An optimized operation method and system for a ransomware protection device

Abstract

The present invention relates to the field of ransomware protection technology, and specifically discloses an optimized operation method and system for a ransomware protection device, step one: simulate a ransomware attack scenario, obtain detection data and interception data of a protection device, analyze and process them, and output a protection effective value; wherein the detection data includes an effective detection ratio, and the interception data includes an effective interception ratio; step two: compare the protection effective value with the protection effective threshold to determine the protection effectiveness of the protection device; step three: based on a low signal of protection effectiveness, extract viruses that have not been successfully intercepted, analyze and process them, and output similar evaluation values ​​to known viruses; wherein the known viruses are ransomware viruses in a database. Thus, based on similar evaluation results, a network security team can formulate an optimized defense strategy more specifically, reduce blind defense against viruses and waste of resources, and thus optimize the operation of ransomware protection devices more effectively.

Description

Technical Field

[0001] The present invention relates to the technical field of ransomware protection, and in particular to an optimized operation method and system for a ransomware protection device. Background Art

[0002] Ransomware is a new type of computer virus that is extremely harmful. It spreads through computer vulnerabilities, email delivery, malicious Trojan programs, web backdoors, etc. Once infected, it will use various encryption algorithms to encrypt user files, making it impossible for users to use these files normally.

[0003] However, before optimizing the protection devices against ransomware, there is a lack of a comprehensive and systematic performance evaluation system to accurately measure the effectiveness of the protection devices. Relying solely on a single indicator is difficult to fully reflect the performance of the protection devices in actual applications, and cannot provide sufficient basis for subsequent optimization.

[0004] In view of this, we propose an optimized operation method and system for a ransomware protection device. Summary of the invention

[0005] The purpose of the present invention is to provide an optimized operation method and system for a ransomware protection device to solve the technical problems in the above background.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] In a first aspect, the present invention provides an optimized operation method of a ransomware protection device, which specifically comprises the following steps:

[0008] Step 1: Simulate a ransomware attack scenario, obtain the detection data and interception data of the protection device, analyze and process them, and output the effective protection value;

[0009] Among them, the detection data includes the effective detection ratio, and the interception data includes the effective interception ratio;

[0010] Step 2: Compare the protection effectiveness value with the protection effectiveness threshold to determine the protection effectiveness of the protection device;

[0011] Step 3: Based on the low protection effectiveness signal, extract the viruses that were not successfully intercepted, analyze and process them, and output similarity evaluation values ​​with known viruses;

[0012] Among them, the known virus is the ransomware virus in the database;

[0013] Step 4: Compare the similarity assessment value with the similarity assessment threshold to determine the similarity between the target virus and the known virus, and optimize the operation based on the similarity judgment result;

[0014] Step 5: Based on the low similarity signal, analyze the target virus, output the time offset coefficient, and determine the update timeliness;

[0015] Wherein, judging the update timeliness includes generating an update timeliness signal and an update untimeliness signal;

[0016] Step 6: Based on the signal of untimely update, optimize and adjust the update time of the virus database.

[0017] In a second aspect, the present invention provides an optimized operation system for a ransomware protection device, the system comprising: a data analysis and processing module: simulating a ransomware attack scenario, obtaining detection data and interception data of the protection device, and performing analysis and processing to output a protection effective value;

[0018] Among them, the detection data includes the effective detection ratio, and the interception data includes the effective interception ratio;

[0019] Effectiveness judgment module: compares the protection effectiveness value with the protection effectiveness threshold to judge the protection effectiveness of the protection device;

[0020] Similarity evaluation value acquisition module: Based on the low protection effectiveness signal, extract the viruses that have not been successfully intercepted, analyze and process them, and output the similarity evaluation values ​​with known viruses;

[0021] Among them, the known virus is the ransomware virus in the database;

[0022] Similarity judgment module: compares the similarity evaluation value with the similarity evaluation threshold to determine the similarity between the target virus and the known virus, and optimizes operations based on the similarity judgment results;

[0023] Timeliness judgment module: Based on the similarity low signal, analyze the target virus, output the time offset coefficient, and judge the update timeliness;

[0024] Wherein, judging the update timeliness includes generating an update timeliness signal and an update untimeliness signal;

[0025] Optimization and adjustment module: optimizes and adjusts the update time of the virus database based on the signal of untimely update;

[0026] Beneficial effects of the present invention:

[0027] (1) The present invention first simulates a ransomware attack scenario, obtains the number of simulated ransomware attacks and the number of ransomware detected by the protection device, and records the number of ransomware successfully intercepted by the protection device, analyzes and processes the above data, calculates an effective detection ratio and an effective interception ratio, calculates a protection effective value based on the obtained effective detection ratio and effective interception ratio, and compares the protection effective value with the protection effective threshold to identify and generate a protection effective signal or a protection invalid signal, so that the possible loopholes and weaknesses of the protection device can be discovered before the ransomware attack actually occurs through a simulated attack, which helps to take timely measures to repair and optimize, improve the effectiveness of the protection device, and reduce potential losses;

[0028] (2) The present invention extracts and processes known viruses and target viruses that were not successfully intercepted in simulated attacks, analyzes them, outputs similarity evaluation values ​​between the target virus and the known viruses, and takes corresponding optimization operation measures based on the comparison results between the similarity evaluation values ​​and the threshold values ​​to improve the effectiveness of the ransomware protection device, thereby being able to more accurately identify the similarity between the target virus and the known virus, which helps to timely discover and defend against virus variants or derivative versions. In addition, based on the similarity evaluation results, the virus database and detection algorithm are dynamically updated, so that the protection device can better adapt to the current security environment and improve the efficiency and accuracy of virus protection;

[0029] (3) The present invention comprehensively evaluates and optimizes the performance of protective devices by combining simulated attack scenario testing with virus behavior analysis, providing network security teams with a more accurate and efficient basis for formulating defense strategies, helping to reduce potential losses and risks;

[0030] (4) The present invention monitors newly added virus samples and makes similarity judgments with historical newly added virus samples to identify duplicate viruses, calculates the time offset coefficient to evaluate the timeliness of virus database updates, analyzes the standard deviation and distribution range of the time offset value when generating an update delay signal, determines the time offset mean, and adjusts the update interval of the virus database, thereby reducing duplicate updates and improving update efficiency. This can alleviate the lag caused by scheduled updates to the virus database to a certain extent, reduce the repeated entry of new viruses into the database due to update lags, and reduce resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The present invention will be further described below in conjunction with the accompanying drawings.

[0032] Figure 1 It is a flowchart of an optimized operation method of a ransomware protection device of the present invention;

[0033] Figure 2 It is a flow chart of an optimized operation system of a ransomware protection device of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example 1

[0035] See also Figure 1 As shown, the optimized operation method of a ransomware protection device according to an embodiment of the present invention specifically includes the following steps:

[0036] Step 1: Simulate a ransomware attack scenario, obtain the detection data and interception data of the protection device, analyze and process them, and output the effective protection value;

[0037] Among them, the detection data includes the effective detection ratio, and the interception data includes the effective interception ratio;

[0038] In some embodiments, a test environment including an attacking machine and a target machine is set up, the attacking machine is used to launch a simulated ransomware attack, and the target machine is equipped with a protection device;

[0039] Configure simulated attack scenarios based on the ransomware attack methods and characteristics, including but not limited to: exploiting specific vulnerabilities, transmitting malicious files, performing encryption operations, etc.;

[0040] Preset analysis period, wherein the analysis period is set by technicians in this field according to analysis requirements and experience;

[0041] For each analysis period, a simulated attack is performed on the attacking machine, and the number of simulated attack ransomware viruses is counted;

[0042] Record the number of ransomware viruses detected by the protection device during the simulated attack, and compare it with the number of ransomware viruses in the simulated attack to obtain the effective detection ratio;

[0043] Record the number of ransomware viruses successfully intercepted by the protection device, and compare it with the number of ransomware viruses detected by the protection device during the simulated attack process to obtain the effective interception ratio;

[0044] Substitute into the formula , the protection effective value FH is calculated, where JC represents the effective detection ratio, LJ represents the effective interception ratio, a1 and a2 are preset proportional coefficients, a1 is 2.56, and a2 is 2.44;

[0045] In this embodiment, for example, a test environment including an attacking machine and a target machine is built, where a ransomware protection device is installed on the target machine. We set an analysis period of 1 hour and configured the following simulated attack scenarios;

[0046] Scenario 1: Exploit a known vulnerability in the Windows system to attack, attempt to transfer malicious files and perform encryption operations, Scenario 2: Send attachments containing ransomware through phishing emails to trick users into clicking and executing;

[0047] In scenario 1, we set the attacker to send 1,000 ransomware samples within 1 hour. In scenario 2, we set the attacker to send 800 ransomware samples within 1 hour.

[0048] Therefore, the total number of simulated ransomware attacks is 1000 + 800 = 1800;

[0049] In scenario one, the protection device detected 950 ransomware samples, and in scenario two, the protection device detected 760 ransomware samples;

[0050] Therefore, the total number of ransomware detected by the protection device is 950 + 760 = 1710;

[0051] In scenario one, the protection device successfully blocked 900 ransomware samples, and in scenario two, the protection device successfully blocked 720 ransomware samples;

[0052] Therefore, the total number of ransomware viruses successfully blocked by the protection device is 900 + 720 = 1620;

[0053] Based on the protection effective value calculation formula, the protection effective value is calculated to be: 7.094;

[0054] Step 2: Compare the protection effectiveness value with the protection effectiveness threshold to determine the protection effectiveness of the protection device;

[0055] In some embodiments, a protection effective value is obtained, and the protection effective value is compared with a protection effective threshold, wherein the protection effective threshold is a critical value used to determine the effectiveness of the protection device against ransomware attacks during the analysis period, and is summarized and set by those skilled in the art based on historical experimental data;

[0056] If the protection effectiveness value is less than or equal to the protection effectiveness threshold, it means that the protection effectiveness of the protection device is low during the analysis period, and a low protection effectiveness signal is generated;

[0057] If the protection effectiveness value is greater than the protection effectiveness threshold, it means that the protection effectiveness of the protection device is high during the analysis period, and a high protection effectiveness signal is generated;

[0058] The technical solution of the embodiment of the present invention is mainly as follows: first, a ransomware attack scenario is simulated, the number of simulated attack ransomware and the number of ransomware detected by the protection device are obtained, and the number of ransomware successfully intercepted by the protection device is recorded, the above data is analyzed and processed, and an effective detection ratio and an effective interception ratio are calculated. The protection effective value is calculated based on the obtained effective detection ratio and effective interception ratio, and the protection effective value is compared with the protection effective threshold to identify and generate a protection effective signal or a protection invalid signal, so that the possible loopholes and weaknesses of the protection device can be discovered before the ransomware attack actually occurs through simulated attacks, which helps to take timely measures to repair and optimize, improve the effectiveness of the protection device, and reduce potential losses.

[0059] Embodiment 2:

[0060] Based on Example 1, please refer to Figure 1 As shown, the optimized operation method of a ransomware protection device according to an embodiment of the present invention further includes the following steps:

[0061] Step 3: Based on the low protection effectiveness signal, extract the viruses that were not successfully intercepted, analyze and process them, and output similarity evaluation values ​​with known viruses;

[0062] Among them, the known virus is the ransomware virus in the database;

[0063] In some embodiments, based on the low protection effectiveness signal, the ransomware virus intercepted and not detected in the simulated attack is extracted as the target virus;

[0064] Extract features of known viruses and target viruses. The extracted features include but are not limited to:

[0065] Attack type: such as attack frequency, attack duration, etc.; Code structure: virus code snippets, functions, variables, etc.; Behavior mode: the behavior of the virus after infecting the system, such as file operations, network communications, etc.; Propagation method: through which channels the virus is spread, such as emails, malicious websites, etc.;

[0066] Converting the extracted features into vector form can be achieved by encoding each feature as a numerical value or a set of numerical values, arranging all the selected features in a certain order to form a feature vector;

[0067] Exemplarily, the forms of feature encoding include but are not limited to: binary encoding: for some discrete features, such as whether there is a certain code snippet or behavior pattern, binary encoding (0 or 1) can be used to represent it; numerical encoding: for quantifiable features, such as attack frequency, attack duration, etc., numerical representation can be used directly; hash function: for string-type features, such as the hash value of a code snippet, a hash function can be used to convert it into a fixed-length numerical vector; feature weight: for some features, different weights can be assigned according to their importance to form a weighted feature vector;

[0068] According to the length of the feature vector (that is, the number of features), a multidimensional vector space is defined, each dimension corresponds to a feature, and the value of each dimension of the vector represents the value of the feature;

[0069] The feature vector of each virus sample is represented as a point in the vector space, that is, each virus sample can be uniquely identified by a feature vector;

[0070] Select a similarity calculation method according to the type and characteristics of the feature vector, wherein the similarity calculation method includes but is not limited to: cosine similarity, Euclidean distance, and Jaccard similarity;

[0071] For the feature vectors of the known virus and the target virus, the selected similarity calculation method is used for calculation, and the absolute value of the calculation result is the similarity evaluation value;

[0072] In this embodiment, the similarity evaluation value is calculated using the cosine similarity calculation method, and the specific process is as follows:

[0073] Feature vectors of known viruses: , the feature vector of the target virus: , where n is the number of eigenvectors, and are the values ​​of the i-th feature respectively;

[0074] The formula for calculating cosine similarity is: , where the dot product is calculated as: , the calculation formula of vector modulus is , ;

[0075] The calculated cosine similarity takes its absolute value, which is the similarity evaluation value;

[0076] Step 4: Compare the similarity evaluation value with the similarity evaluation threshold to determine the similarity between the target virus and the known virus;

[0077] In some embodiments, a similarity evaluation value is obtained, and the similarity evaluation value is compared with a similarity evaluation threshold, wherein the similarity evaluation threshold is set by a person skilled in the art based on a summary of multiple historical experimental data;

[0078] If the similarity evaluation value is less than the similarity evaluation threshold, it means that the known virus and the target virus are less similar, and a low similarity signal is generated;

[0079] Based on the low similarity signal, it indicates that the target virus has significant differences in transmission characteristics and infection patterns from known viruses, so it is marked as a new virus and the virus database and detection algorithm of the protection device are updated to enable it to accurately identify and defend against the target virus;

[0080] If the similarity evaluation value is greater than or equal to the similarity evaluation threshold, it means that the known virus and the target virus are highly similar, and a high similarity signal is generated;

[0081] When the similarity is high, it indicates that the target virus has a high similarity with the known virus in terms of propagation characteristics and infection mode. The target virus may be a variant or derivative version of the known virus. The rule base of the firewall, intrusion detection system (IDS) and intrusion prevention system (IPS) should be updated to ensure that new threats can be identified and blocked. The configuration of security policies, such as access control lists (ACLs) and security group rules, should be adjusted to better adapt to the current security environment.

[0082] The technical solution of the embodiment of the present invention is mainly as follows: extracting and processing known viruses and target viruses that were not successfully intercepted in simulated attacks, outputting similarity evaluation values ​​between the target virus and the known viruses through feature extraction, vector conversion and cosine similarity calculation, and taking corresponding optimization operation measures according to the comparison results between the similarity evaluation values ​​and the thresholds, such as updating the virus database, detection algorithm, firewall rule base, etc., to improve the effectiveness of the ransomware protection device, so that the similarity between the target virus and the known virus can be more accurately identified, which helps to timely discover and defend against virus variants or derivative versions, and dynamically update the virus database and detection algorithm according to the similarity evaluation results, so that the protection device can better adapt to the current security environment and improve the efficiency and accuracy of virus protection.

[0083] Embodiment 3

[0084] Based on Example 1 and Example 2, please refer to Figure 1As shown, since real-time update requires powerful data processing capabilities, so that new virus samples can be quickly analyzed, processed and stored after being received, we usually choose to update regularly, and there will be a certain lag in regular updates, so it may happen that the newly added viruses appearing in different analysis periods are the same, and then the virus database is repeatedly updated. The optimized operation method of the ransomware protection device described in the embodiment of the present invention specifically includes the following steps:

[0085] Step 5: Based on the low similarity signal, analyze the target virus, output the time offset coefficient, and determine the update timeliness;

[0086] Wherein, judging the update timeliness includes generating an update timeliness signal and an update untimeliness signal;

[0087] In some embodiments, based on the low similarity signal, newly added viruses are obtained;

[0088] The similarity between the newly added viruses and the newly added viruses in the historical analysis period is judged. The specific process is as follows: the similarity evaluation value between the newly added viruses and the historical newly added viruses is calculated. If the similarity evaluation value is 1, it means that the newly added viruses are the same as the historical newly added viruses, and the same newly added viruses are marked. If the similarity evaluation value is not 1, it means that the newly added viruses are different from the historical newly added viruses, and they are marked as different newly added viruses.

[0089] It should be noted that the calculation method of the similarity evaluation value between the newly added virus and the historically newly added virus is the same as that of step 3 in Example 2, and will not be described in detail here;

[0090] Based on the same marked new virus, its analysis time is obtained, and the same historical new virus and its analysis time are obtained;

[0091] It should be explained that the analysis time is the time for generating a low similarity signal in step 4 of embodiment 2;

[0092] Get the update interval of the scheduled update of the current virus data database;

[0093] The analysis time of the same newly added virus is calculated by difference with the analysis time of the historical newly added virus to obtain a time deviation value, and the time deviation value is processed by ratio with the update interval time to obtain a time deviation coefficient;

[0094] Compare the time offset factor with 1;

[0095] If the time offset coefficient is less than or equal to 1, it means that the time deviation value is less than or equal to the update interval time, and an update timely signal is generated;

[0096] Based on the timely update signal, analyze other related reasons, including but not limited to: insufficient storage space for the virus database;

[0097] If the time offset coefficient is greater than 1, it means that the time deviation value is greater than the update interval, and an update delay signal is generated;

[0098] It should be noted that the update is not timely in this step, which is just a comparison of the time deviation value with the update interval duration, in order to analyze the relative time of the time deviation value and the update interval duration;

[0099] Step 6: Based on the signal of untimely update, optimize and adjust the update time of the virus database;

[0100] In some embodiments, based on the update delay signal, a time deviation value corresponding to the generation of the update delay signal is obtained, all time deviation values ​​are substituted into the standard deviation formula to calculate the standard deviation value, and the standard deviation value is compared with the standard deviation threshold value, wherein the standard deviation threshold value is summarized and set by a person skilled in the art based on experience and multiple historical simulation data;

[0101] If the standard deviation value is less than or equal to the standard deviation threshold, it means that the acquired time deviation value array is relatively stable. All time deviation values ​​are summed and averaged to obtain the time deviation mean. The update interval of the virus database can be adjusted to the time deviation mean.

[0102] If the standard deviation value is greater than the standard deviation threshold, it means that the acquired time deviation value array is unstable, and the maximum value ZD and the minimum value ZX in the time deviation value are extracted, that is, the value range of the time deviation value data is ZX to ZD;

[0103] The value range [ZX, ZD] is divided into several numerical intervals, wherein the numerical intervals are summarized and set by those skilled in the art based on actual conditions and experience;

[0104] Obtain the number of time deviation values ​​in each numerical interval, extract the numerical interval with the maximum number of time deviation values, sum and average the time deviation values ​​in the numerical interval to obtain the time deviation mean, and adjust the update interval of the virus database to the time deviation mean;

[0105] It should be noted that if there are multiple numerical intervals with the maximum number of time deviation values, all time deviation values ​​in these numerical intervals are summed and averaged;

[0106] It should be noted that when the obtained time deviation mean is less than the update interval time limit, it is adjusted to the update interval time limit, and then other related reasons are analyzed, wherein the update interval time limit is summarized and set by those skilled in the art based on other influences such as system resources, processing capabilities and network conditions;

[0107] The technical solution of the embodiment of the present invention is mainly as follows: by monitoring newly added virus samples and making similarity judgments with historically newly added virus samples to identify duplicate viruses, the time offset coefficient is calculated to evaluate the timeliness of virus database updates, and when an update delay signal is generated, the standard deviation and distribution interval of the time offset value are analyzed to determine the mean of the time offset, and the update interval of the virus database is adjusted, thereby reducing duplicate updates and improving update efficiency, thereby alleviating the lag caused by scheduled updates to the virus database to a certain extent, reducing the repeated storage of new viruses caused by update lags, and reducing resource consumption.

[0108] Embodiment 4:

[0109] Based on Example 1, Example 2 and Example 3, please refer to Figure 2 As shown, an optimized operation system of a ransomware protection device according to an embodiment of the present invention includes:

[0110] Data analysis and processing module: simulates ransomware attack scenarios, obtains detection data and interception data of protection devices, performs analysis and processing, and outputs protection effective values;

[0111] Effectiveness judgment module: compares the protection effectiveness value with the protection effectiveness threshold to judge the protection effectiveness of the protection device;

[0112] Similarity evaluation value acquisition module: Based on the low protection effectiveness signal, extract the viruses that have not been successfully intercepted, analyze and process them, and output the similarity evaluation values ​​with known viruses;

[0113] Similarity judgment module: compares the similarity evaluation value with the similarity evaluation threshold to determine the similarity between the target virus and the known virus, and optimizes operations based on the similarity judgment results;

[0114] Timeliness judgment module: Based on the similarity low signal, analyze the target virus, output the time offset coefficient, and judge the update timeliness;

[0115] Wherein, judging the update timeliness includes generating an update timeliness signal and an update untimeliness signal;

[0116] Optimization and adjustment module: optimizes and adjusts the update time of the virus database based on the signal of untimely update.

[0117] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A method for optimizing the operation of a ransomware protection device, characterized in that: The specific steps include: Step 1: Simulate a ransomware attack scenario, obtain the detection data and interception data of the protection device, analyze and process them, and output the effective protection value; Among them, the detection data includes the effective detection ratio, and the interception data includes the effective interception ratio; Build a test environment that includes an attacking machine and a target machine. The attacking machine is used to launch a simulated ransomware attack, while the target machine is equipped with a protection device and configured with a simulated attack scenario. Preset the analysis period, perform simulated attacks on the attacking machine for each analysis period, and count the number of simulated attack ransomware viruses; Record the number of ransomware viruses detected by the protection device during the simulated attack, and compare it with the number of ransomware viruses in the simulated attack to obtain the effective detection ratio; Record the number of ransomware viruses successfully intercepted by the protection device, and compare it with the number of ransomware viruses detected by the protection device during the simulated attack process to obtain the effective interception ratio; Obtain effective detection ratio and effective interception ratio; Substitute into the formula , the protection effective value FH is calculated, where JC represents the effective detection ratio, LJ represents the effective interception ratio, and a1 and a2 are preset proportional coefficients; Step 2: Compare the protection effectiveness value with the protection effectiveness threshold to determine the protection effectiveness of the protection device and generate a low protection effectiveness signal; Step 3: Based on the low protection effectiveness signal, extract the target viruses that were not successfully intercepted, analyze and process them, and output similarity evaluation values ​​with known viruses; Among them, the known virus is the ransomware virus in the database; Step 4: Compare the similarity assessment value with the similarity assessment threshold to determine the similarity between the target virus and the known virus, and optimize the operation based on the similarity judgment result; The similarity judgment result includes generating a low similarity signal or generating a high similarity signal; Among them, based on the low signal of protection effectiveness, the ransomware virus that was intercepted and not detected in the simulated attack was extracted as the target virus; Step 5: Based on the low similarity signal, analyze the target virus, output the time offset coefficient, and determine the update timeliness; Wherein, judging the update timeliness includes generating an update timeliness signal and an update untimeliness signal; Based on the low similarity signals, new viruses are obtained; The similarity between the newly added viruses and the newly added viruses in the historical analysis period is judged. The specific process is as follows: the similarity evaluation value between the newly added viruses and the historical newly added viruses is calculated. If the similarity evaluation value is 1, it means that the newly added viruses are the same as the historical newly added viruses, and the same newly added viruses are marked. If the similarity evaluation value is not 1, it means that the newly added viruses are different from the historical newly added viruses, and they are marked as different newly added viruses. Based on the same marked new virus, its analysis time is obtained, and the same historical new virus and its analysis time are obtained; Get the update interval of the scheduled update of the current virus database; The analysis time of the same newly added virus is calculated by difference with the analysis time of the historical newly added virus to obtain a time deviation value, and the time deviation value is processed by ratio with the update interval time to obtain a time deviation coefficient; Step 6: Based on the signal of untimely update, optimize and adjust the update time of the virus database.

2. The method for optimizing the operation of a ransomware protection device according to claim 1, characterized in that: The process of generating a low protection effectiveness signal is: Obtaining a protection effective value, and comparing the protection effective value with a protection effective threshold; If the protection effectiveness value is less than or equal to the protection effectiveness threshold, a low protection effectiveness signal is generated.

3. The method for optimizing the operation of a ransomware protection device according to claim 1, characterized in that: The process of obtaining the similarity evaluation value is as follows: Extract features of known viruses and target viruses, and convert the extracted features into vector form; According to the length of the feature vector, a multidimensional vector space is defined, each dimension corresponds to a feature, and the value of each dimension of the vector represents the value of the feature; The feature vector of each virus sample is represented as a point in the vector space, that is, each virus sample is uniquely identified by a feature vector; The similarity evaluation value is calculated using the cosine similarity calculation method. The specific process is as follows: Feature vectors of known viruses: , the feature vector of the target virus: , where n is the number of eigenvectors, and are the values ​​of the i-th feature respectively; The formula for calculating cosine similarity is: , where the dot product is calculated as: , the calculation formula of vector modulus is , ; The calculated cosine similarity takes its absolute value, which is the similarity evaluation value.

4. The method for optimizing the operation of a ransomware protection device according to claim 1, characterized in that: The specific process of step 4 is as follows: Obtaining a similarity evaluation value, and comparing the similarity evaluation value with a similarity evaluation threshold; If the similarity evaluation value is less than the similarity evaluation threshold, a low similarity signal is generated; Based on the low similarity signal, the target virus corresponding to the low similarity signal is extracted and marked as a new virus, and the virus database and detection algorithm of the protection device are updated so that it can accurately identify and defend against the target virus; If the similarity evaluation value is greater than or equal to the similarity evaluation threshold, a high similarity signal is generated; Based on high similarity signals, update the rule base of firewalls, intrusion detection systems, and intrusion prevention systems to ensure that new threats can be identified and blocked, and adjust the configuration of security policies.

5. The method for optimizing the operation of a ransomware protection device according to claim 1, characterized in that: The process of determining the timeliness of updates is as follows: Get the time offset coefficient and compare the time offset coefficient with 1; If the time offset coefficient is less than or equal to 1, an update timely signal is generated; If the time offset coefficient is greater than 1, an update delay signal is generated.

6. The method for optimizing the operation of a ransomware protection device according to claim 1, characterized in that: The specific process of step six is ​​as follows: Based on the update delay signal, a time deviation value corresponding to the generation of the update delay signal is obtained, all time deviation values ​​are substituted into the standard deviation formula to calculate the standard deviation value, and the standard deviation value is compared with the standard deviation threshold; If the standard deviation value is less than or equal to the standard deviation threshold, the obtained time deviation value array is stable, all time deviation values ​​are summed and averaged to obtain the time deviation mean, and the update interval of the virus database is adjusted to the time deviation mean; If the standard deviation value is greater than the standard deviation threshold, the acquired time deviation value array is unstable, and the maximum value ZD and the minimum value ZX in the time deviation value are extracted, that is, the value range of the time deviation value data is ZX to ZD; In the value range [ZX, ZD], it is divided into several value intervals; Obtain the number of time deviation values ​​in each numerical interval, extract the numerical interval with the maximum number of time deviation values, sum and average the time deviation values ​​in the numerical interval to obtain the time deviation mean, and adjust the update interval of the virus database to the time deviation mean.

7. An optimized operation system for a ransomware protection device, characterized in that: The system is used to execute the method described in any one of claims 1 to 6, and the system comprises: Data analysis and processing module: simulates ransomware attack scenarios, obtains detection data and interception data of protection devices, performs analysis and processing, and outputs protection effective values; Among them, the detection data includes the effective detection ratio, and the interception data includes the effective interception ratio; Build a test environment that includes an attacking machine and a target machine. The attacking machine is used to launch a simulated ransomware attack, while the target machine is equipped with a protection device and configured with a simulated attack scenario. Preset the analysis period, perform simulated attacks on the attacking machine for each analysis period, and count the number of simulated attack ransomware viruses; Record the number of ransomware viruses detected by the protection device during the simulated attack, and compare it with the number of ransomware viruses in the simulated attack to obtain the effective detection ratio; Record the number of ransomware viruses successfully intercepted by the protection device, and compare it with the number of ransomware viruses detected by the protection device during the simulated attack process to obtain the effective interception ratio; Obtain effective detection ratio and effective interception ratio; Substitute into the formula , the protection effective value FH is calculated, where JC represents the effective detection ratio, LJ represents the effective interception ratio, and a1 and a2 are preset proportional coefficients; Effectiveness judgment module: compares the protection effectiveness value with the protection effectiveness threshold to judge the protection effectiveness of the protection device; Similarity evaluation value acquisition module: Based on the low protection effectiveness signal, extract the target virus that was not successfully intercepted, analyze and process it, and output the similarity evaluation value with the known virus; Among them, the known virus is the ransomware virus in the database; Similarity judgment module: compares the similarity evaluation value with the similarity evaluation threshold to determine the similarity between the target virus and the known virus, and optimizes operations based on the similarity judgment results; The similarity judgment result includes generating a low similarity signal or generating a high similarity signal; Among them, based on the low signal of protection effectiveness, the ransomware virus that was intercepted and not detected in the simulated attack was extracted as the target virus; Timeliness judgment module: Based on the similarity low signal, analyze the target virus, output the time offset coefficient, and judge the update timeliness; Wherein, judging the update timeliness includes generating an update timeliness signal and an update untimeliness signal; Based on the low similarity signals, new viruses are obtained; The similarity between the newly added viruses and the newly added viruses in the historical analysis period is judged. The specific process is as follows: the similarity evaluation value between the newly added viruses and the historical newly added viruses is calculated. If the similarity evaluation value is 1, it means that the newly added viruses are the same as the historical newly added viruses, and the same newly added viruses are marked. If the similarity evaluation value is not 1, it means that the newly added viruses are different from the historical newly added viruses, and they are marked as different newly added viruses. Based on the same marked new virus, its analysis time is obtained, and the same historical new virus and its analysis time are obtained; Get the update interval of the scheduled update of the current virus database; The analysis time of the same newly added virus is calculated by difference with the analysis time of the historical newly added virus to obtain a time deviation value, and the time deviation value is processed by ratio with the update interval time to obtain a time deviation coefficient; Optimization and adjustment module: optimizes and adjusts the update time of the virus database based on the signal of untimely update.

Images