File protection method, device, equipment, storage medium and program product

Abstract

The present disclosure provides a file protection method, which relates to the field of network security technology and can be applied to the field of financial technology. The method includes: determining a target file based on a file update model, wherein the file update model is self-learned and generated based on system file update status; determining a decoy file generation rule based on the file size and file name of the target file; generating a decoy file corresponding to the target file according to the generation rule; placing the decoy file in a designated file path; monitoring the decoy file in real time to record information about the process accessing the decoy file; and performing an alarm operation based on the process information and a whitelist. The present disclosure also provides a file protection device, equipment, storage medium, and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, specifically to the field of file anti-ransomware technology, and more specifically to a file protection method, device, equipment, storage medium and program product. Background Art

[0002] Ransomware has become a rampant form of cybersecurity threat. Ransomware encrypts victims' important files and demands a ransom for the decryption key. This poses a significant risk to businesses, potentially leading to not only financial losses but also serious consequences such as damaged brand reputation and business stagnation. While the industry is currently focused on developing and implementing various security tools to detect ransomware, missed detection or failure to detect it in a timely manner can put a company's critical data at risk. Even though most ransomware attacks can be mitigated after detection, if critical data has already been encrypted, it may be impossible to recover even after resolving the ransomware attack. Therefore, there is an urgent need for file protection methods to mitigate the risk of ransomware attacks.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a file protection method, apparatus, device, storage medium and program product for preventing ransomware attacks.

[0005] According to a first aspect of the present disclosure, a file protection method is provided, the method comprising:

[0006] Determine the target file based on a file update model, wherein the file update model is generated by self-learning based on system file update conditions;

[0007] Determine a generation rule of the bait file based on the file size and file name of the target file;

[0008] Generate a bait file corresponding to the target file according to the generation rule;

[0009] Placing the bait file in a designated file path;

[0010] Performing real-time monitoring on the bait file to record process information of accessing the bait file; and

[0011] An alarm operation is performed based on the process information and the whitelist.

[0012] According to an embodiment of the present disclosure, the generation rule of the bait file determined based on the file size and file name of the target file includes:

[0013] Determining content generation rules for the decoy file based on the target file size; and

[0014] The naming rule of the bait file is determined according to the target file name.

[0015] According to an embodiment of the present disclosure, the content generation rule of the bait file determined according to the target file size includes:

[0016] If it is determined that the target file size is greater than a second preset threshold, determining to use a sparse file to create a bait file; and

[0017] If it is determined that the target file size is less than or equal to the second preset threshold, it is determined that the size and content of the bait file are consistent with the target file.

[0018] According to an embodiment of the present disclosure, determining the naming rule of the bait file according to the target file name includes:

[0019] If it is determined that a fixed naming rule exists for the target file name, determining a naming rule for the bait file based on the fixed naming rule; and

[0020] If it is determined that there is no fixed naming rule for the target file name, a naming rule for the bait file is determined based on the target file name.

[0021] According to an embodiment of the present disclosure, the fixed naming rule includes naming by date and naming by number, and the naming rule of the bait file determined based on the fixed naming rule includes:

[0022] If it is determined that the fixed naming rule is named according to date, the file name of the bait file is set to the earliest or latest date; and

[0023] If it is determined that the fixed naming rule is to name according to the number, the file name of the bait file is set to the largest or smallest number.

[0024] According to an embodiment of the present disclosure, determining the naming rule of the bait file based on the target file name includes:

[0025] Add special characters before and after the target file name as the file name of the bait file.

[0026] According to an embodiment of the present disclosure, determining the target file based on the file update model includes:

[0027] Obtaining system file data within a preset learning period, wherein the system file data includes file name, file type, folder path, file content, and update frequency; and

[0028] The file whose update frequency is greater than a first preset threshold is determined as a target file.

[0029] According to an embodiment of the present disclosure, before performing an alarm operation according to the process information and the whitelist, the method further includes:

[0030] Collecting all process information accessing the decoy file within a preset learning period; and

[0031] A whitelist is created based on the full process information.

[0032] According to an embodiment of the present disclosure, performing an alarm operation based on the process information and the whitelist includes:

[0033] Filtering the process information according to the whitelist to determine the illegal access process; and

[0034] If it is determined that there is an illegal access process, an alarm message will be sent in the form of email or text message.

[0035] According to an embodiment of the present disclosure, it further includes:

[0036] The corresponding bait file is updated according to the update frequency of the target file.

[0037] A second aspect of the present disclosure provides a document protection device, the device comprising:

[0038] A target file determination module is used to determine the target file based on a file update model, wherein the file update model is generated by self-learning based on system file update conditions;

[0039] A determination module, configured to determine a generation rule of a decoy file based on the file size and file name of the target file;

[0040] A generation module, configured to generate a decoy file corresponding to the target file according to the generation rules;

[0041] A storage module, used for placing the bait file in a designated file path;

[0042] A monitoring module, configured to monitor the bait file in real time to record process information of accessing the bait file; and

[0043] The alarm module is used to perform an alarm operation based on the process information and the whitelist.

[0044] According to an embodiment of the present disclosure, the determination module includes: a first determination submodule and a second determination submodule.

[0045] A first determining submodule is configured to determine a content generation rule for a decoy file according to a target file size; and

[0046] The second determining submodule is used to determine the naming rule of the bait file according to the target file name.

[0047] According to an embodiment of the present disclosure, the first determining submodule includes a first determining unit and a second determining unit.

[0048] A first determining unit is configured to determine to use a sparse file to create a decoy file if it is determined that the target file size is greater than a second preset threshold; and

[0049] The second determining unit is configured to determine that the size and content of the bait file are consistent with the target file if it is determined that the target file size is less than or equal to a second preset threshold.

[0050] According to an embodiment of the present disclosure, the second determining submodule includes a third determining unit and a fourth determining unit.

[0051] a third determining unit, configured to, if it is determined that a fixed naming rule exists for the target file name, determine a naming rule for the decoy file based on the fixed naming rule; and

[0052] The fourth determining unit is configured to determine a naming rule for the bait file based on the target file name if it is determined that no fixed naming rule exists for the target file name.

[0053] According to an embodiment of the present disclosure, the third determination unit is also used to set the file name of the bait file to the earliest or latest date if it is determined that the fixed naming rule is named according to date; and if it is determined that the fixed naming rule is named according to number, set the file name of the bait file to the largest or smallest number.

[0054] According to an embodiment of the present disclosure, the fourth determining unit is further configured to add special characters before and after the target file name as the file name of the bait file.

[0055] According to an embodiment of the present disclosure, the target file determination module includes an acquisition submodule and a target file determination submodule.

[0056] An acquisition submodule, configured to acquire system file data within a preset learning cycle, wherein the system file data includes file name, file type, folder path, file content, and update frequency; and

[0057] The target file determination submodule is configured to determine a file whose update frequency is greater than a first preset threshold as a target file.

[0058] According to an embodiment of the present disclosure, it also includes a process collection module and a whitelist establishment module.

[0059] A process collection module, used to collect all process information accessing the decoy file within a preset learning period; and

[0060] The whitelist establishment module is used to establish a whitelist according to the full process information.

[0061] According to an embodiment of the present disclosure, the whitelist establishment module includes a screening submodule and an alarm submodule.

[0062] a screening submodule, configured to screen the process information according to the whitelist to determine an illegally accessed process; and

[0063] The alarm submodule is used to send an alarm message in the form of email or SMS if it is determined that there is an illegal access process.

[0064] According to an embodiment of the present disclosure, it further includes: a bait file update module.

[0065] The bait file updating module is used to update the corresponding bait file according to the update frequency of the target file.

[0066] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned file protection method.

[0067] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned file protection method.

[0068] The fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned file protection method when executed by a processor.

[0069] A file protection method provided by an embodiment of the present disclosure determines a target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; determines a generation rule for a bait file based on the file size and file name of the target file; generates a bait file corresponding to the target file according to the generation rule; places the bait file in a designated file path; monitors the bait file in real time to record process information accessing the bait file; and performs an alarm operation based on the process information and the whitelist. Compared to related technologies, the embodiment of the present disclosure can self-learn the system file update situation based on the file update model, and then automatically determine important files; in addition, determining the generation rule for the bait file based on the target file size and file name can increase the probability of the bait file being indexed and reduce the storage resource occupation by the bait file. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0071] Figure 1 Schematically illustrates an application scenario diagram of the file protection method, apparatus, device, storage medium, and program product according to an embodiment of the present disclosure;

[0072] Figure 2a The system architecture diagram of the file protection device provided according to the embodiment of the present disclosure is schematically shown;

[0073] Figure 2b The following schematically shows a file protection flow chart provided according to an embodiment of the present disclosure;

[0074] Figure 3 A flowchart of a file protection method provided according to an embodiment of the present disclosure is schematically shown;

[0075] Figure 4 A flowchart of a file protection method provided according to another embodiment of the present disclosure is schematically shown;

[0076] Figure 5 A flowchart of a method for determining a generation rule of a decoy file based on the file size and file name of the target file according to an embodiment of the present disclosure is schematically shown;

[0077] Figure 6 Schematically shows a flow chart of a method for determining content generation rules of a bait file according to the size of a target file provided in accordance with an embodiment of the present disclosure;

[0078] Figure 7 A flowchart of a method for determining a naming rule of a bait file according to a target file name provided in accordance with an embodiment of the present disclosure is schematically shown.

[0079] Figure 8 A structural block diagram of a file protection device according to an embodiment of the present disclosure is schematically shown; and

[0080] Figure 9 A block diagram of an electronic device suitable for implementing a file protection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0081] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0082] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0083] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0084] When expressions such as "at least one of A, B and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0085] Based on the above technical problems, an embodiment of the present disclosure provides a file protection method, which includes: determining a target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; determining a generation rule for a bait file based on the file size and file name of the target file; generating a bait file corresponding to the target file according to the generation rule; placing the bait file in a specified file path; monitoring the bait file in real time to record process information of accessing the bait file; and performing an alarm operation based on the process information and the whitelist.

[0086] Figure 1 The application scenario diagram of the file protection method, apparatus, device, storage medium and program product according to the embodiments of the present disclosure is schematically shown.

[0087] like Figure 1As shown, the application scenario 100 according to this embodiment may include a file protection scenario. A network 104 is used to provide a medium for a communication link between terminal devices 101, 102, 103 and a server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0088] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0089] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0090] Server 105 can be a back-end server, which can execute the file protection method provided by the embodiment of the present disclosure, determine the first number of network requests in response to the network request of the client; if it is determined that the first number of network requests is less than or equal to the first preset threshold, perform traffic shaping on the network request based on the leaky bucket algorithm; if it is determined that the first number of network requests is greater than the first preset threshold, verify each network request based on the preset verification rule to determine the second number of network requests; and forward the network request based on the preset token bucket algorithm and the second number of network requests, and the token in the preset token bucket algorithm is added with a timestamp.

[0091] It should be noted that the file protection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the file protection device provided in the embodiment of the present disclosure can generally be set in the server 105. The file protection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the file protection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0092] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0093] It should be noted that the file protection method and device determined in the embodiments of the present disclosure can be used in the field of Internet technology, the field of financial technology, and any field other than the financial field. The application field of the file protection method and device determined in the embodiments of the present disclosure is not limited.

[0094] Figure 2a The following schematically shows the system architecture of the file protection device provided according to an embodiment of the present disclosure. Figure 2b The following schematically shows a file protection flow chart provided according to an embodiment of the present disclosure. Figure 2a and Figure 2b As shown, the system includes a self-learning module A1, a generation module A2, and a monitoring module A3. Self-learning module A1 sets a learning cycle, during which it learns all updated files in the system and establishes a file update model, including information such as file name, file type, folder path, file content, and update frequency. Generation module A2 is responsible for generating and placing specific decoy files based on the learning results and generation strategy of self-learning module A1. The decoy files are regularly updated. Monitoring module A3 is responsible for real-time monitoring of decoy files and issuing alarms.

[0095] The following will be based on Figure 1 Describe the application scenarios and Figure 2a The system architecture described by Figures 3 to 6 The file protection method of the embodiment of the present disclosure is described in detail.

[0096] Figure 3 The flowchart of a file protection method provided according to an embodiment of the present disclosure is schematically shown. Figure 3 As shown, the file protection method of this embodiment includes operations S210 to S260, and the method can be executed by a server or other computing devices.

[0097] In operation S210 , a target file is determined based on a file update model.

[0098] According to an embodiment of the present disclosure, the file update model is generated by self-learning based on the system file update situation.

[0099] In one example, in order to protect important corporate files to cope with the risk of ransomware attacks, the disclosed embodiment adopts the concept of bait files. By placing seemingly important but actually specially crafted bait files in the system, attackers are induced to divert their attention and behavior to these files, thereby reducing the ransomware's attack on truly important files. In order to more quickly determine the target files that need to be protected among many files, the target files are determined based on the file update model. Specifically, a learning cycle is set, and within this cycle, all files updated in the system are learned to establish a file update model. The target files are automatically determined by the file update model.

[0100] In operation S220, a generation rule of a decoy file is determined based on the file size and file name of the target file.

[0101] In operation S230, a decoy file corresponding to the target file is generated according to the generation rule;

[0102] In operation S240, the bait file is placed in a designated file path;

[0103] In one example, in order to increase the probability of bait files being indexed and reduce the storage space occupied by bait files, when generating bait files, the generation rules of the bait files are determined based on the file size and file name of the target file, and the bait files corresponding to the target files are generated according to the generation rules. The bait files are placed in the specified file path. For specific generation rules, please refer to Figures 5 to 7 operation.

[0104] In operation S250, the bait file is monitored in real time to record process information of accessing the bait file.

[0105] In operation S260, an alarm operation is performed according to the process information and the whitelist.

[0106] In one example, the monitoring module is responsible for real-time monitoring and issuing alerts for decoy files. This is done in two phases. The first phase involves a learning cycle, utilizing eBPF (extended Berkeley Packet Filter) technology. eBPF is a technology for running user-written programs in the Linux kernel. eBPF programs are event-driven and can execute at multiple kernel hooks, such as system calls, function entry / exit points, kernel tracepoints, and network events. eBPF captures the file-opening system call "sys enter openat" and filters out accesses to decoy files. These captured events are then passed to a user-mode program for processing. The user-mode program receives event notifications from eBPF, records information about processes accessing the decoy files, and creates a whitelist. After the learning cycle, an alert is issued if a process not on the whitelist accesses the decoy file.

[0107] A file protection method provided by an embodiment of the present disclosure determines a target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; determines a generation rule for a bait file based on the file size and file name of the target file; generates a bait file corresponding to the target file according to the generation rule; places the bait file in a designated file path; monitors the bait file in real time to record process information accessing the bait file; and performs an alarm operation based on the process information and the whitelist. Compared to related technologies, the embodiment of the present disclosure can self-learn the system file update situation based on the file update model, and then automatically determine important files; in addition, determining the generation rule for the bait file based on the target file size and file name can increase the probability of the bait file being indexed and reduce the storage resource occupation by the bait file.

[0108] Figure 4 A flowchart of another file protection method provided according to an embodiment of the present disclosure is schematically shown.

[0109] like Figure 4 As shown, it includes operations S410 to S490.

[0110] In operation S410, system file data within a preset learning period is acquired.

[0111] According to an embodiment of the present disclosure, the system file data includes file name, file type, folder path, file content and update frequency.

[0112] In operation S420 , the file whose update frequency is greater than a first preset threshold is determined as a target file.

[0113] In one example, the system learns all updated files within a cycle and builds a file update model, including information such as file name, file type, folder path, file content, and update frequency. Files with an update frequency greater than a first preset threshold are identified as target files, i.e., important files. Optionally, files in a specified folder path can also be identified as target files.

[0114] In operation S430, a generation rule of a decoy file is determined based on the file size and file name of the target file.

[0115] In operation S440, a decoy file corresponding to the target file is generated according to the generation rule;

[0116] According to an embodiment of the present disclosure, the corresponding bait file is updated according to the update frequency of the target file.

[0117] In operation S450, the bait file is monitored in real time to record process information of accessing the bait file.

[0118] In operation S460, information about all processes accessing the decoy file is collected within a preset learning period.

[0119] In operation S470 , a whitelist is created based on the full process information.

[0120] In operation S480, the process information is screened according to the whitelist to determine an illegally accessed process.

[0121] In operation S490, if it is determined that there is an illegal access process, an alarm message is sent in the form of an email or a text message.

[0122] In one example, after a bait file is generated, the bait file is monitored in real time, and process information accessing the bait file is recorded. Specifically, the full process information accessing the bait file is collected within a preset learning cycle. A whitelist is established based on the full process information, and the whitelist contains access process records of legitimate users. The process information is filtered according to the whitelist to determine the illegal access process. If it is determined that an illegal access process exists, an alarm message is sent in the form of an email or text message. The disclosed embodiment provides a more proactive anti-ransomware attack method, which enhances the protection of important files by placing bait files and monitoring them in real time, thereby preventing ransomware attacks. By monitoring the access and modification of bait files in real time, abnormal activities can be discovered early, and timely measures can be taken to prevent further attacks on important files by ransomware, thereby maximizing data security and business continuity.

[0123] The following combination Figures 5 to 7 The generation rules of the bait file in the embodiment of the present disclosure are described in detail. Figure 5 The flowchart of the method for determining the generation rule of the bait file based on the file size and file name of the target file according to an embodiment of the present disclosure is schematically shown. Figure 6 The flowchart of the method for determining the content generation rule of a bait file according to the target file size provided in accordance with an embodiment of the present disclosure is schematically shown. Figure 7 A flowchart of a method for determining a naming rule of a bait file according to a target file name provided in accordance with an embodiment of the present disclosure is schematically shown.

[0124] like Figure 5 As shown, operation S220 includes operation S310 and operation S320.

[0125] In operation S310, a content generation rule of a decoy file is determined according to a target file size.

[0126] like Figure 6 As shown, operation S310 includes operation S311 and operation S312.

[0127] In operation S311 , if it is determined that the target file size is greater than a second preset threshold, it is determined to create a bait file using a sparse file.

[0128] In operation S312, if it is determined that the target file size is less than or equal to the second preset threshold, it is determined that the size and content of the bait file are consistent with the target file.

[0129] In one example, the content generation rules of the bait file are differentiated according to the size of the target file. For example, for files within 100M, the size and content of the corresponding bait file are consistent with the target file; for files larger than 100M, in order to save server disk space and try to control the disk usage of the bait file, a sparse file is used to create the corresponding bait file. The file size is displayed as the file size initially requested, and the occupied space is the actual amount of data written. For example, a virtual machine snapshot file of 2G is stored on the server system. The corresponding bait file is a sparse file that requests a size of 2G but actually occupies 100M. The actual content of the file is consistent with the first 100M of the snapshot file.

[0130] In operation S320, a naming rule of the decoy file is determined according to the target file name.

[0131] like Figure 7 As shown, operation S320 includes operation S321 and operation S322.

[0132] In operation S321, if it is determined that a fixed naming rule exists for the target file name, a naming rule for the decoy file is determined based on the fixed naming rule.

[0133] According to an embodiment of the present disclosure, the fixed naming rule includes naming by date and naming by number, and the naming rule of the bait file determined based on the fixed naming rule includes: if it is determined that the fixed naming rule is naming by date, the file name of the bait file is set to the earliest or latest date; and if it is determined that the fixed naming rule is naming by number, the file name of the bait file is set to the largest or smallest number.

[0134] In operation S322, if it is determined that the target file name does not have a fixed naming rule, a naming rule for the decoy file is determined based on the target file name.

[0135] According to an embodiment of the present disclosure, special characters are added before and after the target file name as the file name of the bait file.

[0136] In one example, there are two possible file naming scenarios. One is that important files follow specific naming rules, such as naming by date or number. Therefore, the naming of decoy files must also follow these rules, with the date or number set to the smallest or largest value to ensure indexing priority. The other scenario is that important files have no naming rules. To ensure decoy files are indexed first, special characters are added before and after the target file name to serve as the decoy file's name.

[0137] Based on the above file protection method, the present disclosure also provides a file protection device. Figure 8 The device is described in detail.

[0138] Figure 8 Schematically shows a structural block diagram of a file protection device according to an embodiment of the present disclosure. Figure 8 As shown, the file protection device 700 of this embodiment includes a target file determination module 710 , a determination module 720 , a generation module 730 , a storage module 740 , a monitoring module 750 and an alarm module 760 .

[0139] The target file determination module 710 is used to determine the target file based on the file update model, which is generated by self-learning based on the system file update situation. In one embodiment, the target file determination module 710 can be used to perform the operation S210 described above, which will not be repeated here.

[0140] The determination module 720 is used to determine the generation rule of the bait file based on the file size and file name of the target file. In one embodiment, the determination module 720 can be used to perform the operation S220 described above, which will not be repeated here.

[0141] The generation module 730 is used to generate a decoy file corresponding to the target file according to the generation rule. In one embodiment, the generation module 730 can be used to perform the operation S230 described above, which will not be repeated here.

[0142] The storage module 740 is used to place the bait file in a specified file path. In one embodiment, the storage module 740 can be used to perform the operation S240 described above, which will not be repeated here.

[0143] The monitoring module 750 is used to monitor the bait file in real time to record the process information of accessing the bait file. The monitoring module 750 can be used to perform the operation S250 described above, which will not be described in detail here.

[0144] The alarm module 760 is used to perform an alarm operation based on the process information and the whitelist. The alarm module 760 can be used to perform the operation S260 described above, which will not be repeated here.

[0145] According to an embodiment of the present disclosure, the determination module includes: a first determination submodule and a second determination submodule.

[0146] The first determination submodule is used to determine the content generation rule of the bait file according to the target file size. The first determination submodule can be used to perform the operation S310 described above, which will not be repeated here.

[0147] The second determining submodule is used to determine the naming rule of the bait file according to the target file name. The second determining submodule can be used to perform the operation S320 described above, which will not be repeated here.

[0148] According to an embodiment of the present disclosure, the first determining submodule includes a first determining unit and a second determining unit.

[0149] The first determining unit is used to determine whether to use a sparse file to create a bait file if it is determined that the target file size is greater than a second preset threshold. The first determining unit can be used to perform the operation S311 described above, which will not be repeated here.

[0150] The second determining unit is configured to determine that the size and content of the decoy file are consistent with the target file if the target file size is less than or equal to a second preset threshold. The second determining unit can be configured to execute the operation S312 described above, which will not be described in detail here.

[0151] According to an embodiment of the present disclosure, the second determining submodule includes a third determining unit and a fourth determining unit.

[0152] The third determining unit is used to determine the naming rule of the bait file based on the fixed naming rule if it is determined that the target file name has a fixed naming rule; the third determining unit can be used to perform the operation S321 described above, which will not be repeated here.

[0153] The fourth determining unit is configured to determine the naming rule of the decoy file based on the target file name if it is determined that the target file name does not have a fixed naming rule. The fourth determining unit can be configured to perform the operation S322 described above, which will not be described in detail here.

[0154] According to an embodiment of the present disclosure, the third determination unit is also used to set the file name of the bait file to the earliest or latest date if it is determined that the fixed naming rule is named according to date; and if it is determined that the fixed naming rule is named according to number, set the file name of the bait file to the largest or smallest number.

[0155] According to an embodiment of the present disclosure, the fourth determining unit is further configured to add special characters before and after the target file name as the file name of the bait file.

[0156] According to an embodiment of the present disclosure, the target file determination module includes an acquisition submodule and a target file determination submodule.

[0157] The acquisition submodule is used to obtain system file data within a preset learning cycle, and the system file data includes file name, file type, folder path, file content and update frequency; the acquisition submodule can be used to perform operation S410 described above, which will not be repeated here.

[0158] The target file determination submodule is configured to determine the file whose update frequency is greater than a first preset threshold as a target file. The target file determination submodule can be configured to execute the operation S420 described above, which will not be described in detail here.

[0159] According to an embodiment of the present disclosure, it also includes a process collection module and a whitelist establishment module.

[0160] The process collection module is used to collect all process information of accessing the bait file within a preset learning period; the process collection module can be used to perform the operation S460 described above, which will not be repeated here.

[0161] The whitelist establishment module is configured to establish a whitelist based on the full process information. The whitelist establishment module can be configured to execute the operation S470 described above, which will not be described in detail here.

[0162] According to an embodiment of the present disclosure, the whitelist establishment module includes a screening submodule and an alarm submodule.

[0163] The screening submodule is used to screen the process information according to the whitelist to determine the illegally accessed process; the screening submodule can be used to perform the operation S480 described above, which will not be repeated here.

[0164] The alarm submodule is used to send an alarm message in the form of an email or text message if it is determined that there is an illegal access process. The alarm submodule can be used to perform the operation S490 described above, which will not be repeated here.

[0165] According to an embodiment of the present disclosure, it further includes: a bait file update module.

[0166] The bait file update module is used to update the corresponding bait file according to the update frequency of the target file. The bait file update module can be used to perform the operations described above, which will not be repeated here.

[0167] According to an embodiment of the present disclosure, any multiple modules among the target file determination module 710, the determination module 720, the generation module 730, the storage module 740, the monitoring module 750 and the alarm module 760 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the target file determination module 710, the determination module 720, the generation module 730, the storage module 740, the monitoring module 750 and the alarm module 760 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the target file determination module 710, determination module 720, generation module 730, storage module 740, monitoring module 750 and alarm module 760 can be at least partially implemented as a computer program module, which can perform corresponding functions when executed.

[0168] Figure 9 A block diagram of an electronic device suitable for implementing a file protection method according to an embodiment of the present disclosure is schematically shown.

[0169] like Figure 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0170] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0171] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage portion 908 including a hard disk; and a communication portion 909 including a network interface card such as a LAN card or a modem. The communication portion 909 performs communication processing via a network such as the Internet. A drive 909 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 909 as needed, so that a computer program read therefrom can be installed into the storage portion 908 as needed.

[0172] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the file protection method according to the embodiments of the present disclosure.

[0173] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0174] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the file protection method provided by the embodiments of the present disclosure.

[0175] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 901 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0176] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0177] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0178] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0179] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0180] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0181] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A file protection method, characterized in that: The method comprises: Determine the target file based on a file update model, wherein the file update model is generated by self-learning based on system file update conditions; Determine a generation rule of the bait file based on the file size and file name of the target file; Generate a bait file corresponding to the target file according to the generation rule; Placing the bait file in a designated file path; Performing real-time monitoring on the bait file to record process information of accessing the bait file; and An alarm operation is performed based on the process information and the whitelist.

2. The method according to claim 1, characterized in that The generation rule of the bait file determined based on the file size and file name of the target file includes: Determining content generation rules for the decoy file based on the target file size; and The naming rule of the bait file is determined according to the target file name.

3. The method according to claim 2, characterized in that The content generation rule of the bait file determined according to the target file size includes: If it is determined that the target file size is greater than a second preset threshold, determining to use a sparse file to create a bait file; and If it is determined that the target file size is less than or equal to the second preset threshold, it is determined that the size and content of the bait file are consistent with the target file.

4. The method according to claim 2, characterized in that The naming rule of determining the bait file according to the target file name includes: If it is determined that a fixed naming rule exists for the target file name, determining a naming rule for the bait file based on the fixed naming rule; and If it is determined that there is no fixed naming rule for the target file name, a naming rule for the bait file is determined based on the target file name.

5. The method according to claim 4, characterized in that The fixed naming rules include naming by date and naming by number. The naming rules for the bait files determined based on the fixed naming rules include: If it is determined that the fixed naming rule is named according to date, the file name of the bait file is set to the earliest or latest date; and If it is determined that the fixed naming rule is to name according to the number, the file name of the bait file is set to the largest or smallest number.

6. The method according to claim 4, characterized in that The naming rule of determining the bait file based on the target file name includes: Add special characters before and after the target file name as the file name of the bait file.

7. The method according to claim 1, characterized in that Determining the target file based on the file update model includes: Obtaining system file data within a preset learning period, wherein the system file data includes file name, file type, folder path, file content, and update frequency; and The file whose update frequency is greater than a first preset threshold is determined as a target file.

8. The method according to any one of claims 1 to 7, characterized in that Before performing an alarm operation based on the process information and the whitelist, the method further includes: Collecting all process information accessing the decoy file within a preset learning period; and A whitelist is created based on the full process information.

9. The method according to claim 8, characterized in that The alarm operation according to the process information and the whitelist includes: Filtering the process information according to the whitelist to determine the illegal access process; and If it is determined that there is an illegal access process, an alarm message will be sent in the form of email or text message.

10. The method according to claim 9, characterized in that Also includes: The corresponding bait file is updated according to the update frequency of the target file.

11. A document protection device, characterized in that: The device comprises: A target file determination module is used to determine the target file based on a file update model, wherein the file update model is generated by self-learning based on system file update conditions; A determination module, configured to determine a generation rule of a decoy file based on the file size and file name of the target file; A generation module, configured to generate a decoy file corresponding to the target file according to the generation rules; A storage module, used for placing the bait file in a designated file path; A monitoring module, configured to monitor the bait file in real time to record process information of accessing the bait file; and The alarm module is used to perform an alarm operation based on the process information and the whitelist.

12. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images