioral characteristics of multiple ransomware samples; then the acquisition unit is used to monitor the ransomware according to the engine behavior library to obtain the monitoring result; finally, the blocking unit is used to block the ransomware operation behavior when the monitoring result indicates the existence of the ransomware operation behavior, thereby achieving the purpose of building an engine behavior library according to the behavioral characteristics of the ransomware samples in the ransomware sample library when performing abnormal operations, and monitoring whether the ransomware has ransomware operation behavior based on the engine behavior library and blocking the existing ransomware operation behavior, realizing the technical effect of directly monitoring and blocking the ransomware operation behavior of the ransomware based on the engine behavior library, which is not limited to the supervision method of equipment and specific viruses, and can realize the comprehensive supervision of different equipment in the industrial control environment in different ways, thereby improving the analysis and supervision efficiency.

[0085] Therefore, the technical solution provided by the above-mentioned embodiment of the present invention solves the technical problem in the related art that the traditional method used for monitoring and implementation targets a single device, has weak correlation, and leads to low monitoring efficiency.

[0086] Optionally, the ransomware blocking device suitable for an industrial control environment further includes at least one of the following: a first acquisition unit, used to acquire a ransomware sample library before determining that a behavior feature generated by a ransomware sample in the ransomware sample library executing a first abnormal operation is a first target behavior feature; a second acquisition unit, used to acquire multiple ransomware samples and construct a ransomware sample library based on the multiple ransomware samples.

[0087] Optionally, the first determination unit includes one of the following: a first determination module, used to determine that the behavior characteristics generated by the ransomware sample performing the target serialization operation multiple times are the first target behavior characteristics, wherein the target serialization operation refers to the operation of the ransomware sample replacing the source file with the encrypted file and deleting the source file, and the encrypted file is the file obtained by the ransomware sample encrypting the source file; a second determination module, used to determine that the behavior characteristics of the encrypted file after the ransomware sample performs the target serialization operation compared with the source file are greater than the entropy change threshold as the first target behavior characteristics; a third determination module, used to determine that the behavior characteristics generated by the ransomware sample performing the process injection operation are the first target behavior characteristics, wherein the process injection operation refers to the ransomware sample injecting its own code into a running process or having injected its own code into a process operation; a fourth determination module, used to determine that the behavior characteristics generated by the ransomware sample performing a registry modification operation are the first target behavior characteristics, wherein the registry modification operation refers to the operation of the ransomware sample modifying the registry of the operating system; a fifth determination module, used to determine that the behavior characteristics generated by the ransomware sample performing a backup deletion operation are the first target behavior characteristics, wherein the backup deletion operation refers to the operation of the ransomware sample deleting the shadow backup of the operating system, and the shadow backup refers to the operation for restoring encrypted or deleted files in the operating system; a sixth determination module, used to determine that the behavior characteristics generated by the ransomware sample performing an abnormal file operation are the first target behavior characteristics, wherein the abnormal file operation at least includes: an operation of changing file attributes, an operation of abnormally moving files, and an operation of abnormally accessing files.

[0088] Optionally, the second determination unit includes: a seventh determination module, used to determine that the behavior characteristic of the ransomware sample in the process of encrypting the source file, that the number of encryptions is greater than the first encryption threshold, is a second target behavior characteristic, wherein the first encryption threshold is used to determine whether there is an abnormality in the number of encryptions in the encryption process, and the encryption process refers to the process of the ransomware sample encrypting the source file; an eighth determination module, used to determine that the behavior characteristic of the ransomware sample in the process of encrypting the source file, that the number of cryptographic primitives detected is greater than the second encryption threshold, is a second target behavior characteristic, wherein the second encryption threshold is used to determine whether there is an abnormality in the number of cryptographic primitives in the encryption process.

[0089] Optionally, the acquisition unit includes: a first acquisition module, used to monitor the file system behavior and / or process behavior according to the engine behavior library to determine whether there is a first target behavior feature in the file system behavior and / or process behavior, and obtain a first judgment result; a second acquisition module, used to monitor the encryption operations and cryptographic primitives in the file system behavior and / or process behavior according to the engine behavior library to determine whether there is a second target behavior feature in the file system behavior and / or process behavior, and obtain a second judgment result; a ninth determination module, used to determine that the first judgment result and the second judgment result are monitoring results, wherein, when the first judgment result indicates that there is the first target behavior feature in the file system behavior and / or process behavior, and / or, the second target behavior feature in the file system behavior and / or process behavior, the monitoring result indicates the presence of ransomware operation behavior.

[0090] Optionally, the blocking unit includes at least one of the following: a first blocking module, used to block the ransomware operation behavior by bait delivery, wherein the bait delivery refers to using specific files or information as bait to make the ransomware extort false files to block the ransomware from extorting real files, the false files refer to specific files or information used as bait, and the real files refer to files that need to be prevented from being extorted by the ransomware; a second blocking module, used to block the ransomware operation behavior by process blocking, wherein process blocking refers to monitoring and blocking the malicious process of the ransomware; a third blocking module, used to block the ransomware operation behavior by file write operation blocking, wherein file write operation blocking refers to blocking the ransomware from extorting real files by monitoring the write operation of the file system; a fourth blocking module, used to block the ransomware operation behavior by encryption operation blocking, wherein encryption operation blocking refers to preventing the encryption behavior of the ransomware to block the ransomware from extorting real files.

[0091] Optionally, the ransomware blocking device suitable for an industrial control environment further includes: a monitoring unit, which is used to monitor the ransomware in real time using a monitoring and blocking strategy, so as to block the ransomware operation behavior when there is a ransomware operation behavior, wherein the monitoring and blocking strategy includes at least: a loose strategy, a normal strategy, a sensitive strategy and a strict strategy.

[0092] According to another aspect of an embodiment of the present invention, a ransomware blocking system applicable to an industrial control environment is further provided. The ransomware blocking system applicable to an industrial control environment uses any of the above-mentioned ransomware blocking methods applicable to an industrial control environment.

[0093] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the above-mentioned ransomware blocking methods applicable to an industrial control environment.

[0094] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0095] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: determining a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation as a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware sample represents the behavior features of different ransomware in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation performed by the ransomware sample at the bottom layer of the operating system; determining a behavior feature generated by a ransomware sample in the ransomware sample library executing a second abnormal operation as a second target behavior feature, wherein the second abnormal operation refers to an abnormal operation performed by the ransomware sample in an encryption process, the encryption process refers to a process of encrypting a source file when the ransomware performs a ransomware operation behavior, and the source file refers to a file extorted by the ransomware; constructing an engine behavior library of the ransomware sample according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of behavior features including multiple ransomware samples; performing ransomware monitoring on the ransomware according to the engine behavior library to obtain a monitoring result; and blocking the ransomware operation behavior when the monitoring result indicates the existence of a ransomware operation behavior of the ransomware.

[0096] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: obtaining a ransomware sample library; obtaining multiple ransomware samples, and constructing a ransomware sample library based on the multiple ransomware samples.

[0097] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: determining that the behavior characteristic generated by the ransomware sample performing a target serialization operation multiple times is a first target behavior characteristic, wherein the target serialization operation refers to the operation in which the ransomware sample replaces the source file with the encrypted file and deletes the source file, and the encrypted file is the file obtained by encrypting the source file by the ransomware sample; determining that the behavior characteristic in which the entropy change of the encrypted file compared to the source file after the ransomware sample performs the target serialization operation is greater than the entropy change threshold is the first target behavior characteristic; determining that the behavior characteristic generated by the ransomware sample performing a process injection operation is the first target behavior characteristic, wherein the process injection operation refers to the ransomware sample injecting its own code into a running process or an already running process. The operation of injecting its own code into the process; determining the behavioral characteristics generated by the ransomware sample performing the registry modification operation as the first target behavioral characteristics, wherein the registry modification operation refers to the operation of the ransomware sample modifying the registry of the operating system; determining the behavioral characteristics generated by the ransomware sample performing the backup deletion operation as the first target behavioral characteristics, wherein the backup deletion operation refers to the operation of the ransomware sample deleting the shadow backup of the operating system, and the shadow backup refers to the operation used to restore encrypted or deleted files in the operating system; determining the behavioral characteristics generated by the ransomware sample performing abnormal file operations as the first target behavioral characteristics, wherein the abnormal file operations at least include: operations to change file attributes, operations to move files abnormally, and operations to access files abnormally.

[0098] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: determining a behavioral feature in which the number of encryptions of the ransomware sample during the process of encrypting the source file is greater than a first encryption threshold as a second target behavioral feature, wherein the first encryption threshold is used to determine whether there is an abnormality in the number of encryptions in the encryption process, and the encryption process refers to the process in which the ransomware sample encrypts the source file; determining a behavioral feature in which the number of cryptographic primitives detected in the process of encrypting the source file by the ransomware sample is greater than a second encryption threshold as a second target behavioral feature, wherein the second encryption threshold is used to determine whether there is an abnormality in the number of cryptographic primitives in the encryption process.

[0099] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: monitoring the file system behavior and / or process behavior according to the engine behavior library to determine whether a first target behavior feature exists in the file system behavior and / or process behavior, and obtaining a first judgment result; monitoring the encryption operations and cryptographic primitives in the file system behavior and / or process behavior according to the engine behavior library to determine whether a second target behavior feature exists in the file system behavior and / or process behavior, and obtaining a second judgment result; determining the first judgment result and the second judgment result as monitoring results, wherein, when the first judgment result indicates that the first target behavior feature exists in the file system behavior and / or process behavior, and / or, the second target behavior feature exists in the file system behavior and / or process behavior, the monitoring result indicates the presence of ransomware operation behavior.

[0100] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: blocking the ransomware operation by bait delivery, wherein bait delivery refers to using specific files or information as bait to make the ransomware extort false files to block the ransomware from extorting real files, the false files refer to specific files or information used as bait, and the real files refer to files that need to be prevented from being extorted by the ransomware; blocking the ransomware operation by process blocking, wherein process blocking refers to monitoring and blocking the malicious processes of the ransomware; blocking the ransomware operation by file write operation blocking, wherein file write operation blocking refers to blocking the ransomware from extorting real files by monitoring the write operations of the file system; blocking the ransomware operation by encryption operation blocking, wherein encryption operation blocking refers to preventing the encryption behavior of the ransomware to block the ransomware from extorting real files.

[0101] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: using a monitoring and blocking strategy to monitor the ransomware in real time to block the ransomware operation behavior when there is a ransomware operation behavior, wherein the monitoring and blocking strategy includes at least: a loose strategy, a normal strategy, a sensitive strategy and a strict strategy.

[0102] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is running, any one of the above-mentioned ransomware blocking methods applicable to an industrial control environment is executed.

[0103] According to another aspect of an embodiment of the present invention, a computer program product is further provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned ransomware blocking methods applicable to an industrial control environment.

[0104] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0105] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0107] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0108] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0109] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0110] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A ransomware blocking method suitable for an industrial control environment, characterized in that: include: Determine a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation as a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware samples represent the behavior features of different ransomware software in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation performed by the ransomware sample at the bottom layer of the operating system; Determining that the behavior feature generated by the ransomware sample in the ransomware sample library performing a second abnormal operation is a second target behavior feature, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample during an encryption process, the encryption process refers to a process in which the ransomware encrypts a source file when performing a ransomware operation, and the source file refers to a file extorted by the ransomware; Building an engine behavior library of the ransomware virus sample according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of the behavior features of multiple ransomware virus samples; Performing ransomware monitoring on the ransomware according to the engine behavior library to obtain monitoring results; When the monitoring result indicates that there is a ransomware operation behavior, the ransomware operation behavior is blocked.

2. The ransomware blocking method applicable to an industrial control environment according to claim 1, characterized in that: Before determining that the behavior feature generated by the ransomware sample in the ransomware sample library executing the first abnormal operation is the first target behavior feature, at least one of the following is also included: Obtaining the ransomware virus sample library; A plurality of the ransomware virus samples are obtained, and the ransomware virus sample library is constructed based on the plurality of the ransomware virus samples.

3. The ransomware blocking method applicable to an industrial control environment according to claim 1, characterized in that: Determining the behavior feature generated by the first abnormal operation performed by the ransomware sample in the ransomware sample library as the first target behavior feature includes one of the following: Determining that the behavior feature generated by the ransomware sample performing the target serialization operation multiple times is the first target behavior feature, wherein the target serialization operation refers to an operation in which the ransomware sample replaces the source file with the encrypted file and then deletes the source file, and the encrypted file is a file obtained by the ransomware sample encrypting the source file; Determine that the behavior feature in which the entropy change of the encrypted file compared to the source file after the ransomware virus sample executes the target serialization operation is greater than an entropy change threshold as the first target behavior feature; Determining that the behavior feature generated by the process injection operation performed by the ransomware virus sample is the first target behavior feature, wherein the process injection operation refers to an operation in which the ransomware virus sample injects its own code into a running process or has already injected its own code into the process; Determining that the behavior feature generated by the ransomware virus sample performing a registry modification operation is the first target behavior feature, wherein the registry modification operation refers to an operation in which the ransomware virus sample modifies the registry of the operating system; Determining that the behavior feature generated by the ransomware virus sample performing a backup deletion operation is the first target behavior feature, wherein the backup deletion operation refers to an operation in which the ransomware virus sample deletes a shadow backup of the operating system, and the shadow backup refers to a file used to restore encrypted or deleted files in the operating system; Determine that the behavior feature generated by the ransomware virus sample performing an abnormal file operation is the first target behavior feature, wherein the abnormal file operation at least includes: an operation of changing file attributes, an operation of abnormally moving a file, and an operation of abnormally accessing a file.

4. The ransomware blocking method applicable to an industrial control environment according to claim 1, characterized in that: Determining the behavior feature generated by the ransomware sample in the ransomware sample library executing the second abnormal operation as the second target behavior feature includes: Determine that the behavior feature in which the number of encryptions of the ransomware sample during the process of encrypting the source file is greater than a first encryption threshold as the second target behavior feature, wherein the first encryption threshold is used to determine whether there is an abnormality in the number of encryptions in the encryption process, and the encryption process refers to the process in which the ransomware sample encrypts the source file; Determine that the behavior feature in which the number of cryptographic primitives detected by the ransomware sample during the process of encrypting the source file is greater than a second encryption threshold as the second target behavior feature, wherein the second encryption threshold is used to determine whether there is an abnormality in the number of cryptographic primitives in the encryption process.

5. The ransomware blocking method applicable to an industrial control environment according to claim 1, characterized in that: The ransomware is monitored according to the engine behavior library to obtain monitoring results, including: Monitoring the file system behavior and / or the process behavior according to the engine behavior library to determine whether the first target behavior feature exists in the file system behavior and / or the process behavior, and obtaining a first determination result; Monitoring the encryption operations and cryptographic primitives in the file system behavior and / or the process behavior according to the engine behavior library to determine whether the second target behavior feature exists in the file system behavior and / or the process behavior, and obtaining a second determination result; Determine the first judgment result and the second judgment result as the monitoring result, wherein, when the first judgment result indicates that the first target behavior feature exists in the file system behavior and / or the process behavior, and / or the second target behavior feature exists in the file system behavior and / or the process behavior, the monitoring result indicates that the ransomware has the ransom operation behavior.

6. The ransomware blocking method applicable to an industrial control environment according to claim 1, characterized in that: When the monitoring result indicates that there is a ransomware operation behavior of the ransomware, blocking the ransomware operation behavior includes at least one of the following: The extortion operation behavior is blocked by bait delivery, wherein the bait delivery refers to using a specific file or information as bait to make the ransomware extort a false file, so as to block the ransomware from extorting a real file, the false file refers to the specific file or information used as bait, and the real file refers to the file that needs to be prevented from being extorted by the ransomware; Blocking the ransomware operation by process blocking, wherein process blocking refers to monitoring and blocking the malicious process of the ransomware; The extortion operation behavior is blocked by blocking file write operations, wherein the file write operation blocking refers to blocking the extortion of the real file by the ransomware by monitoring the write operation of the file system; The ransomware operation behavior is blocked by using encryption operation blocking, wherein the encryption operation blocking refers to preventing the encryption behavior of the ransomware software to block the ransomware software from ransomware the real file.

7. The ransomware blocking method applicable to an industrial control environment according to claim 1, characterized in that: Also includes: The ransomware is monitored in real time by adopting a monitoring and blocking strategy, so as to block the ransomware operation behavior when the ransomware has the ransomware operation behavior, wherein the monitoring and blocking strategy at least includes: a loose strategy, a normal strategy, a sensitive strategy and a strict strategy.

8. A ransomware blocking device suitable for an industrial control environment, characterized in that: include: A first determining unit is used to determine a behavior feature generated by a ransomware sample in a ransomware sample library executing a first abnormal operation as a first target behavior feature, wherein the ransomware sample library is a collection of multiple ransomware samples, the ransomware samples represent the behavior features of different ransomware software in the process of implementing ransomware, and the first abnormal operation refers to an abnormal operation performed by the ransomware sample at the bottom layer of the operating system; A second determination unit is used to determine that the behavior feature generated by the ransomware sample in the ransomware sample library performing a second abnormal operation is a second target behavior feature, wherein the second abnormal operation refers to the abnormal operation performed by the ransomware sample during the encryption process, the encryption process refers to the process of encrypting the source file when the ransomware performs the ransomware operation behavior, and the source file refers to the file extorted by the ransomware; A construction unit, configured to construct an engine behavior library of the ransomware virus sample according to the first target behavior feature and the second target behavior feature, wherein the engine behavior library is a collection of the behavior features of a plurality of ransomware virus samples; An acquisition unit, configured to perform ransomware monitoring on the ransomware according to the engine behavior library to obtain a monitoring result; The blocking unit is used to block the ransomware operation behavior when the monitoring result indicates that there is a ransomware operation behavior of the ransomware software.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the ransomware blocking method applicable to an industrial control environment as described in any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by the processor, the ransomware blocking method applicable to the industrial control environment as described in any one of claims 1 to 7 is executed.

Images