A method, apparatus, device, and storage medium for detecting ransomware.
By monitoring changes in file extensions in the file system and utilizing whitelisting and Z-score analysis, ransomware can be identified, solving the problem of ransomware bypassing traditional detection methods and achieving efficient and accurate ransomware detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- INSPUR SUZHOU INTELLIGENT TECH CO LTD
- Filing Date
- 2024-10-22
- Publication Date
- 2026-07-17
AI Technical Summary
Existing ransomware detection methods are unable to effectively identify ransomware that bypasses antivirus software and decoy files, leading to greater threats to computer security.
By monitoring changes in file extensions in the file system, the maximum number of file extensions created can be identified. Then, by using a whitelist filtering mechanism and Z-score analysis, it can be determined whether there is a file funnel phenomenon, thereby identifying abnormal file extensions and detecting ransomware.
Effectively identify ransomware, defend against its ability to bypass detection mechanisms of traditional antivirus software and decoy files, reduce false positive rates, protect system performance and business processes, and improve detection accuracy.
Smart Images
Figure CN119475334B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of security technology, and in particular to a ransomware detection method, apparatus, device, and storage medium. Background Technology
[0002] Ransomware is a type of malware that demands ransom by encrypting files. During the encryption process, it replaces various filenames such as .txt and .doc with extensions that can represent the virus (e.g., .wanncry), posing a significant threat to computer security. There are two main types of protection against ransomware: proactive protection by antivirus software and decoy techniques. However, as ransomware continues to upgrade and evolve, the risk of bypassing antivirus software and decoys is constantly increasing. Once antivirus software and decoys are bypassed, ransomware will launch unrestrained attacks on the system, posing an even greater threat to computer security. Summary of the Invention
[0003] This application provides a ransomware detection method, apparatus, device, and storage medium, aiming to solve the problem of ransomware bypassing antivirus software and decoy files.
[0004] The first aspect of this application provides a ransomware detection method, including: Identify the file extensions with the highest number of creations within the current time window and multiple historical time windows; Based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows, the changes of different file extensions with time windows are analyzed. Based on the analysis results, abnormal file extensions were identified.
[0005] In one optional implementation, the step of identifying the file extension with the highest number of creations within the current time window and multiple historical time windows includes... Identify the file extensions of all newly created files within the current time window and multiple historical time windows; Filter out file extensions that belong to the whitelist from all newly created files within the current time window and multiple historical time windows; Within the current time window and multiple historical time windows, identify the file extensions with the highest number of creations from the filtered file extensions.
[0006] In an optional implementation, the method further includes: Add all file extensions other than those with the maximum number of creations within the current time window to the whitelist; If the file extensions with the maximum number of creations within the current time window are normal file extensions, output a confirmation request to ask the user to confirm whether to add file extensions other than those with the maximum number of creations within the current time window to the whitelist.
[0007] In one alternative implementation, the step of identifying the abnormal file extension includes: If the pre-configured action is to kill the thread, the target process and related processes are queried and killed according to the pre-created process tree. The related processes include the parent process, child process and sibling process of the target process. The target process is the process that created the new file corresponding to the abnormal file extension. If the pre-configured action is to record, an alarm log is recorded for the target process.
[0008] In an optional implementation, the method further includes: Within multiple consecutive current time windows, if the file extension with the largest number of creations is identified from the filtered file extensions as the first extension, and if the first extension is a normal file extension within multiple consecutive current time windows, then the first extension is determined to be an abnormal file extension.
[0009] In an optional implementation, the method further includes: If multiple file extensions have the maximum number of creations within the current time window, add the file extensions of all newly created files within the current time window to the whitelist. Based on the number of file extensions with the highest number of creations within the current time window and multiple historical time windows, the changes in different file extensions over time windows are analyzed, including: Given that there is a unique file extension with the maximum number of creations within the current time window and multiple historical event windows, the changes of different file extensions with the time window are analyzed based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows.
[0010] In one optional implementation, the analysis of the changes in different file extensions over time windows, based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows, includes: Calculate the average number of file extensions with the highest number of creations within the current time window and multiple historical time windows; The standard deviation is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, and the mean value. The standard score is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, as well as the mean and the standard deviation. If the standard score is greater than or equal to the target threshold, the file suffix with the largest number of creations within the current time window is identified as an abnormal file suffix. If the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffixes with the largest number of creations in the multiple historical time windows are deleted from the cache.
[0011] A second aspect of this application provides a ransomware detection device, comprising: The acquisition module is used to identify the file extensions with the highest number of creations within the current time window and multiple historical time windows; The analysis module is used to analyze the changes of different file extensions over time windows based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows. The identification module is used to identify abnormal file extensions based on the analysis results.
[0012] A third aspect of this application provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the ransomware detection method of the first aspect of this application.
[0013] A fourth aspect of this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the ransomware detection method of the first aspect of this application.
[0014] In this embodiment, file extensions with the highest number of creations are identified within the current time window and multiple historical time windows. Based on the number of file extensions with the highest number of creations within the current time window and multiple historical time windows, the changes in different file extensions over time windows are analyzed. Based on the analysis results, abnormal file extensions are identified. This method effectively identifies abnormal file extensions to defend against ransomware upgrades or targeted attacks, preventing ransomware from bypassing traditional antivirus software or detection mechanisms based on decoy files. Attached Figure Description
[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0016] Figure 1 This is a flowchart of the ransomware detection method proposed in one embodiment of this application; Figure 2 This is a flowchart of manually adding a whitelist to a ransomware detection method proposed in one embodiment of this application; Figure 3 This is a flowchart of the file funnel judgment process for a ransomware detection method proposed in one embodiment of this application; Figure 4 This is a process tree flowchart of a ransomware detection method proposed in an embodiment of this application; Figure 5 This is a flowchart of the detection steps of a ransomware detection method proposed in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a ransomware detection system proposed in one embodiment of this application; Figure 7 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation
[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0018] Ransomware, a major threat to computer security, is increasingly impacting the market, with attacks shifting from individual users to large institutions and organizations such as governments and enterprises. It has become a key target in sectors including healthcare, education, finance, and government. In response to this threat, ransomware protection measures are receiving increasing attention.
[0019] There are two main types of protection against ransomware. The first is proactive protection by antivirus software, which aims to detect and handle ransomware as quickly as possible after it enters the system. However, this method is heavily reliant on virus definitions. The second is decoy technology, which uses decoy files to lure and kill ransomware. The concept behind decoy technology is simple: deploy bait, capture and process events that trigger the bait's actions. However, whether the decoy file can effectively identify the virus within the system, or simply detect normal operations (whether human or system-wide), is a challenge. If it traps and kills a legitimate business program, it will be a poor user experience and could even disrupt the normal operation of the business system, causing unnecessary losses.
[0020] As ransomware continues to upgrade and evolve, the risk of antivirus software and decoys being bypassed is also increasing. Once antivirus software and decoys are bypassed, ransomware will launch unbridled attacks on the system, posing a greater threat to computer security. Therefore, we need to continuously improve our ransomware protection capabilities to safeguard our computer systems and data security.
[0021] In ransomware protection technologies, the deployment location and quantity of decoy files are key factors determining the success and timing of ransomware capture. This also implies the risk of decoy files being bypassed or capture occurring too late (i.e., after most critical files have been encrypted). When implementing decoy file capture techniques, any operations on the decoy files must be intercepted; therefore, the deployed decoy files may adversely affect normal business processes. Decoy files need to monitor multiple hook points such as file creation, reading, writing, deletion, and renaming. File operations are frequent actions for the system, so monitoring every system call related to file operations for ransomware detection may impact system performance.
[0022] A file funnel is a thread that occurs during the encryption process of ransomware files. It's the phenomenon where a large number of files with various file extensions are converted to files with a single, uniform extension. Within a short period, a large number of files with the same specific extension suddenly appear on the system. These files quickly become dominant, causing the system's file structure to exhibit a funnel-like concentration trend. Over time, the variety of file extensions gradually decreases until almost only the specific extension assigned by the ransomware after encryption remains, such as the common ".wanncry", thus clearly revealing the ransomware's intrusion behavior.
[0023] This paper proposes a ransomware detection method based on the file funnel phenomenon. This method analyzes the sharp decrease in the variety of file extensions in the system, especially when multiple file extensions are encrypted, leaving only ransomware-specific extensions (such as .wanncry), to determine if ransomware is running. The file funnel phenomenon is a significant indicator of ransomware activity, and its occurrence is unavoidable by ransomware; it cannot be bypassed through technical means. Therefore, by monitoring the file funnel phenomenon in real time, we can effectively defend against ransomware escalations or targeted attacks, preventing them from bypassing traditional antivirus software or detection mechanisms based on decoy files; avoiding disruptions to normal business processes due to decoy file interception; and preventing the impact on system performance from adding monitoring and ransomware detection logic to excessive system calls.
[0024] Reference Figure 1 , Figure 1 This is a flowchart of a ransomware detection method according to an embodiment of this application, including the following steps S11-S13: Step S11: Identify the file extension with the largest number of creations within the current time window and multiple historical time windows.
[0025] To monitor file creation, scripts or tools can be used to scan files in a specified directory (or the entire file system) and collect information such as file creation time, name, and path. File extensions (suffixes) can be extracted from the collected filenames, for example, extracting .txt from example.txt. A sliding window approach can be used, counting all files created within those 5 seconds by their extensions to obtain a list of {extension, total number}, identifying the file extension with the highest number of creations within that time window. Furthermore, for the current time window and multiple historical event windows (such as the past 9 time windows), the file extension with the highest number of creations can be identified for each time window.
[0026] Furthermore, the process of identifying file extensions with the highest number of creations within the current time window and multiple historical time windows includes... Identify the file extensions of all newly created files within the current time window and multiple historical time windows; Filter out file extensions that belong to the whitelist from all newly created files within the current time window and multiple historical time windows; Within the current time window and multiple historical time windows, identify the file extensions with the highest number of creations from the filtered file extensions.
[0027] A whitelist is a security mechanism used to ensure that only explicitly permitted or trusted programs, files, or operations can be executed or accessed. Whitelist filtering mechanisms encompass both built-in whitelists and manually added whitelists. Built-in whitelists can pre-define 177 common system file extensions, designed for automatic identification and handling; if a file extension is on the whitelist, the system will automatically remove statistical data related to that extension. For example... Figure 2 As shown, when manually adding a file to the whitelist, first determine if a certain file extension is a normal file extension (when it is determined to be on the whitelist), save and update it to the user-space whitelist database, and at the same time update the whitelist information in the kernel to ensure system-level synchronous updates, and delete the relevant data of the added extension in the kernel cache statistics.
[0028] This process identifies the file extensions of all newly created files within the current time window and multiple historical time windows. A whitelist filtering mechanism is used to remove whitelisted file extensions from all newly created file extensions. If all file extension data within the current event window is filtered out, the analysis process automatically terminates and proceeds to the next time window for statistical analysis. Within the current time window and multiple historical time windows, the file extension with the highest number of creations is identified from the filtered file extensions. Filtering out whitelisted file extensions helps reduce false positives, improves analysis efficiency, and provides stronger support for file system management and maintenance.
[0029] Furthermore, the method also includes: Add all file extensions other than those with the maximum number of creations within the current time window to the whitelist; If the file extensions with the maximum number of creations within the current time window are normal file extensions, output a confirmation request to ask the user to confirm whether to add file extensions other than those with the maximum number of creations within the current time window to the whitelist.
[0030] File extensions with low creation frequency within the current time window—that is, file extensions other than those with the highest creation frequency—are automatically added to a whitelist. By automatically adding infrequently created extensions to the whitelist, redundant analysis and judgment of these extensions can be reduced, thereby saving computing resources and improving overall recognition efficiency.
[0031] If a file extension with the highest number of creations within the current time window is determined to be a legitimate file extension (not ransomware), a confirmation request is output and reported to user space. The user then determines whether to add the file extension to the whitelist. By reporting to user space and allowing the user to confirm whether it is on the whitelist based on the actual situation, the false positive rate can be greatly reduced, while maintaining sensitivity to potential unknown threats.
[0032] Step S12: Analyze the changes of different file extensions with the maximum number of creations within the current time window and multiple historical time windows.
[0033] Based on the number of file extensions with the highest creation frequency within the current time window and multiple historical time windows, the Z-score (standard score) of the file extension with the highest creation frequency within each time window is calculated. This allows for analysis of the changes in different file extensions over time windows to determine if they exhibit a file funnel phenomenon, thereby further confirming the presence of ransomware threats. By performing Z-score analysis on the extensions with the highest creation frequency to determine if they are ransomware, i.e., real-time monitoring of the file funnel phenomenon, it can effectively defend against ransomware upgrades or targeted attacks, preventing them from bypassing traditional antivirus software or detection mechanisms based on decoy files.
[0034] Furthermore, the method also includes: If multiple file extensions have the maximum number of creations within the current time window, add the file extensions of all newly created files within the current time window to the whitelist. Based on the number of file extensions with the highest number of creations within the current time window and multiple historical time windows, the changes in different file extensions over time windows are analyzed, including: Given that there is a unique file extension with the maximum number of creations within the current time window and multiple historical time windows, the changes of different file extensions with the time window are analyzed based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows.
[0035] If multiple file extensions have the maximum number of creations within the current time window (i.e., multiple extensions share the same maximum number of newly created file records), then all file extensions of newly created files within the current time window are added to a whitelist for reassessment in the next time window. While waiting for the next time window, the system remains silent, preparing for a new round of statistical analysis. If a unique file extension has the maximum number of creations within the current time window and multiple historical time windows, then the changes in different file extensions over time windows are analyzed based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows. Analyzing file extensions with the unique maximum number of creations helps in achieving ransomware detection based on the file funnel phenomenon, thereby protecting data security.
[0036] Furthermore, the analysis of the changes in different file extensions over time windows, based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows, includes: Calculate the average number of file extensions with the highest number of creations within the current time window and multiple historical time windows; The standard deviation is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, and the mean value. The standard score is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, as well as the mean and the standard deviation. If the standard score is greater than or equal to the target threshold, the file suffix with the largest number of creations within the current time window is identified as an abnormal file suffix. If the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffixes with the largest number of creations in the multiple historical time windows are deleted from the cache.
[0037] Reference Figure 3 It can calculate the mean, standard deviation, and standard score based on the number of file extensions with the maximum number of creations in the current time window and multiple historical event windows (such as the past 9 time windows), and judge abnormal file extensions based on the standard score.
[0038] Calculate the average number of file extensions with the highest number of creations within the current time window using the following formula (1): (1) in, This represents the average number of file extensions with the maximum number of creations within the current time window, and x represents the number of file extensions with the maximum number of creations within each time window.
[0039] Calculate the standard deviation of file extensions with the largest number of creations within the current time window using the following formula (2): (2) in, This represents the standard deviation of the file extension with the highest number of creations within the current time window. This represents the average number of file extensions with the maximum number of creations within the current time window, and x represents the number of file extensions with the maximum number of creations within each time window.
[0040] Calculate the standard score (Z-score) of the file extension with the largest number of creations within the current time window using the following formula (3): (3) Where Z represents the standard score for the file extension with the maximum number of creations within the current time window. This represents the standard deviation of the file extension with the highest number of creations within the current time window. This represents the average number of file extensions with the maximum number of creations within the current time window, where x represents the number of file extensions with the maximum number of creations within the current time window.
[0041] The presence of abnormal file extensions is determined based on a standard score (Z). In Z-score applications, 2 or 3 are often used as thresholds; 3 can be chosen as the target threshold if a higher deviation from the target score is required. If the standard score is greater than or equal to the target threshold, the file extension with the highest number of creations within the current time window is considered abnormal and belongs to ransomware. If the standard score is less than the target threshold, the file extension with the highest number of creations within the current time window is considered normal and does not belong to ransomware. Multiple file extensions with the highest number of creations within historical time windows (determined to be normal) can be removed from the cache to maintain the timeliness and accuracy of the cache.
[0042] By performing Z-score analysis on data from the current window and multiple historical time windows, a sudden and significant increase in file extensions can be identified. This means a particular uncommon (non-whitelisted) extension is suddenly being created on a large scale on the system. Such a file extension is then identified as a ransomware extension, and appropriate actions can be taken, such as killing threads or simply logging the data. Monitoring the file funnel phenomenon can effectively prevent ransomware from bypassing antivirus software and decoy files, improving detection accuracy. The file funnel is an inherent part of the encryption process in ransomware, and it is something that ransomware cannot circumvent.
[0043] Furthermore, the method also includes: Within multiple consecutive current time windows, if the file extension with the largest number of creations is identified from the filtered file extensions as the first extension, and if the first extension is a normal file extension within multiple consecutive current time windows, then the first extension is determined to be an abnormal file extension.
[0044] Within three consecutive current time windows, if the file extensions with the highest creation frequency consistently appear as the first extension (or the normal file extension), then the first extension is identified as an abnormal file extension. In other words, if no abnormal file extensions are identified within three consecutive current time windows (meaning no ransomware is detected), but the most frequently occurring file extension remains consistent across these three windows, then this extension can be identified as a ransomware extension. Supplementing this process to indirectly identify potential ransomware activity can improve detection accuracy.
[0045] Step S13: Based on the analysis results, identify abnormal file extensions.
[0046] Based on the analysis results, abnormal file extensions are identified. This can be done by analyzing file extensions with the highest unique number of creations to obtain a standard score. If the standard score is greater than or equal to a target threshold, then file extensions with the highest unique number of creations within the current time window are identified as abnormal.
[0047] Furthermore, after identifying the abnormal file extension, the process includes: If the pre-configured action is to kill the thread, the target process and related processes are queried and killed according to the pre-created process tree. The related processes include the parent process, child process and sibling process of the target process. The target process is the process that created the new file corresponding to the abnormal file extension. If the pre-configured action is to record, an alarm log is recorded for the target process.
[0048] Reference Figure 4 The kernel initializes the process tree by scanning the ` / proc` directory. This directory contains detailed information about all currently running processes. Each process has its own dedicated directory, named using the process's PID (Process Identifier). By meticulously traversing this directory structure, the system can accurately locate all active processes and construct a clear and intuitive process tree based on their parent-child relationships. During program execution, the kernel monitors and manages process lifecycle events such as creation and deletion, dynamically updating the process tree structure based on these events. Specifically, the kernel includes newly created processes, including those created through cloning, and removes terminated processes from the process tree. When a process needs to be terminated (killed), the user or system can locate and select the corresponding process by querying the process tree.
[0049] After identifying abnormal file extensions, pre-configured actions can be taken. These actions include at least: killing threads and logging. If the pre-configured action is to kill threads, the target process and related processes are queried and killed according to a pre-created process tree, and logs can be logged. The target process is the process that created the new file corresponding to the abnormal file extension, and related processes include the target process's parent, child, and sibling processes. If the pre-configured action is to log, only alerts related to the target process are logged. By setting different actions to promptly handle potential ransomware activities, the risk of data being encrypted and extorted can be significantly reduced, protecting the important information assets of enterprises and individuals, and ensuring the continuous and stable operation of the system.
[0050] In this embodiment, file extensions with the highest number of creations are identified within the current time window and multiple historical time windows. Based on the number of file extensions with the highest number of creations within the current time window and multiple historical time windows, the changes in different file extensions over time windows are analyzed. Based on the analysis results, abnormal file extensions are identified. This method effectively identifies abnormal file extensions to defend against ransomware upgrades or targeted attacks. It can prevent ransomware from bypassing traditional antivirus software or detection mechanisms based on decoy files. It can also avoid the impact on normal business processes caused by interception operations similar to decoy files, and the performance impact on the system caused by adding monitoring and ransomware judgment logic to excessive system calls.
[0051] Reference Figure 5 , Figure 5 This is a flowchart illustrating the detection steps of a ransomware detection method according to an embodiment of this application. Figure 5 As shown, the detection process is as follows: The system analyzes the file extensions of all newly created files within a given time window; filters out file extensions belonging to the whitelist; checks if the remaining file extensions are empty; if the remaining file extensions are empty, it ends the statistical analysis for the current time window; if the remaining file extensions are not empty, it further checks if there are multiple file extensions with the maximum number of creations; if there are multiple file extensions with the maximum number of creations, it ends the statistical analysis for the current time window; if there are no multiple file extensions with the maximum number of creations, it performs a file funnel analysis on the unique file extension with the maximum number of creations; if the file funnel analysis does not identify any abnormal file extensions, it ends the statistical analysis for the current time window; if the file funnel analysis identifies abnormal file extensions, it chooses whether to kill the process; if it chooses to kill the process, it executes the process killing operation and then reports the log; if it does not choose to kill the process, it directly reports the log.
[0052] The file funnel judgment refers to calculating the Z-score (standard score) of a unique file extension with the highest number of creations within each time window, comparing the standard score with a target threshold to identify abnormal file extensions, thus confirming the existence of ransomware threats.
[0053] Reference Figure 6 , Figure 6 This is a schematic diagram of the structure of a ransomware detection system proposed in one embodiment of this application. Figure 6 As shown, the ransomware detection system includes a file creation hook module, a ransomware judgment module, a process table module, a process creation hook module, a process termination hook module, a process cloning hook module, a policy parsing module, a policy distribution module, a log printing module, a log receiving module, a whitelist determination module, and a whitelist distribution module.
[0054] The file creation hook module is primarily responsible for capturing file creation events, accurately recording the filename of the newly created file and the PID of the main process, and identifying the file extension corresponding to the filename. This is crucial for subsequent analysis of which processes may be engaging in malicious activities.
[0055] The ransomware judgment module is primarily responsible for statistical analysis of the file extensions of newly created files to identify file funnel phenomena and thus determine the presence of ransomware. For file extensions identified as ransomware, appropriate actions will be taken, including killing related processes (involving the current process, parent process, child process, and sibling processes) or reporting the issue to the logs.
[0056] The process creation hook module, process termination hook module, and process cloning hook module are mainly responsible for accurately recording the creation, termination, and cloning behaviors of processes, and sending the recorded relevant information to the process table module to update and maintain the latest state of the process tree in real time.
[0057] The process table module is primarily responsible for obtaining the initial process tree through scanning the / proc directory and updating it in real time to maintain the latest state of the process tree by receiving recorded information on process creation and destruction. By querying the process tree, the corresponding process can be located and selected, allowing the policy module to take control measures when necessary, such as killing ransomware processes.
[0058] The policy parsing module is primarily responsible for parsing the pre-configured actions in security policies. These actions include, at a minimum, killing threads or logging. It translates policy configurations into executable instructions or logic, guiding the system's response. Simultaneously, it integrates permission and role management functions to ensure that only users or roles with the appropriate permissions can modify and execute security policies. This helps prevent unauthorized access and operations, improving system security and stability.
[0059] The policy distribution module is mainly responsible for distributing the instructions or logic generated by the policy parsing module to other relevant modules, such as the ransomware judgment module, to ensure that the security policy is executed correctly.
[0060] The whitelist determination module is mainly responsible for determining whether a file extension is not a ransomware extension after the ransomware detection module has determined it. If so, it checks whether the file extension is on the whitelist. If it is, it sends the file extension to the whitelist distribution module, which then distributes it to the kernel.
[0061] The whitelist distribution module is primarily responsible for distributing whitelist information to the ransomware judgment module. When determining whether a system is under ransomware attack, it can exclude security entries from the whitelist, improving analysis efficiency.
[0062] The log receiving module is mainly responsible for receiving reported log information and sending it to the log printing module.
[0063] The log printing module is mainly responsible for printing log information to files, consoles, HTTPS, etc., according to the configuration, providing important information for security analysis.
[0064] By monitoring real-time changes in the file system, particularly the concentration and sharp decrease of file extensions, we can provide timely warnings and pinpoint threats before ransomware encrypts large numbers of files and causes widespread damage, thus providing a strong protective barrier for system security. Regardless of the methods or algorithms used to spread ransomware, the final phenomenon on the system is a file funnel. By monitoring this file funnel phenomenon, we can effectively prevent ransomware from bypassing our defenses and improve ransomware detection efficiency.
[0065] Based on the same inventive concept, one embodiment of this application provides a ransomware detection device, which includes: The acquisition module is used to identify the file extensions with the highest number of creations within the current time window and multiple historical time windows; The analysis module is used to analyze the changes of different file extensions over time windows based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows. The identification module is used to identify abnormal file extensions based on the analysis results.
[0066] In one optional implementation, the acquisition module is specifically used for: Identify the file extensions of all newly created files within the current time window and multiple historical time windows; Filter out file extensions that belong to the whitelist from all newly created files within the current time window and multiple historical time windows; Within the current time window and multiple historical time windows, identify the file extensions with the highest number of creations from the filtered file extensions.
[0067] In one alternative embodiment, the device further includes: The first processing module is used to add file extensions other than those with the maximum number of creations within the current time window to the whitelist; If the file extensions with the maximum number of creations within the current time window are normal file extensions, output a confirmation request to ask the user to confirm whether to add file extensions other than those with the maximum number of creations within the current time window to the whitelist.
[0068] In one optional implementation, the identification module is specifically used for: If the pre-configured action is to kill the thread, the target process and related processes are queried and killed according to the pre-created process tree. The related processes include the parent process, child process and sibling process of the target process. The target process is the process that created the new file corresponding to the abnormal file extension. If the pre-configured action is to record, an alarm log is recorded for the target process.
[0069] In one alternative embodiment, the device further includes: The second processing module is used to identify, within multiple consecutive time windows, the file extensions with the largest number of creations that are all the first extension, and where the first extension is a normal file extension within multiple consecutive time windows, and then determine the first extension as an abnormal file extension.
[0070] In one alternative embodiment, the device further includes: The third processing module is used to add the file extensions of all newly created files in the current time window to the whitelist when multiple file extensions have the maximum number of creations in the current time window. Based on the number of file extensions with the highest number of creations within the current time window and multiple historical time windows, the changes in different file extensions over time windows are analyzed, including: If there is only one file extension with the maximum number of creations within the current time window, the changes of different file extensions with the maximum number of creations are analyzed based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows.
[0071] In one optional implementation, the analysis module is specifically used for: Calculate the average number of file extensions with the highest number of creations within the current time window and multiple historical time windows; The standard deviation is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, and the mean value. The standard score is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, as well as the mean and the standard deviation. If the standard score is greater than or equal to the target threshold, the file suffix with the largest number of creations within the current time window is identified as an abnormal file suffix. If the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffixes with the largest number of creations in the multiple historical time windows are deleted from the cache.
[0072] Based on the same inventive concept, another embodiment of this application provides an electronic device, such as... Figure 7 As shown. Figure 7 This is a schematic diagram of an electronic device according to an embodiment of this application. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When executed by the processor, the program implements the steps of the ransomware detection method described in any of the above embodiments of this application.
[0073] Based on the same inventive concept, this disclosure also provides a computer-readable storage medium, which, when the instructions in the computer-readable storage medium are executed by the processor of a computer device, enables the computer device to perform the steps in the ransomware detection method described in any of the above embodiments of this application.
[0074] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0075] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0076] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0077] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0079] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.
[0080] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.
[0081] The above provides a detailed description of a ransomware detection method, apparatus, device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A method for detecting ransomware, characterized in that, include: Identify the file extensions with the highest number of creations within the current time window and multiple historical time windows; Based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows, the changes of different file extensions with time windows are analyzed. Based on the analysis results, abnormal file extensions were identified; The process of identifying file extensions with the highest number of creations within the current time window and multiple historical time windows includes: Within the current time window and multiple historical time windows, identify the file extensions of all newly created files; specifically, monitor file creation by using scripts or tools to scan files in a specified directory and collect the file creation time, name, and path, and extract the file extensions from the collected file names; Filter out file extensions that belong to the whitelist from all newly created files within the current time window and multiple historical time windows; Within the current time window and multiple historical time windows, identify the file extension with the largest number of creations from the filtered file extensions; The method further includes: Within multiple consecutive current time windows, if the file extension with the largest number of creations is identified from the filtered file extensions as the first extension, and if the first extension is a normal file extension within multiple consecutive current time windows, then the first extension is determined to be an abnormal file extension.
2. The ransomware detection method according to claim 1, characterized in that, The method further includes: Add all file extensions other than those with the maximum number of creations within the current time window to the whitelist; If the file extensions with the maximum number of creations within the current time window are normal file extensions, output a confirmation request to ask the user to confirm whether to add file extensions other than those with the maximum number of creations within the current time window to the whitelist.
3. The ransomware detection method according to claim 1, characterized in that, After identifying abnormal file extensions, the process includes: If the pre-configured action is to kill the thread, the target process and related processes are queried and killed according to the pre-created process tree. The related processes include the parent process, child process and sibling process of the target process. The target process is the process that created the new file corresponding to the abnormal file extension. If the pre-configured action is to record, an alarm log is recorded for the target process.
4. The ransomware detection method according to claim 1, characterized in that, The method further includes: If multiple file extensions have the maximum number of creations within the current time window, add the file extensions of all newly created files within the current time window to the whitelist. Based on the number of file extensions with the highest number of creations within the current time window and multiple historical time windows, the changes in different file extensions over time windows are analyzed, including: Given that there is a unique file extension with the maximum number of creations within the current time window and multiple historical time windows, the changes of different file extensions with the time window are analyzed based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows.
5. The ransomware detection method according to any one of claims 1-4, characterized in that, The analysis examines the changes in different file extensions over time windows based on the number of file extensions with the highest creation count within the current time window and multiple historical time windows, including: Calculate the average number of file extensions with the highest number of creations within the current time window and multiple historical time windows; The standard deviation is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, and the mean value. The standard score is calculated based on the number of file extensions with the largest number of creations within the current time window and multiple historical time windows, as well as the mean and the standard deviation. If the standard score is greater than or equal to the target threshold, the file suffix with the largest number of creations within the current time window is identified as an abnormal file suffix. If the standard score is less than the target threshold, the file suffix with the largest number of creations in the current time window is determined as a normal file suffix, and the file suffixes with the largest number of creations in the multiple historical time windows are deleted from the cache.
6. A ransomware detection device, characterized in that, include: The acquisition module is used to identify the file extensions with the highest number of creations within the current time window and multiple historical time windows; The analysis module is used to analyze the changes of different file extensions over time windows based on the number of file extensions with the maximum number of creations within the current time window and multiple historical time windows. The identification module is used to identify abnormal file extensions based on the analysis results; The acquisition module is specifically used for: Within the current time window and multiple historical time windows, identify the file extensions of all newly created files; specifically, monitor file creation by using scripts or tools to scan files in a specified directory and collect the file creation time, name, and path, and extract the file extensions from the collected file names; Filter out file extensions that belong to the whitelist from all newly created files within the current time window and multiple historical time windows; Within the current time window and multiple historical time windows, identify the file extension with the largest number of creations from the filtered file extensions; The device further includes: The second processing module is used to identify, within multiple consecutive time windows, the file extensions with the largest number of creations that are all the first extension, and where the first extension is a normal file extension within multiple consecutive time windows, and then determine the first extension as an abnormal file extension.
7. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the ransomware detection method according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the ransomware detection method according to any one of claims 1 to 5.