Method and system for preventing ransomware virus in industrial scene, medium and electronic equipment

Abstract

The invention provides a method for preventing ransomware in an industrial scene. The method comprises the following steps: installing a set of special drive program and matched application program on an industrial computer needing to be protected; a drive program performs Hook file opening operation on a system kernel layer, and intercepts all file opening requests; and performing real-time judgment on the file opening request, and if the target file is an important file and the execution program is an illegal program, refusing the request. The invention provides an innovative ransomware virus protection method aiming at industrial scene characteristics, and provides a more comprehensive, efficient and real-time network security guarantee for industrial enterprises through accurate file operation interception and program legality judgment.

Description

Technical Field

[0001] The present invention belongs to the field of industrial software, and specifically relates to a method, system, medium and electronic equipment for preventing ransomware in industrial scenarios. Background Art

[0002] In the development of malware, ransomware has rampantly spread across the global network with the help of virtual currency. This is especially true for industrial enterprises, whose computers often store important industrial data and industrial files. If they are attacked by ransomware, it often means significant data asset losses and economic losses. The harm of ransomware is becoming more and more serious, and there is even a RaaS (Ransomware As A Service) industry. The creators of ransomware viruses develop ransomware and ransomware platforms. Anyone can download and distribute the ransomware and use the ransomware platform to perform ransom operations. The owner of RaaS and the actual distributor of the ransomware virus share the ransom proceeds.

[0003] There are several traditional ways to deal with ransomware:

[0004] 1. Antivirus software: Antivirus software detects target files by file signatures. If the target file contains a specific signature, it will be identified as a virus / ransomware. However, this detection method cannot keep up with the speed of ransomware updates. At the same time, antivirus software is not very suitable for industrial scenarios. Once the antivirus software misidentifies a key industrial software as a virus, it will cause unpredictable consequences.

[0005] 2. Active behavior analysis: Dynamically identify the behavior of the target program. If the target program performs a series of specific operations, it is judged as ransomware. This method is better than antivirus software, but advanced ransomware can also be bypassed through some mature means, such as dividing it into multiple programs, each of which only processes a specific step, so that such technology can be deceived;

[0006] 3. Bait trapping: Store some bait files in a specific directory. Once these files are encrypted by the ransomware, trace back the attack chain to locate the attack program and lock it. This approach is delayed on the one hand, and the ransomware cannot be caught immediately. By the time it is locked, the software may have been copied and spread to multiple computers; on the other hand, there is no guarantee that the ransomware will encrypt the bait files first. If important industrial files are encrypted first and then the bait files are encrypted, this detection method will be meaningless.

[0007] 4. Sandbox detection: Run the target file in a specific sandbox / virtual machine, track the behavior of the target program, and detect whether it is a ransomware virus. The first obstacle is that the current anti-sandbox technology is very mature. For example, if the attack is delayed, waiting for half a year before the attack occurs again, the sandbox detection basically loses its meaning. The second obstacle is that the sandbox detection takes a certain amount of time and cannot be completed in the first time, which affects the user experience;

[0008] In short, there is currently no perfect method to control ransomware in the industrial field. Summary of the invention

[0009] The purpose of the present invention is to provide a method, system, medium and electronic device for preventing ransomware in industrial scenarios.

[0010] The technical solution of the present invention is as follows:

[0011] A method for preventing ransomware in an industrial scenario, the method comprising:

[0012] Install a set of special drivers and supporting applications on the industrial computers that need to be protected;

[0013] The driver hooks the file opening operation at the system kernel level and intercepts all file opening requests;

[0014] The file opening request is judged in real time. If the target file is an important document and the executed program is not a legitimate program, the request is rejected.

[0015] Furthermore, the driver program hooks the file opening operation at the system kernel level and intercepts all file opening requests specifically as follows:

[0016] Through the supporting application, the computer is scanned, all important industrial documents and the programs that can legally modify these documents are identified and marked, and a document-program mapping table is established.

[0017] The driver works at the operating system kernel level and intercepts all file opening requests through Hook technology.

[0018] Furthermore, the real-time judgment of the file opening request is specifically as follows:

[0019] After intercepting a file open request, the driver will check whether the target file in the request is an important document previously identified. If it is not an important document, the driver will directly release the request without any intervention;

[0020] If the target file is an important document, the driver will further check whether the program that performs the open operation is a legitimate program recorded in the previous mapping relationship table;

[0021] If the executed program is not a legitimate program, the driver will deny the opening request, thus preventing the ransomware from encrypting important files.

[0022] Furthermore, the driver program Hook file opening operation specifically includes:

[0023] Use the minifilter filter driver in Windows; modify the syscall table in Linux.

[0024] The present invention also provides a system for preventing ransomware in an industrial scenario, the system comprising:

[0025] Program installation module, used to install a set of special drivers and supporting applications on the industrial computers that need to be protected;

[0026] The Hook module is used by the driver to hook the file opening operation at the system kernel level and intercept all file opening requests;

[0027] The request judgment module is used to make real-time judgment on the file opening request. If the target file is an important document and the executing program is not a legitimate program, the request will be rejected.

[0028] An electronic device includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned method for preventing ransomware viruses in industrial scenarios.

[0029] A computer-readable storage medium stores a computer program, wherein the computer program is executed by a processor to implement the above-mentioned method for preventing ransomware in an industrial scenario.

[0030] Compared with the prior art, the present invention has the following advantages:

[0031] Precise protection: Through the mapping relationship between files and programs, accurate identification and protection of important documents are achieved.

[0032] Real-time interception: Intercept at the system kernel level to ensure immediate discovery and blocking of ransomware encryption operations.

[0033] Highly controllable: Taking advantage of the stability of the industrial environment, the possibility of misjudgment and misoperation is reduced.

[0034] Minimize losses: Even if ransomware invades, the company's economic losses and data security risks are minimized because important files are not encrypted BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings generally illustrate various embodiments by way of example and not limitation, and together with the description and claims, serve to illustrate the embodiments of the invention. Where appropriate, the same reference numerals are used throughout the drawings to refer to the same or similar parts. Such embodiments are illustrative and are not intended to be exhaustive or exclusive embodiments of the present apparatus or method.

[0036] Figure 1 A schematic flow chart of the method of the present invention is shown. DETAILED DESCRIPTION

[0037] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0038] Unlike computers in office networks, computers in the industrial field are extremely stable. They usually do not install new programs at will, do not upgrade versions, and do not even patch the system. This means that the operating environment of computers in the industrial field is relatively stable.

[0039] For example, in the engineer station for Siemens PLC, except for WinCC program, other programs are not critical industrial processes. The only program that can write PLC code is WinCC, and any other program should not modify the PLC code file. If the computer is also used to write Word documents, the program used is either Office or WPS. In short, for computers in industrial environments, all important data can only be modified by specific programs, and any other programs beyond this scope should not modify them.

[0040] Based on the above principles, a system driver is developed to hook all file operations in the system kernel and perform filtering and interception, as follows:

[0041] 1. Develop a set of drivers and supporting applications and install them on the computer to be protected;

[0042] 2. The application scans the current computer and traverses the disk to find important documents and programs that modify these documents;

[0043] 3. Map these documents and programs into a relationship for future use;

[0044] 4. Driver Hook file opening operation. For example, for Windows operating system, you can use minifilter filter driver to capture IRP request of IRP_MJ_CREATE in callback and specify PreOperation function for it so as to intercept when file opening operation occurs. For Linux system, you can modify the syscall entry address related to file opening in the kernel and replace the entry address with the interception function, such as replacing the function at the offset address of __NR_openat and __NR_openat2 in the syscall table with the interception function.

[0045] 5. When a file open request reaches the kernel, it is intercepted by a filter callback or directly intercepted by our kernel driver;

[0046] 6. The driver determines whether the target file is an important document, such as PLC code, Word or other important files;

[0047] 7. If it is not an important document in releasing the request;

[0048] 8. If it is an important document, the driver determines whether the program that performs the operation is a legitimate program based on the mapping relationship generated in step 3;

[0049] 9. If it is not a legitimate procedure, deny the request;

[0050] By following the above steps, the ransomware cannot encrypt important documents. If the documents are not encrypted, even if the computer is attacked by the ransomware, there will be no significant negative impact, and the loss can be minimized.

[0051] An embodiment of the present invention further provides a system for preventing ransomware in an industrial scenario, the system comprising:

[0052] Program installation module, used to install a set of special drivers and supporting applications on the industrial computers that need to be protected;

[0053] The Hook module is used by the driver to hook the file opening operation at the system kernel level and intercept all file opening requests;

[0054] The request judgment module is used to make real-time judgment on the file opening request. If the target file is an important document and the executing program is not a legitimate program, the request will be rejected.

[0055] An electronic device includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned method for preventing ransomware viruses in industrial scenarios.

[0056] A computer-readable storage medium stores a computer program, wherein the computer program is executed by a processor to implement the above-mentioned method for preventing ransomware in an industrial scenario.

[0057] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for preventing ransomware in an industrial scenario, characterized in that: The method comprises: Install drivers and supporting applications on industrial computers that need to be protected; The driver hooks the file opening operation at the system kernel level and intercepts all file opening requests; The file opening request is judged in real time. If the target file is an important document and the executed program is not a legitimate program, the request is rejected.

2. The method for preventing ransomware in an industrial scenario according to claim 1, characterized in that: The driver hooks the file opening operation at the system kernel level and intercepts all file opening requests specifically as follows: Through the supporting application, the computer is scanned, all important industrial documents and the programs that can legally modify these documents are identified and marked, and a document-program mapping table is established. The driver works at the operating system kernel level and intercepts all file opening requests through Hook technology.

3. The method for preventing ransomware in an industrial scenario according to claim 1, characterized in that: The specific real-time judgment of the file opening request is as follows: After intercepting a file open request, the driver will check whether the target file in the request is an important document previously identified. If it is not an important document, the driver will directly release the request without any intervention; If the target file is an important document, the driver will further check whether the program that performs the open operation is a legitimate program recorded in the previous mapping relationship table; If the executed program is not a legitimate program, the driver will deny the opening request, thus preventing the ransomware from encrypting important files.

4. The method for preventing ransomware in an industrial scenario according to claim 1, characterized in that: The driver program Hook file opening operation specifically includes: Use the minifilter filter driver in Windows; modify the syscall table in Linux.

5. A system for preventing ransomware in industrial scenarios, characterized in that: The system comprises: Program installation module, used to install a set of special drivers and supporting applications on the industrial computers that need to be protected; The Hook module is used by the driver to hook the file opening operation at the system kernel level and intercept all file opening requests; The request judgment module is used to make real-time judgment on the file opening request. If the target file is an important document and the executing program is not a legitimate program, the request will be rejected.

6. An electronic device, characterized in that: It includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the method for preventing ransomware in an industrial scenario according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: It stores a computer program, and when the computer program is executed by a processor, it implements the method for preventing ransomware viruses in an industrial scenario as described in any one of claims 1 to 4.

Images