Ransomware detection method, device and equipment and storage medium

Abstract

The invention provides a ransomware detection method, device and equipment and a storage medium, relates to the technical field of security, and aims to solve the problem that ransomware bypasses detection of antivirus software and bait files and causes major threats to computer security. The method comprises the following steps: in a current time window and a plurality of historical time windows, identifying file suffixes with the maximum creation number; according to the number of the file suffixes with the maximum creation number in the current time window and a plurality of historical time windows, analyzing the change conditions of different file suffixes along with the time windows; and according to an analysis result, identifying an abnormal file suffix.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of security technology, and in particular to a ransomware detection method, device, equipment and storage medium. Background Art

[0002] Ransomware is a type of malware that extorts ransom by encrypting files. During the encryption process, various files such as .txt and .doc are encrypted into suffixes that can represent viruses (such as .wanncry), which will pose a major threat to computer security. In terms of protection against ransomware, there are two main types of protection measures: active protection of antivirus software and trapping technology. However, with the continuous upgrading and evolution of ransomware, the risk of antivirus software and bait being bypassed is also increasing. Once the antivirus software and bait are bypassed, the ransomware will attack the system unscrupulously, posing a greater threat to computer security. Summary of the invention

[0003] The embodiments of the present application provide a ransomware detection method, apparatus, device and storage medium, aiming to solve the problem of ransomware bypassing the detection of antivirus software and bait files.

[0004] A first aspect of an embodiment of the present application provides a ransomware virus detection method, comprising: Identify the file suffix with the largest number of creations within the current time window and within multiple historical time windows; According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed; Based on the analysis results, abnormal file suffixes are identified.

[0005] In an optional implementation, the identifying of the file suffix with the largest number of creations in the current time window and in multiple historical time windows includes: Identify the file suffixes of all newly created files in the current time window and multiple historical time windows; In the current time window and multiple historical time windows, filter out the file suffixes belonging to the whitelist from the file suffixes of all newly created files; In a current time window and in a plurality of historical time windows, a file suffix having a maximum number of creations is identified from the filtered file suffixes.

[0006] In an optional embodiment, the method further includes: Adding other file suffixes except the file suffix with the largest number of creations within the current time window to the whitelist; When the file suffix with the largest number of creations in the current time window is a normal file suffix, a confirmation request is output to request the user to confirm whether to add the file suffix with the largest number of creations in the current time window to the whitelist.

[0007] In an optional implementation, after identifying the abnormal file suffix, the method includes: In the case where the pre-configured handling action is to kill the thread, query and kill the target process and related processes according to the pre-created process tree, wherein the related processes include the parent process, child process and sibling process of the target process, and the target process is the process that creates the new file corresponding to the abnormal file suffix; When the pre-configured handling action is recording, an alarm log for the target process is recorded.

[0008] In an optional embodiment, the method further includes: In a plurality of consecutive current time windows, it is identified that the file suffixes with the largest number of creations from the filtered file suffixes are all first suffixes, and in a case where the first suffixes are all normal file suffixes in a plurality of consecutive current time windows, the first suffix is ​​determined to be an abnormal file suffix.

[0009] In an optional embodiment, the method further includes: In the case where multiple file suffixes in the current time window all have the maximum creation quantity, adding the file suffixes of all newly created files in the current time window to the whitelist; According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed, including: When there is a unique file suffix with the maximum creation number in the current time window and multiple historical event windows, the changes of different file suffixes with time windows are analyzed according to the number of file suffixes with the maximum creation number in the current time window and multiple historical time windows.

[0010] In an optional implementation, analyzing the changes of different file suffixes over time windows according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows includes: Calculate the average value based on the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows; Calculate the standard deviation according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, and the mean; Calculate a standard score according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, as well as the mean and the standard deviation; In a case where the standard score is greater than or equal to the target threshold, determining the file suffix with the largest number of creations in the current time window as an abnormal file suffix; When the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffix with the largest number of creations in the multiple historical time windows is deleted from the cache.

[0011] A second aspect of an embodiment of the present application provides a ransomware detection device, including: An acquisition module, for identifying a file suffix having a maximum number of creations in a current time window and in a plurality of historical time windows; An analysis module, for analyzing changes in different file suffixes over time windows according to the number of file suffixes with the largest number of creations in a current time window and in multiple historical time windows; The identification module is used to identify abnormal file suffixes based on the analysis results.

[0012] A third aspect of an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the ransomware detection method of the first aspect of the embodiment of the present application when executing the computer program.

[0013] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the ransomware detection method of the first aspect of the embodiment of the present application is implemented.

[0014] In this embodiment, the file suffix with the largest number of creations is identified in the current time window and multiple historical time windows; the changes of different file suffixes with the time window are analyzed according to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows; and abnormal file suffixes are identified according to the analysis results. Abnormal file suffixes can be effectively identified to defend against the upgrade or targeted attack of ransomware and prevent ransomware from bypassing traditional antivirus software or detection mechanisms based on bait files. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0016] Figure 1 This is a flowchart of the steps of a ransomware detection method proposed in an embodiment of the present application; Figure 2 This is a manual whitelist adding flowchart of the ransomware virus detection method proposed in one embodiment of the present application; Figure 3 This is a file funnel determination flow chart of a ransomware virus detection method proposed in an embodiment of the present application; Figure 4 It is a process tree flow chart of a ransomware virus detection method proposed in an embodiment of the present application; Figure 5 It is a flow chart of the detection steps of the ransomware virus detection method proposed in one embodiment of the present application; Figure 6 It is a structural diagram of a ransomware virus detection system proposed in an embodiment of the present application; Figure 7 It is a schematic diagram of an electronic device proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] Ransomware, a major threat to computer security, is increasingly gaining influence, and attacks on individual users have gradually shifted to large institutions and organizations such as governments and enterprises. Industries such as medical care, education, finance, and government have become important targets of attacks. Faced with this threat, protection measures against ransomware are also gaining increasing attention.

[0019] There are two main types of protection measures for ransomware. The first is active protection by antivirus software, which aims to detect and process ransomware in the shortest possible time after it enters the system. However, the drawback of this protection measure is that it relies heavily on the virus library. The second is trapping technology, which uses bait files to trap ransomware and process it. The design concept of trapping technology is not complicated, that is, to place baits, capture events where the baits are operated, and process them. However, whether the bait files can effectively identify viruses in the system or whether they are just normal operations (whether human operations or business system operations) is a challenge. If a normal business program is trapped and killed, it will be a bad experience for the user, and may even affect the normal operation of the business system, causing unnecessary losses.

[0020] As ransomware continues to upgrade and evolve, the risk of antivirus software and bait being bypassed is also increasing. Once antivirus software and bait are bypassed, ransomware will attack the system unscrupulously, posing a greater threat to computer security. Therefore, we need to continuously improve our ability to protect against ransomware to protect our computer systems and data security.

[0021] In the related technologies for protection against ransomware, the deployment location and number of bait files are key factors in determining whether the ransomware can be successfully captured and when to capture it. This also means that there is a risk that the bait file will be bypassed or captured too late (that is, after most key files have been encrypted). When implementing the bait file trapping technology, any operation on the bait file needs to be intercepted. Therefore, the bait file placed may have an adverse effect on normal business processes. The bait file needs to monitor multiple hook points such as file creation, reading and writing, deletion, and renaming. For the system, file operations are a very frequent action, so every system call of the file operation is monitored and judged by the process ransomware, which may affect the performance of the system to a certain extent.

[0022] File funneling is a thread that occurs when a ransomware encrypts files. It is a phenomenon in which a large number of files with various suffixes suddenly become files with a unified suffix. In a short period of time, a large number of files with the same specific suffix suddenly appear in the system. These files quickly dominate, causing the system file structure to show a funnel-like concentration trend. As time goes by, the types of file suffixes in the system gradually decrease, until almost only the specific suffixes uniformly assigned by the ransomware after encryption remain, such as the common ".wanncry", which significantly exposes the ransomware's intrusion behavior.

[0023] This paper proposes a ransomware detection method based on the detection of file funneling phenomenon. The method determines whether the ransomware is running by analyzing the sharp decrease in the types of file suffixes in the system, especially when multiple suffix files are encrypted and only the ransomware-specific suffix (such as .wanncry) remains. The file funneling phenomenon is a significant sign of ransomware activity, and its occurrence cannot be avoided by ransomware, that is, it cannot be bypassed by technical means. Therefore, by real-time monitoring of the file funneling phenomenon, we can effectively defend against ransomware upgrades or targeted attacks, prevent it from bypassing traditional antivirus software or detection mechanisms based on bait files; avoid the normal business process being affected by interception operations such as bait files; and avoid the performance of the system being affected by adding monitoring and ransomware judgment logic in too many system calls.

[0024] Reference Figure 1 , Figure 1 This is a flowchart of the steps of the ransomware virus detection method proposed in an embodiment of the present application, including the following steps S11 to S13: Step S11: in the current time window and in multiple historical time windows, identify the file suffix with the largest number of creations.

[0025] To monitor file creation, you can use scripts or tools to scan files in a specified directory (or the entire file system) and collect information such as the file creation time, name, and path. Extract the file suffix (extension) from the collected file names, such as extracting .txt from example.txt. You can perform sliding statistics in a time window of 5 seconds, count all files created within these 5 seconds by suffix to get a list of {suffix name, total number}, and find the file suffix with the largest number of creations in this time window. For the current time window and multiple historical event windows (such as the past 9 time windows), identify the file suffix with the largest number of creations in each time window.

[0026] Furthermore, the file suffix with the largest number of creations is identified in the current time window and multiple historical time windows, including Identify the file suffixes of all newly created files in the current time window and multiple historical time windows; In the current time window and multiple historical time windows, filter out the file suffixes belonging to the whitelist from the file suffixes of all newly created files; In a current time window and in a plurality of historical time windows, a file suffix having a maximum number of creations is identified from the filtered file suffixes.

[0027] Whitelist refers to a security mechanism that ensures that only programs, files, or operations that are explicitly allowed or trusted can be executed or accessed. Whitelist filtering mechanism, this process covers built-in whitelist and manually added whitelist. The built-in whitelist can pre-set 177 common system file suffixes, designed to automatically identify and process. If a file suffix is ​​on the whitelist, the system will automatically clear the statistics related to the suffix. Figure 2 As shown, manually add a whitelist. First, when a certain suffix is ​​determined to be a normal file suffix (determined to be on the whitelist), save and update it to the user-state whitelist database, and update the whitelist information in the kernel at the same time to ensure synchronous updates at the system level, and delete the related data of the added suffix in the kernel cache statistics.

[0028] Identify the file suffixes of all newly created files in the current time window and multiple historical time windows. Through the whitelist filtering mechanism, filter out the file suffixes that belong to the whitelist from the file suffixes of all newly created files. Among them, if all file suffix data in the current event window are filtered out, the analysis process will automatically terminate and transfer to the next time window for statistical analysis. In the current time window and multiple historical time windows, identify the file suffix with the largest number of creations from the filtered file suffixes. Filtering out file suffixes that belong to the whitelist helps reduce the false alarm rate, improve analysis efficiency, and provide more powerful support for the management and maintenance of the file system.

[0029] Furthermore, the method further comprises: Adding other file suffixes except the file suffix with the largest number of creations within the current time window to the whitelist; When the file suffix with the largest number of creations in the current time window is a normal file suffix, a confirmation request is output to request the user to confirm whether to add the file suffix with the largest number of creations in the current time window to the whitelist.

[0030] Automatically add file suffixes that are not frequently created within the current time window, that is, other file suffixes except the file suffix with the largest number of creations, to the whitelist. By automatically adding suffixes that are not frequently created to the whitelist, repeated analysis and judgment of these suffixes can be reduced, thereby saving computing resources and improving overall recognition efficiency.

[0031] If the file suffix with the largest number of creations in the current time window is judged to be a normal file suffix (not a ransomware virus), a confirmation request is output and reported to the user state, and the user determines whether the file suffix is ​​added to the whitelist. By reporting to the user state, the user confirms whether it is on the whitelist based on the actual situation, which can greatly reduce the false alarm rate while retaining sensitivity to potential unknown threats.

[0032] Step S12: Analyze the changes of different file suffixes with time windows according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows.

[0033] According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the Z-score (standard score) of the file suffix with the largest number of creations in each time window is calculated, so as to analyze the changes of different file suffixes over the time window to determine whether they belong to the file funnel phenomenon, and further confirm whether there is a ransomware threat. By performing Z-score analysis on the suffix with the highest creation frequency to determine whether it is a ransomware virus, that is, real-time monitoring of the file funnel phenomenon, it can effectively defend against the upgrade or targeted attack of the ransomware virus and prevent it from bypassing traditional antivirus software or detection mechanisms based on bait files.

[0034] Furthermore, the method further comprises: In the case where multiple file suffixes in the current time window all have the maximum creation quantity, adding the file suffixes of all newly created files in the current time window to the whitelist; According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed, including: When there is a unique file suffix with the maximum creation number in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed based on the number of file suffixes with the maximum creation number in the current time window and multiple historical time windows.

[0035] If multiple file suffixes have the maximum number of creations in the current time window, that is, there are multiple suffixes that have the maximum number of new file records in parallel, then the file suffixes of all new files in the current time window are added to the whitelist, pending re-evaluation in the next time window. While waiting for the next time window, the system remains silent and prepares for a new round of statistical analysis. If there is a unique file suffix with the maximum number of creations in the current time window and multiple historical time windows, then the changes in different file suffixes over time windows are analyzed based on the number of file suffixes with the maximum number of creations in the current time window and multiple historical time windows. Analyzing the unique file suffix with the maximum number of creations helps to implement ransomware detection based on the file funnel phenomenon to protect data security.

[0036] Furthermore, the analysis of changes in different file suffixes over time windows according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows includes: Calculate the average value based on the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows; Calculate the standard deviation according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, and the mean; Calculate a standard score according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, as well as the mean and the standard deviation; In a case where the standard score is greater than or equal to the target threshold, determining the file suffix with the largest number of creations in the current time window as an abnormal file suffix; When the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffix with the largest number of creations in the multiple historical time windows is deleted from the cache.

[0037] Reference Figure 3 , the mean, standard deviation and standard score can be calculated based on the data of the number of file suffixes with the maximum number of creation in the current time window and multiple historical event windows (such as the past 9 time windows), totaling 10 windows, and the abnormal file suffixes can be judged based on the standard score.

[0038] The mean of the file suffix with the largest number of creations in the current time window is calculated according to the following formula (1): (1) in, represents the mean of the file suffix with the largest number of creations in the current time window, and x represents the number of file suffixes with the largest number of creations in each time window.

[0039] The standard deviation of the file suffix with the largest number of creations in the current time window is calculated according to the following formula (2): (2) in, Indicates the standard deviation of the file suffix with the largest number of creations in the current time window. represents the mean of the file suffix with the largest number of creations in the current time window, and x represents the number of file suffixes with the largest number of creations in each time window.

[0040] The standard score (Z-score value) of the file suffix with the largest number of creations in the current time window is calculated according to the following formula (3): (3) Where Z represents the standard fraction of file suffixes with the largest number of creations in the current time window, Indicates the standard deviation of the file suffix with the largest number of creations in the current time window. represents the mean of the file suffix with the largest number of creations in the current time window, and x represents the number of file suffixes with the largest number of creations in the current time window.

[0041] The standard score Z is used to determine whether there are abnormal file suffixes. In the application of Z-score, 2 or 3 are often used as thresholds. According to the requirement of a higher degree of deviation of the newly added numbers, 3 can be selected as the target threshold. If the standard score is greater than or equal to the target threshold, the file suffix with the largest number of creations in the current time window is judged to be an abnormal file suffix, and the suffix belongs to the file suffix of the ransomware. If the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is judged to be a normal file suffix, and the suffix does not belong to the file suffix of the ransomware. The file suffix with the largest number of creations in multiple historical time windows (determined to be a normal file suffix) can be deleted from the cache to maintain the timeliness and accuracy of the cache.

[0042] By performing Z-score analysis on the data of the current window and multiple time history windows, we can find a sudden and substantial increase in file suffixes, that is, an uncommon (non-whitelisted) suffix that suddenly begins to be created on a large scale on the system. In this case, the file suffix is ​​identified as a ransomware suffix, and the thread can be killed or only recorded according to the strategy. By monitoring the file funnel phenomenon, we can effectively avoid the ransomware from bypassing antivirus software and bait files, and improve the accuracy of detection. Ransomware is inevitably accompanied by file funneling during the encryption process, which cannot be circumvented by ransomware.

[0043] Furthermore, the method further comprises: In a plurality of consecutive current time windows, it is identified that the file suffixes with the largest number of creations from the filtered file suffixes are all first suffixes, and in a case where the first suffixes are all normal file suffixes in a plurality of consecutive current time windows, the first suffix is ​​determined to be an abnormal file suffix.

[0044] It can be identified that the file suffix with the largest number of creations from the filtered file suffixes in three consecutive current time windows is the first suffix, which is consistent, and the first suffix is ​​a normal file suffix. In this case, the first suffix is ​​determined to be an abnormal file suffix. In other words, in three consecutive current time windows, no abnormal file suffix has been identified, that is, the ransomware virus has not been identified. However, in these three current time windows, the file suffix with the highest frequency remains consistent, so it can be determined that the suffix is ​​the suffix of the ransomware virus. Indirectly identifying potential ransomware activities through additional judgments can improve detection accuracy.

[0045] Step S13: According to the analysis result, identify abnormal file suffixes.

[0046] According to the analysis results, the abnormal file suffixes are identified. The file suffixes with the largest number of unique creations can be analyzed to obtain a standard score for identification. If the standard score is greater than or equal to the target threshold, the file suffix with the largest number of unique creations in the current time window is identified as an abnormal file suffix.

[0047] Further, after identifying the abnormal file suffix, the method includes: In the case where the pre-configured handling action is to kill the thread, query and kill the target process and related processes according to the pre-created process tree, wherein the related processes include the parent process, child process and sibling process of the target process, and the target process is the process that creates the new file corresponding to the abnormal file suffix; When the pre-configured handling action is recording, an alarm log for the target process is recorded.

[0048] Reference Figure 4 , by scanning the / proc directory to initialize the process tree. This directory contains detailed information about each currently running process, where each process has its own directory, and the directory is named directly using the process's PID (process identifier). By carefully traversing this directory structure, the system can accurately locate all active processes and build a clear and intuitive process tree based on the parent-child relationship between them. During program execution, the kernel is responsible for monitoring and managing life cycle events such as process creation and deletion, and dynamically updating the process tree structure based on these events. Specifically, the kernel includes newly created processes, including processes generated by cloning operations, and removes terminated processes from the process tree. When a process needs to be terminated (killed), the user or the system can locate and select the corresponding process by querying the process tree.

[0049] After identifying the abnormal file suffix, it can be processed through the pre-configured disposal action. The pre-configured disposal actions include at least: killing the thread and recording. If the pre-configured disposal action is to kill the thread, the target process and related processes are queried and killed according to the pre-created process tree, and logs can be recorded. The target process is the process that creates the new file corresponding to the abnormal file suffix, and the related processes include the parent process, child process and sibling process of the target process. If the pre-configured disposal action is to record, only the alarm log for the target process is recorded. By setting different disposal actions to deal with potential ransomware activities in a timely manner, the risk of data being encrypted and ransomed can be significantly reduced, the important information assets of enterprises and individuals can be protected, and the continuous and stable operation of the system can be ensured.

[0050] In this embodiment, the file suffix with the largest number of creations is identified in the current time window and multiple historical time windows; the changes of different file suffixes with the time window are analyzed according to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows; and abnormal file suffixes are identified according to the analysis results. Abnormal file suffixes can be effectively identified to defend against the upgrade or targeted attack of ransomware, which can prevent ransomware from bypassing traditional antivirus software or detection mechanisms based on bait files, and can also prevent interception operations such as bait files from affecting the normal business process and adding monitoring and ransomware judgment logic in too many system calls to affect system performance.

[0051] Reference Figure 5 , Figure 5 1 is a flow chart of the detection steps of the ransomware detection method proposed in one embodiment of the present application. Figure 5 As shown in the figure, the detection process is as follows: Count the file suffixes of all newly created files in the time window; filter out the file suffixes that belong to the whitelist; determine whether the remaining file suffixes are empty; if the remaining file suffixes are empty, end the statistical analysis of the current time window; if the remaining file suffixes are not empty, further determine whether there are multiple file suffixes with the largest number of creations; if there are multiple file suffixes with the largest number of creations, end the statistical analysis of the current time window; if there are not multiple file suffixes with the largest number of creations, perform a file funnel judgment on the only file suffix with the largest number of creations; if the file funnel judgment does not identify any abnormal file suffixes, end the statistical analysis of the current time window; if the file funnel judgment identifies any abnormal file suffixes, choose whether to kill the process (kill); if you choose to kill the process, execute the operation of killing the process and then report the log; if you do not choose to kill the process, directly report the log.

[0052] Among them, file funnel judgment refers to calculating the Z-score (standard score) of the unique file suffix with the largest number of creations within each time window, and comparing the standard score with the target threshold to identify abnormal file suffixes, that is, to confirm whether there is a ransomware threat.

[0053] Reference Figure 6 , Figure 6 Schematic diagram of the structure of the ransomware detection system proposed in one embodiment of the present application. Figure 6 As shown, the ransomware detection system includes a file creation hook module, a ransomware judgment module, a process table module, a process creation hook module, a process termination hook module, a process cloning hook module, a policy parsing module, a policy issuing module, a log printing module, a log receiving module, a whitelist determination module and a whitelist issuing module.

[0054] The file creation hook module is mainly responsible for capturing the occurrence of file creation behavior, accurately recording the file name of the newly created file and the PID of the main process, and identifying the file suffix corresponding to the file name. This is crucial for subsequent analysis of which processes may be performing malicious activities.

[0055] The ransomware judgment module is mainly responsible for statistical analysis of the file suffixes of newly created files, so as to identify the occurrence of file funneling and determine whether there is a ransomware virus. For file suffixes judged as ransomware viruses, they will be processed according to their disposal actions, including killing related processes (involving the current process, parent process, child process and brother process) or reporting logs.

[0056] The process creation hook module, process termination hook module and process cloning hook module are mainly responsible for accurately recording the creation, termination and cloning behaviors of the process, and sending the recorded relevant information to the process table module to update and maintain the latest status of the process tree in real time.

[0057] The process table module is mainly responsible for obtaining the initial process tree by scanning the / proc directory, and receiving the information of process creation and destruction to update the latest status of the process tree in real time. By querying the process tree, the corresponding process can be located and selected, supporting the policy module to take control measures when necessary, such as killing the ransomware process.

[0058] The policy parsing module is mainly responsible for parsing the pre-configured disposal actions in the security policy, which at least include: killing threads or recording. The policy configuration is converted into system executable instructions or logic to provide guidance for system response. At the same time, the permission and role management functions are integrated to ensure that only users or roles with corresponding permissions can modify and execute security policies. This helps prevent unauthorized access and operations and improve the security and stability of the system.

[0059] The policy delivery module is mainly responsible for delivering the instructions or logic generated by the policy parsing module to other related modules, such as the ransomware judgment module, to ensure that the security policy is correctly executed.

[0060] The whitelist determination module is mainly responsible for determining whether the file suffix is ​​on the whitelist if the ransomware judgment module determines that the file suffix is ​​not a ransomware. If it is confirmed, the file suffix is ​​sent to the whitelist delivery module, and then delivered to the kernel.

[0061] The whitelist sending module is mainly responsible for sending the whitelist information to the ransomware judgment module. When judging whether the system is attacked by ransomware, the safe items in the whitelist can be excluded to improve the efficiency of analysis.

[0062] The log receiving module is mainly responsible for receiving the reported log information and sending the log information to the log printing module.

[0063] The log printing module is mainly responsible for printing log information to files, consoles, https, etc. according to the configuration, providing important basis for security analysis.

[0064] By real-time monitoring of the dynamic changes of the file system, especially the concentration trend and sharp decrease of file extensions, we can timely warn and locate threats before the ransomware encrypts a large number of files and causes extensive damage, providing a strong protection barrier for system security. Regardless of how the ransomware spreads, and what path and algorithm are used for encryption, the phenomenon that will eventually appear on the system is file funneling. By monitoring the file funneling phenomenon, we can effectively prevent the ransomware from being bypassed and improve the detection efficiency of the ransomware.

[0065] Based on the same inventive concept, an embodiment of the present application provides a ransomware virus detection device, which includes: An acquisition module, for identifying a file suffix having a maximum number of creations in a current time window and in multiple historical time windows; An analysis module, for analyzing changes in different file suffixes over time windows according to the number of file suffixes with the largest number of creations in a current time window and in multiple historical time windows; The identification module is used to identify abnormal file suffixes based on the analysis results.

[0066] In an optional implementation, the acquisition module is specifically used to: Identify the file suffixes of all newly created files in the current time window and multiple historical time windows; In the current time window and multiple historical time windows, filter out the file suffixes belonging to the whitelist from the file suffixes of all newly created files; In a current time window and in a plurality of historical time windows, a file suffix having a maximum number of creations is identified from the filtered file suffixes.

[0067] In an optional embodiment, the device further comprises: A first processing module, configured to add other file suffixes except the file suffix with the largest number of creations within the current time window to the whitelist; When the file suffix with the largest number of creations in the current time window is a normal file suffix, a confirmation request is output to request the user to confirm whether to add the file suffix with the largest number of creations in the current time window to the whitelist.

[0068] In an optional implementation, the identification module is specifically used to: In the case where the pre-configured handling action is to kill the thread, query and kill the target process and related processes according to the pre-created process tree, wherein the related processes include the parent process, child process and sibling process of the target process, and the target process is the process that creates the new file corresponding to the abnormal file suffix; When the pre-configured handling action is recording, an alarm log for the target process is recorded.

[0069] In an optional embodiment, the device further comprises: The second processing module is used to identify, from the filtered file suffixes, the file suffixes with the largest number of creations in multiple consecutive time windows, that all of the file suffixes are first suffixes, and if the first suffixes are normal file suffixes in multiple consecutive time windows, determine the first suffix as an abnormal file suffix.

[0070] In an optional embodiment, the device further comprises: A third processing module is used for adding the file suffixes of all newly created files in the current time window to the whitelist when multiple file suffixes in the current time window all have the maximum creation quantity; According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed, including: When there is a unique file suffix with the maximum creation number in the current time window, the changes of different file suffixes with time windows are analyzed according to the number of file suffixes with the maximum creation number in the current time window and multiple historical time windows.

[0071] In an optional implementation, the analysis module is specifically used for: Calculate the average value based on the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows; Calculate the standard deviation according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, and the mean; Calculate a standard score according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, as well as the mean and the standard deviation; In a case where the standard score is greater than or equal to the target threshold, determining the file suffix with the largest number of creations in the current time window as an abnormal file suffix; When the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffix with the largest number of creations in the multiple historical time windows is deleted from the cache.

[0072] Based on the same inventive concept, another embodiment of the present application provides an electronic device, such as Figure 7 shown. Figure 7 1 is a schematic diagram of an electronic device shown in an embodiment of the present application. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes, the steps in the ransomware detection method described in any of the above embodiments of the present application are implemented.

[0073] Based on the same inventive concept, an embodiment of the present disclosure further provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer device is enabled to execute the steps in the ransomware detection method described in any of the above embodiments of the present application.

[0074] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0075] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0076] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0079] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0080] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0081] The above is a detailed introduction to a ransomware detection method, device, equipment and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technicians in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting ransomware, characterized in that: include: Identify the file suffix with the largest number of creations within the current time window and within multiple historical time windows; According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed; Based on the analysis results, abnormal file suffixes are identified.

2. The ransomware virus detection method according to claim 1, characterized in that: The step of identifying the file suffix with the largest number of creations in the current time window and in multiple historical time windows includes: Identify the file suffixes of all newly created files in the current time window and multiple historical time windows; In the current time window and multiple historical time windows, filter out the file suffixes belonging to the whitelist from the file suffixes of all newly created files; In a current time window and in a plurality of historical time windows, a file suffix having a maximum number of creations is identified from the filtered file suffixes.

3. The ransomware virus detection method according to claim 2, characterized in that: The method further comprises: Adding other file suffixes except the file suffix with the largest number of creations within the current time window to the whitelist; When the file suffix with the largest number of creations in the current time window is a normal file suffix, a confirmation request is output to request the user to confirm whether to add the file suffix with the largest number of creations in the current time window to the whitelist.

4. The ransomware virus detection method according to claim 1, characterized in that: After identifying the abnormal file suffix, the following steps are included: In the case where the pre-configured handling action is to kill the thread, query and kill the target process and related processes according to the pre-created process tree, wherein the related processes include the parent process, child process and sibling process of the target process, and the target process is the process that creates the new file corresponding to the abnormal file suffix; When the pre-configured handling action is recording, an alarm log for the target process is recorded.

5. The ransomware virus detection method according to claim 2, characterized in that: The method further comprises: In a plurality of consecutive current time windows, it is identified that the file suffixes with the largest number of creations from the filtered file suffixes are all first suffixes, and in a case where the first suffixes are all normal file suffixes in a plurality of consecutive current time windows, the first suffix is ​​determined to be an abnormal file suffix.

6. The ransomware virus detection method according to claim 2, characterized in that: The method further comprises: In the case where multiple file suffixes in the current time window all have the maximum creation quantity, adding the file suffixes of all newly created files in the current time window to the whitelist; According to the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed, including: When there is a unique file suffix with the maximum creation number in the current time window and multiple historical time windows, the changes of different file suffixes over time windows are analyzed based on the number of file suffixes with the maximum creation number in the current time window and multiple historical time windows.

7. The ransomware virus detection method according to any one of claims 1 to 6, characterized in that: The method analyzes the changes of different file suffixes with time windows according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, including: Calculate the average value based on the number of file suffixes with the largest number of creations in the current time window and multiple historical time windows; Calculate the standard deviation according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, and the mean; Calculate a standard score according to the number of file suffixes with the largest number of creations in the current time window and in multiple historical time windows, as well as the mean and the standard deviation; In a case where the standard score is greater than or equal to the target threshold, determining the file suffix with the largest number of creations in the current time window as an abnormal file suffix; When the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffix with the largest number of creations in the multiple historical time windows is deleted from the cache.

8. A ransomware virus detection device, characterized in that: include: An acquisition module, for identifying a file suffix having a maximum number of creations in a current time window and in multiple historical time windows; An analysis module, for analyzing changes in different file suffixes over time windows according to the number of file suffixes with the largest number of creations in a current time window and in multiple historical time windows; The identification module is used to identify abnormal file suffixes based on the analysis results.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the ransomware virus detection method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the ransomware virus detection method according to any one of claims 1 to 7 is implemented.

Images