Ransomware processing method and apparatus, and electronic device

Abstract

The invention relates to the field of network security, and discloses a ransomware processing method and apparatus, and an electronic device. The method comprises the steps of triggering a suspicious file imported into a preset sandbox to run, and monitoring a first behavior feature of the suspicious file; determining an encryption algorithm operation condition according to the first behavior feature and a preset second behavior feature; when the operation condition of the encryption algorithm is that the encryption algorithm is operated, encrypted data, encryption algorithm characteristics and a key mark vector are recorded; determining a candidate encryption algorithm according to the encryption algorithm features; and decrypting the encrypted data by using the candidate encryption algorithm and the key mark vector. Therefore, the candidate encryption algorithm possibly used by the ransomware can be conveniently deduced, and the encrypted data can be decrypted by using the candidate encryption algorithm, so that the encrypted data can be decrypted successfully more easily, and the recovery probability and the recovery efficiency of the file encrypted by the ransomware are further improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method and device for processing ransomware, and electronic equipment. Background Art

[0002] As the frequency and complexity of ransomware attacks increase, enterprises and individuals are facing unprecedented data security threats. In related technologies, users can usually only get feedback that the files have been encrypted after the files have been encrypted by the ransomware, and there is no effective means to recover the files encrypted by the ransomware.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical elements or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0005] The embodiments of the present application provide a method and device for processing a ransomware virus, and an electronic device to increase the probability of recovering files encrypted by the ransomware virus.

[0006] An embodiment of the present application provides a method for processing a ransomware virus, including: triggering the operation of a suspicious file imported into a preset sandbox, and monitoring a first behavioral feature of the suspicious file; the first behavioral feature characterizes the operating behavior of the suspicious file during the operation; the suspicious file is assumed to be a file carrying a ransomware virus; determining the operation status of an encryption algorithm according to the first behavioral feature and a preset second behavioral feature; the second behavioral feature characterizes the operating behavior during the operation of the encryption algorithm; when the encryption algorithm operation status is that the encryption algorithm is running, recording encrypted data, encryption algorithm features and a key marking vector; determining a candidate encryption algorithm according to the encryption algorithm features; and decrypting the encrypted data using the candidate encryption algorithm and the key marking vector.

[0007] In the above implementation, it is considered that the sandbox can isolate and analyze untrusted applications in a virtualized environment. By importing suspicious files into the sandbox, the behavior of the suspicious files can be monitored and the behavior characteristics related to encryption can be recorded, so as to facilitate the analysis of whether the suspicious files carry ransomware. At the same time, considering that different encryption algorithms have different encryption characteristics, by recording the encryption algorithm characteristics during the operation of the suspicious files, it is easy to infer the candidate encryption algorithms that the ransomware may use. Decrypting the encrypted data using the candidate encryption algorithms can make it easier to successfully decrypt the encrypted data, thereby improving the recovery probability and recovery efficiency of files encrypted by the ransomware.

[0008] Furthermore, determining the operation status of the encryption algorithm based on the first behavior feature and the preset second behavior feature includes: determining a first target similarity between the first behavior feature and the second behavior feature; when the first target similarity is higher than a first preset similarity, confirming that the operation status of the encryption algorithm is that the encryption algorithm is running; otherwise, confirming that the operation status of the encryption algorithm is that the encryption algorithm is not running.

[0009] In the above implementation, considering that there are some specific features in the process of running the encryption algorithm, the similarity between the first behavior feature and the second behavior feature of the suspicious file can reflect whether the two behaviors are similar, so as to accurately infer whether an encryption algorithm is running, so as to facilitate the subsequent decryption of the encrypted data.

[0010] Furthermore, the first behavior feature includes: target call instructions, target memory access mode, target function call chain, target encryption duration and target encrypted file size; the second behavior feature includes: sample call instructions, sample memory access mode, sample function call chain, sample encryption duration and sample encrypted file size; determining the first target similarity between the first behavior feature and the second behavior feature includes: calculating the first sample similarity between the target call instruction and the sample call instruction; calculating the second sample similarity between the target memory access mode and the sample memory access mode; calculating the third sample similarity between the target function call chain and the sample function call chain; calculating the fourth sample similarity between the target encryption duration and the sample encryption duration; calculating the fifth sample similarity between the target encrypted file size and the sample encrypted file size; determining the first target similarity according to the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity.

[0011] In the above implementation, taking into account the existence of multiple behavioral characteristics in the encryption process, multiple behavioral characteristics such as target call instructions, target memory access mode, target function call chain, target encryption duration and target encrypted file size are comprehensively considered, and the sample similarity of each behavioral characteristic is compared to determine the target similarity, which can make it more accurate to infer whether an encryption algorithm is running according to the target similarity.

[0012] Furthermore, the first behavioral feature also includes: retrieving the file type; before determining the candidate encryption algorithm according to the encryption algorithm feature, the method also includes: determining a first hazard metric value according to the key tag vector; determining a second hazard metric value according to the retrieved file type; backing up the suspicious file according to the first hazard metric value and the second hazard metric value; stopping the suspicious file and running the backup file.

[0013] In the above implementation, when it is detected that the running suspicious file may be harmful, the suspicious file is backed up and the backup file is run. While protecting the data of the suspicious file from further damage, the running of the ransomware of the suspicious file can be continuously monitored to provide data support for subsequent ransomware protection.

[0014] Furthermore, the encryption algorithm characteristics include: calling instructions, encryption operation mode and key length; determining a candidate encryption algorithm based on the encryption algorithm characteristics includes: searching for the candidate encryption algorithm corresponding to the calling instruction, the encryption operation mode and the key length in a preset encryption algorithm database; the encryption algorithm database stores the correspondence between the calling instructions, encryption operation mode, key length and the candidate encryption algorithm.

[0015] In the above implementation, different encryption algorithms have different encryption algorithm features. By combining multiple encryption algorithm features to match candidate encryption algorithms, it is possible to narrow down the range of encryption algorithms used by ransomware, so as to decrypt the encrypted data faster in the future.

[0016] Furthermore, there are multiple candidate encryption algorithms, and the encrypted data is decrypted using the candidate encryption algorithms and the key marking vector, including: determining the priority of each candidate encryption algorithm according to the calling instruction, the encryption operation mode and the key length; and decrypting the encrypted data using the candidate encryption algorithm and the key marking vector according to the priority.

[0017] In the above implementation, by sorting different candidate encryption algorithms and performing decryption in order of priority, it is helpful to match the correct candidate encryption algorithm more quickly, thereby achieving faster decryption success.

[0018] Furthermore, after decrypting the encrypted data using the candidate encryption algorithm and the key marking vector, the method for processing the ransomware virus also includes: verifying whether the decrypted data satisfies a first preset condition; the first preset condition satisfies at least one of the following: the decrypted data has the same file format as the encrypted data, the decrypted data has the same file structure as the encrypted data, the content of the decrypted data is the same as the content of the encrypted data before encryption, and the decrypted data can be executed normally; if the decrypted data satisfies the first preset condition, confirming that the decryption is successful; otherwise, confirming that the decryption fails.

[0019] In the above implementation, by verifying the decrypted data, it can be ensured that the encrypted data is correctly restored.

[0020] Furthermore, there are multiple encrypted data; the method for processing the ransomware virus also includes: reorganizing the decrypted data corresponding to each of the encrypted data to obtain reorganized data; verifying whether the reorganized data meets a second preset condition; the second preset condition includes: whether the hash value of the reorganized data is consistent with the hash value of the suspicious file, and whether the file format of the reorganized data is consistent with the file format of the suspicious file; if the reorganized data meets the second preset condition, confirming that the reorganization is successful, and recording the candidate encryption algorithm and the key marking vector that are successfully decrypted; otherwise, confirming that the reorganization fails.

[0021] In the above implementation, considering that the ransomware virus may encrypt multiple segments of data separately, by reorganizing and verifying the multiple encrypted data, the accuracy and integrity of the data after the suspicious file is recovered can be improved.

[0022] An embodiment of the present application provides a device for processing a ransomware virus, including: a monitoring module, used to trigger the operation of a suspicious file imported into a preset sandbox, and monitor a first behavioral feature of the suspicious file; the first behavioral feature characterizes the operating behavior of the suspicious file during the operation; an operation status determination module, used to determine the operation status of an encryption algorithm according to the first behavioral feature and a preset second behavioral feature; the second behavioral feature characterizes the operating behavior during the operation of the encryption algorithm; a recording module, used to record encrypted data, encryption algorithm features and a key marking vector when the encryption algorithm operation status is that the encryption algorithm is running; an algorithm derivation module, used to determine a candidate encryption algorithm according to the encryption algorithm features; a decryption module, used to decrypt the encrypted data using the candidate encryption algorithm and the key marking vector.

[0023] An embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned method for processing a ransomware virus.

[0024] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein: Figure 1 It is a schematic diagram of a method for processing a ransomware virus provided in an embodiment of the present application; Figure 2 is a schematic diagram of a device for processing a ransomware virus provided in an embodiment of the present application; Figure 3 It is a schematic diagram of an electronic device provided in an embodiment of the present application.

[0026] Reference numerals: 1: Monitoring module; 2: Operation status determination module; 3: Recording module; 4: Algorithm derivation module; 5: Decryption module; 6: Bus; 7: Processor; 8: Memory; 9: Communication interface. DETAILED DESCRIPTION

[0027] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0028] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0029] Unless otherwise stated, the term "plurality" means two or more.

[0030] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0031] Embodiment 1 The present application provides a method for processing a ransomware virus. Figure 1 As shown, Figure 1 The basic flow chart of the method for processing a ransomware virus provided in the embodiment of the present application includes: Step S101, triggering the execution of a suspicious file imported into a preset sandbox, and monitoring a first behavior feature of the suspicious file.

[0032] The first behavior feature represents the operation behavior of the suspicious file during its operation, that is, the operation behavior generated when the suspicious file is running in the sandbox.

[0033] Among them, suspicious files are files that are assumed to carry ransomware. Suspicious files include executable files and script files. Suspicious files include applications.

[0034] The sandbox can be deployed on a local device or in the cloud.

[0035] For example, as an effective dynamic analysis tool, the sandbox can isolate and analyze untrusted applications in a virtualized environment, and provide behavioral analysis, encryption identification, and data recovery functions. Use the sandbox to build an isolated execution environment, import suspicious files into the sandbox, and trigger the suspicious files to run. At this point, the running status of the suspicious files can be monitored in real time through the sandbox's built-in system hooks and virtual machine monitor (VMM). The monitoring content includes but is not limited to process calls, system resource access, memory usage, network communications, and registry operations. Subsequently, it can be inferred whether the suspicious file is encrypted by analyzing the monitoring content, and how to decrypt and restore the encrypted data, thereby improving the response speed and processing capabilities to ransomware attacks.

[0036] Step S102: determining the operation status of the encryption algorithm according to the first behavior feature and the preset second behavior feature.

[0037] The second behavior feature characterizes the operation behavior during the operation of the encryption algorithm. For example, the second behavior feature can be obtained by engineers observing and counting the operation behaviors generated by different encryption algorithms during the encryption process.

[0038] In some embodiments, step S102 may include: determining a first target similarity between the first behavior feature and the second behavior feature; when the first target similarity is higher than a first preset similarity, confirming that the encryption algorithm operation status is that the encryption algorithm is running; otherwise, confirming that the encryption algorithm operation status is that the encryption algorithm is not running.

[0039] In an optional manner of the above embodiment, the first behavior feature includes: one or more behavior features of a target call instruction, a target memory access mode, a target function call chain, a target encryption duration, and a target encrypted file size. The behavior type of the second behavior feature is the same as the behavior type of the first behavior feature, and the sample similarity between the corresponding behavior types in the first behavior feature and the second behavior feature is calculated to determine the first target similarity.

[0040] Exemplarily, the first behavior feature includes: target call instruction, target memory access mode, target function call chain, target encryption duration and target encrypted file size. The second behavior feature includes: sample call instruction, sample memory access mode, sample function call chain, sample encryption duration and sample encrypted file size. Determining the first target similarity between the first behavior feature and the second behavior feature includes: calculating the first sample similarity between the target call instruction and the sample call instruction; calculating the second sample similarity between the target memory access mode and the sample memory access mode; calculating the third sample similarity between the target function call chain and the sample function call chain; calculating the fourth sample similarity between the target encryption duration and the sample encryption duration; calculating the fifth sample similarity between the target encrypted file size and the sample encrypted file size; determining the first target similarity according to the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity.

[0041] Among them, different encryption algorithms will call specific instruction sets during execution, and the calling instructions include encryption algorithm-specific instructions. Encryption algorithm-specific instructions are encryption algorithm-related function calls, specific encryption operators, etc. For example: S-Box (SubstitutionBox) operations and round function operations of AES (Advanced Encryption Standard), and large integer calculation instructions of RSA (an asymmetric encryption algorithm).

[0042] The function call chain may be a calling function sequence and parameters of an encryption algorithm.

[0043] The target encryption duration may be the execution duration of the encryption process of the encryption algorithm.

[0044] The target encrypted file size may be the file size processed during the encryption process of the encryption algorithm.

[0045] Among them, considering that encryption algorithms usually involve a large amount of memory reading and writing, the target memory access mode can be a memory mode when encrypting data. Exemplarily, since some encryption algorithms perform block encryption according to fixed-size data blocks, the target memory access mode can be a memory mode when encrypting block data.

[0046] In the above example, calculating the first sample similarity between the target call instruction and the sample call instruction may be: calculating the similarity between a first feature vector representing the target call instruction and a second feature vector representing the sample call instruction as the first sample similarity.

[0047] In the above example, calculating the second sample similarity between the target memory access pattern and the sample memory access pattern may be: calculating the similarity between the third feature vector representing the target memory access pattern and the fourth feature vector representing the sample memory access pattern as the second sample similarity.

[0048] In the above example, calculating the third sample similarity between the target function call chain and the sample function call chain may be: calculating the similarity between the fifth feature vector representing the target function call chain and the sixth feature vector representing the sample function call chain as the third sample similarity.

[0049] In the above example, calculating the fourth sample similarity between the target encryption duration and the sample encryption duration may be: calculating the similarity between the seventh feature vector representing the target encryption duration and the eighth feature vector representing the sample encryption duration as the fourth sample similarity.

[0050] In the above example, calculating the fifth sample similarity between the target encrypted file size and the sample encrypted file size may be: calculating the similarity between the ninth feature vector representing the target encrypted file size and the tenth feature vector representing the sample encrypted file size as the fifth sample similarity.

[0051] In the above example, determining the first target similarity according to the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity may be: taking the average similarity of the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity as the first target similarity.

[0052] In the above example, determining the first target similarity according to the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity can be: obtaining first weights corresponding to the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity, respectively, and weighting the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity according to the first weights to obtain the first target similarity.

[0053] Optionally, the first weights corresponding to the similarities of each sample may be recorded in advance in a similarity weight database.

[0054] Optionally, an existing algorithm for calculating the similarity between two feature vectors may be used, such as cosine similarity, Euclidean distance, etc., which will not be described in detail here.

[0055] In another exemplary embodiment, the first behavior feature includes: a target call instruction and a target memory access pattern. The second behavior feature includes: a sample call instruction and a sample memory access pattern. Determining the first target similarity between the first behavior feature and the second behavior feature includes: calculating a first sample similarity between the target call instruction and the sample call instruction; calculating a second sample similarity between the target memory access pattern and the sample memory access pattern; and calculating an average similarity between the first sample similarity and the second sample similarity as the first target similarity.

[0056] Step S103: When the encryption algorithm is running, the encrypted data, encryption algorithm characteristics and key marking vector are recorded.

[0057] The key tag vector may include encryption algorithm features and / or key features. Exemplarily, the key tag vector may be a vector formed by concatenating encryption algorithm features and / or key features. Encryption algorithm features include, for example, algorithm type, call instructions, encryption operation mode, key length, etc. Key features include, for example, certain bit patterns and transformation methods of the key.

[0058] Exemplarily, the encryption algorithm features and key features are concatenated according to the set feature types and feature sequences to form a key tag vector. The key tag vector is used to characterize the encryption algorithm features and key features in the encryption process. In this way, by recording the key tag vector, the key tag vector can provide a basis for subsequent data recovery and decryption processes.

[0059] In some embodiments, the first behavioral feature also includes: retrieving the file type; before determining the candidate encryption algorithm based on the encryption algorithm feature, it also includes: determining a first hazard metric value based on the key tag vector; determining a second hazard metric value based on the retrieved file type; backing up suspicious files based on the first hazard metric value and the second hazard metric value; stopping the execution of the suspicious file and running the backup file.

[0060] Among them, the search file type, such as: documents, pictures, databases, etc. The sandbox can monitor whether a specific file extension, such as: .doc, .xls, .pdf, etc., is called, so as to determine whether to search for a specific file type and which file type to search.

[0061] In an optional manner of the above embodiment, determining the first harm metric value based on the key tag vector may be: calculating the key similarity between the key tag vector and the sample tag vector in a preset first metric database, and taking the sample harm metric value of the sample tag vector corresponding to the highest key similarity as the first harm metric value.

[0062] The first metric database records the corresponding relationship between the sample label vector and the sample hazard metric value.

[0063] In another optional manner of the above embodiment, determining the first harm metric value according to the key marking vector may be: inputting the key marking vector into a first harm degree prediction model to obtain the first harm metric value corresponding to the key marking vector.

[0064] Optionally, a sample key labeling vector with a first harm metric value label may be obtained, and the sample key labeling vector with the first harm metric value label may be input into a preset first training model for training to obtain a first harm degree prediction model.

[0065] Among them, the first training model, for example: a neural network model, etc.

[0066] In an optional manner of the above embodiment, determining the second harm metric value according to the retrieved file type may be: searching for the second harm metric value corresponding to the retrieved file type in a preset second metric value database. The second metric value database stores the correspondence between the retrieved file type and the second harm metric value.

[0067] In another optional manner of the above embodiment, determining the second harm metric value according to the retrieved file type may be: inputting the retrieved file type into a second harm degree prediction model to obtain the second harm metric value corresponding to the retrieved file type.

[0068] Optionally, a sample retrieval file type with a second hazard metric value label may be obtained, and the sample retrieval file type with the second hazard metric value label may be input into a preset second training model for training to obtain a second hazard degree prediction model.

[0069] The second training model is, for example, a neural network model.

[0070] In an optional manner of the above embodiment, backing up the suspicious file according to the first hazard metric value and the second hazard metric value may be: determining a target metric value according to the first hazard metric value and the second hazard metric value. When the target metric value is greater than a preset metric value, backing up the suspicious file. When the target metric value is less than or equal to the preset metric value, determining that the suspicious file does not pose a ransomware threat.

[0071] Optionally, the sum of the first harm metric value and the second harm metric value is used as the target metric value.

[0072] Also optionally, second weights corresponding to the first hazard metric value and the second hazard metric value are obtained, and the first hazard metric value and the second hazard metric value are weighted according to the second weights to obtain a target hazard metric value.

[0073] Optionally, the second weights corresponding to the respective hazard metric values ​​may be recorded in advance in the hazard metric weight database, for example, the second weight of the first hazard metric value is 0.6, and the second weight of the second hazard metric value is 0.4.

[0074] In some embodiments, before determining the candidate encryption algorithm according to the encryption algorithm feature, the method further includes: sending the first behavior feature and the encryption algorithm feature to a preset decision client, and the decision client responds to the user's first decision instruction to feedback whether to back up the suspicious file. The first decision instruction is used to indicate whether to back up the suspicious file.

[0075] In this way, after backing up the suspicious file, the suspicious file is stopped and the backup file is run. This can continuously monitor the operation of the ransomware virus of the suspicious file while protecting the data of the suspicious file from further damage, providing data support for subsequent ransomware protection.

[0076] Optionally, when a ransomware attempts to delete or encrypt backup files, the sandbox can abort the operation or create an instant running snapshot save state to prevent further data damage.

[0077] Step S104, determining a candidate encryption algorithm according to encryption algorithm characteristics.

[0078] In some embodiments, the encryption algorithm characteristics may include one or more of: calling instructions, encryption operation mode, and key length.

[0079] Among them, encryption operation modes, for example: symmetric encryption, asymmetric encryption, group mode, etc.

[0080] For example, if the encryption operation mode is symmetric encryption, AES, DES (a symmetric encryption algorithm) may become candidate encryption algorithms. If asymmetric encryption is used, RSA may become a candidate encryption algorithm.

[0081] As another example, if the sandbox captures a block-level encryption mode, such as CBC (Cipher Block Chaining Mode) or ECB (Electronic Codebook Mode), encryption algorithms such as AES and DES that use this encryption operation mode may become candidate encryption algorithms.

[0082] Different encryption algorithms use different key lengths, but the key length of the same encryption algorithm is usually fixed. For example, AES uses 128-bit, 192-bit, or 256-bit keys, while RSA usually uses 1024-bit or 2048-bit keys.

[0083] Exemplarily, the encryption algorithm features include: calling instructions, encryption operation mode and key length. Determining the candidate encryption algorithm based on the encryption algorithm features may include: searching for the candidate encryption algorithm corresponding to the calling instructions, encryption operation mode and key length in a preset encryption algorithm database; the encryption algorithm database stores the corresponding relationship between the calling instructions, encryption operation mode, key length and the candidate encryption algorithm.

[0084] As another example, the encryption operation mode may be compared with the sample encryption operation modes in a preset encryption operation mode database to select a first sample encryption algorithm. The key length may be compared with the sample key length in a preset key length database to select a second sample encryption algorithm. The call instruction may be compared with the sample call instruction in a preset call instruction database to select a third sample encryption algorithm, and the same encryption algorithm among the first sample encryption algorithm, the second sample encryption algorithm and the third sample encryption algorithm may be determined as a candidate encryption algorithm.

[0085] The corresponding relationship between sample encryption operation modes and encryption algorithms is stored in the encryption operation mode database, the corresponding relationship between sample key lengths and encryption algorithms is stored in the key length database, and the corresponding relationship between sample call instructions and encryption algorithms is stored in the call instruction database.

[0086] Exemplarily, the electronic device first filters possible encryption algorithms based on the encryption operation mode observed in the sandbox. For example, if the sandbox captures a block-level encryption mode, such as CBC or ECB, the candidate encryption algorithms will be narrowed down to encryption algorithms that use this mode, such as AES, DES, etc. Then, based on the key length extracted by the sandbox, the encryption algorithms are further screened as candidate encryption algorithms. For example, if the key length used by the virus is 256 bits, AES and other symmetric encryption algorithms (such as Blowfish) may be candidate encryption algorithms. Then, the call instructions recorded by the sandbox are compared with the sample call instructions preset in the encryption algorithm database. If there are S-Box lookups, round function operations, etc. in the call instructions, AES can be used as a candidate encryption algorithm. Through the above comparison, a set of candidate encryption algorithms can be derived.

[0087] In another exemplary embodiment, the encryption algorithm features include: a call instruction, an encryption operation mode, and a key length. Determining a candidate encryption algorithm based on the encryption algorithm features may include: inputting the call instruction, the encryption operation mode, and the key length into an encryption algorithm prediction model to obtain a candidate encryption algorithm corresponding to the call instruction, the encryption operation mode, and the key length.

[0088] Optionally, sample encryption algorithm features with candidate encryption algorithm labels are obtained, and the sample encryption algorithm features with candidate encryption algorithm labels are input into a preset third training model for training to obtain an encryption algorithm prediction model.

[0089] Among them, the third training model, for example: a neural network model, etc.

[0090] Step S105: decrypt the encrypted data using the candidate encryption algorithm and the key tag vector.

[0091] In some embodiments, there are multiple candidate encryption algorithms, and step S105 may include: sending the candidate encryption algorithm to a preset decision client, the decision client selects a candidate encryption algorithm for decryption in response to the user's second decision instruction, and decrypts the encrypted data using the candidate encryption algorithm and key marking vector fed back by the decision client.

[0092] In some embodiments, there are multiple candidate encryption algorithms, and step S105 may include: determining the priority of each candidate encryption algorithm according to the calling instruction, encryption operation mode and key length; and decrypting the encrypted data using the candidate encryption algorithm and the key marking vector according to the priority.

[0093] In an optional method of the above embodiment, the priority of each candidate encryption algorithm is determined according to the calling instruction, encryption operation mode and key length, which can be: searching the priority corresponding to the calling instruction, encryption operation mode and key length in a preset priority database; the priority database stores the correspondence between the calling instruction, encryption operation mode, key length and priority.

[0094] In some embodiments, after decrypting the encrypted data using the candidate encryption algorithm and the key marking vector, the method further includes: verifying whether the decrypted data satisfies a first preset condition; the first preset condition satisfies at least one of the following: the file format of the decrypted data is the same as that of the encrypted data, the file structure of the decrypted data is the same as that of the encrypted data, the content of the decrypted data is the same as that of the encrypted data before encryption, and the decrypted data can be executed normally; if the decrypted data satisfies the first preset condition, the decryption is confirmed to be successful; otherwise, the decryption is confirmed to have failed.

[0095] Among them, file formats, such as text, pictures, compressed packages, etc.

[0096] The file structure refers to the organization and arrangement of data within the file, describing the composition of the various parts in the file and the relationship between the various parts, such as sequential files, index files, etc.

[0097] Among them, hash comparison can be used to verify whether the content of the decrypted data is the same as the content of the encrypted data before encryption.

[0098] The executable file can be started to determine whether the decrypted data can be executed normally. If the executable file can be started normally, the decrypted data can be executed normally; otherwise, the decrypted data cannot be executed normally.

[0099] In some embodiments, there are multiple encrypted data; the method further includes: reorganizing the decrypted data corresponding to each encrypted data to obtain reorganized data; and verifying whether the reorganized data meets the second preset condition. If the reorganized data meets the second preset condition, the reorganization is confirmed to be successful, and the candidate encryption algorithm and key tag vector that are successfully decrypted are recorded; otherwise, the reorganization is confirmed to be unsuccessful.

[0100] The second preset condition includes: whether the hash value of the reorganized data is consistent with the hash value of the suspicious file, and whether the file format of the reorganized data is consistent with the file format of the suspicious file.

[0101] For example, for different types of files such as image files, compressed files, and text files, the following methods can be used to verify whether the file format meets expectations. For example, if it is an image file, the header identifier and pixel data of the image file are detected. If it is a database file, the table structure and field data of the database are detected.

[0102] In this way, the hash value of the decrypted data is calculated and compared with the hash value of the original data. The integrity and consistency of the data before and after decryption can be ensured through hash verification, avoiding data loss or damage during the decryption and reorganization process. The integrity and consistency of the data can be further ensured by judging the file format.

[0103] In an optional manner of the above embodiment, the sandbox may record the position and order of each encrypted data. Recombining the decrypted data corresponding to each encrypted data to obtain the recombined data may be: recombining the decrypted data according to the recorded position and order of the encrypted data to obtain the recombined data.

[0104] In another optional manner of the above embodiment, the decrypted data corresponding to each encrypted data is reassembled to obtain the reassembled data, which may be: reading the file header information of each encrypted data, reassembling the decrypted data according to the file header information, and obtaining the reassembled data. The file header information includes the order of the encrypted data.

[0105] Exemplarily, some file formats, such as images, videos, databases, etc., have file header information. The file header information includes information such as the structure of the file, the order of data blocks, and data types. The correct order of data blocks can be identified by reading the header information.

[0106] In this way, once the order of different encrypted data is correctly determined, each decrypted data block can be merged into a complete file or data. For example, if an image file is encrypted in multiple data blocks, the system will splice them according to the width, length and order of each data block to restore the complete image.

[0107] In some embodiments, for certain file types, such as compressed packages, database files, etc., it is also necessary to parse the file format and restore the file content according to the file format requirements. For example, each data block in a compressed file may be a compressed part, and the decrypted data blocks will be decompressed and merged to ensure the correctness of the data.

[0108] For example, each encryption algorithm has a specific instruction sequence. When running, the program will call the specific instructions of these encryption algorithms, such as using the encryption instructions of the CPU (processor) or calling encryption functions through the library. And these instructions will show a series of behavioral characteristics, such as specific opcodes, memory access modes, data processing methods, etc. A set of behavioral characteristics can be preset in the sandbox. When the ransomware is executed in the sandbox, its code execution is monitored, and the behavioral characteristics such as instructions, data operations, and memory changes called during the actual execution process are captured, and these characteristics are matched with the instruction sets of known encryption algorithms preset in the sandbox and the code behavior characteristics when running the encryption algorithm. Algorithm matching and feature similarity measurement are used to determine whether there is sufficient evidence to show that a certain encryption algorithm is running. After identifying the encryption behavior, the sandbox derives the possible encryption algorithm type, that is, the candidate encryption algorithm, by analyzing the encryption mode and key length used in the application. A pre-built encryption algorithm database is used in the process of deriving candidate encryption algorithms. The encryption algorithm database contains encryption algorithm features such as calling instructions, encryption operation modes, and key lengths of common encryption algorithms. The sandbox compares these features with the behavior of the ransomware to form a series of candidate encryption algorithms.

[0109] After the candidate encryption algorithms are derived, the sandbox administrator can manually select from the derived candidate encryption algorithms, or select the most suitable candidate encryption algorithm based on the priority. Then, the sandbox accesses and reads the encrypted data in the saved snapshot, and calls the candidate encryption algorithm to decrypt the encrypted data. During the decryption process, a block-level data decryption verification mechanism is adopted. After the encrypted data is decrypted one by one using the candidate encryption algorithm using the recorded key tag vector, it is also necessary to confirm whether the decrypted data conforms to the expected format or content, so as to determine the correctness of the decryption algorithm. After determining that the decryption algorithm is correct, the sandbox will recover the damaged data through segmented decryption and reassembly technology. Since the ransomware may use different encryption algorithms or keys for different files or data blocks, the encrypted data blocks can be processed segment by segment, and each segment of the encrypted data can be decrypted. The decrypted data is reassembled to restore it to the original data structure. At the same time, the reassembled data is verified to ensure the integrity and consistency of the reassembled data. After the data is successfully reassembled, the sandbox can also record the key and candidate encryption algorithm used for decryption and generate a key algorithm mapping table. This mapping table will be used for the prevention of similar attacks and data recovery in the future. At the same time, the sandbox can also encrypt and store the recorded keys to prevent them from being leaked.

[0110] After completing data decryption and recovery, the sandbox can also allow the ransomware to continue executing until all its encryption actions are completed. At this point, the sandbox can record the complete attack process of the ransomware, including but not limited to encryption methods, network communications, attack targets and other information, and store this data in the threat intelligence database to provide a basis for subsequent threat intelligence analysis and defense strategies.

[0111] Embodiment 2 Based on the same inventive concept, the present application embodiment provides a device for processing a ransomware virus, such as Figure 2 As shown, the device for processing ransomware includes: a monitoring module 1, an operation status determination module 2, a recording module 3, an algorithm derivation module 4 and a decryption module 5. Among them, the monitoring module 1 is used to trigger the operation of a suspicious file imported into a preset sandbox and monitor the first behavior feature of the suspicious file; the first behavior feature represents the operation behavior of the suspicious file during the operation; the operation status determination module 2 is used to determine the operation status of the encryption algorithm according to the first behavior feature and the preset second behavior feature; the second behavior feature represents the operation behavior during the operation of the encryption algorithm; the recording module 3 is used to record the encrypted data, the encryption algorithm feature and the key marking vector when the encryption algorithm operation status is that the encryption algorithm is running; the algorithm derivation module 4 is used to determine the candidate encryption algorithm according to the encryption algorithm feature; the decryption module 5 is used to decrypt the encrypted data using the candidate encryption algorithm and the key marking vector.

[0112] In some embodiments, the operation status determination module 2 is used to determine the operation status of the encryption algorithm based on the first behavior feature and the preset second behavior feature in the following manner: determine the first target similarity between the first behavior feature and the second behavior feature; when the first target similarity is higher than the first preset similarity, confirm that the encryption algorithm operation status is that the encryption algorithm is running; otherwise, confirm that the encryption algorithm operation status is that the encryption algorithm is not running.

[0113] In some embodiments, the first behavioral feature includes: target call instructions, target memory access mode, target function call chain, target encryption duration and target encrypted file size; the second behavioral feature includes: sample call instructions, sample memory access mode, sample function call chain, sample encryption duration and sample encrypted file size; the operation status determination module 2 is used to determine the first target similarity between the first behavioral feature and the second behavioral feature in the following manner: calculate the first sample similarity between the target call instruction and the sample call instruction; calculate the second sample similarity between the target memory access mode and the sample memory access mode; calculate the third sample similarity between the target function call chain and the sample function call chain; calculate the fourth sample similarity between the target encryption duration and the sample encryption duration; calculate the fifth sample similarity between the target encrypted file size and the sample encrypted file size; determine the first target similarity based on the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity and the fifth sample similarity.

[0114] In some embodiments, the first behavioral feature also includes: retrieving the file type; the device for processing the ransomware virus also includes: a backup module, which is used to determine a first hazard measurement value based on a key marking vector before determining a candidate encryption algorithm based on the encryption algorithm characteristics; determine a second hazard measurement value based on the retrieved file type; back up suspicious files based on the first hazard measurement value and the second hazard measurement value; stop running suspicious files and run backup files.

[0115] In some embodiments, the encryption algorithm characteristics include: calling instructions, encryption operation mode and key length; the algorithm derivation module 4 is used to determine the candidate encryption algorithm according to the encryption algorithm characteristics in the following manner: searching for the candidate encryption algorithm corresponding to the calling instructions, encryption operation mode and key length in a preset encryption algorithm database; the encryption algorithm database stores the correspondence between the calling instructions, encryption operation mode, key length and candidate encryption algorithms.

[0116] In some embodiments, there are multiple candidate encryption algorithms, and the decryption module 5 is used to decrypt the encrypted data using the candidate encryption algorithms and the key marking vector in the following manner: determine the priority of each candidate encryption algorithm according to the calling instruction, the encryption operation mode and the key length; and decrypt the encrypted data using the candidate encryption algorithm and the key marking vector according to the priority.

[0117] In some embodiments, the device for processing ransomware also includes: a verification module, which is used to decrypt the encrypted data using a candidate encryption algorithm and a key marking vector, and then verify whether the decrypted data meets a first preset condition; the first preset condition satisfies at least one of the following: the file format of the decrypted data is the same as that of the encrypted data, the file structure of the decrypted data is the same as that of the encrypted data, the content of the decrypted data is the same as the content of the encrypted data before encryption, and the decrypted data can be executed normally; if the decrypted data meets the first preset condition, the decryption is confirmed to be successful; otherwise, the decryption is confirmed to have failed.

[0118] In some embodiments, there are multiple encrypted data; the device for processing ransomware also includes: a reorganization module, used to reorganize the decrypted data corresponding to each encrypted data to obtain reorganized data; verify whether the reorganized data meets the second preset condition; the second preset condition includes: whether the hash value of the reorganized data is consistent with the hash value of the suspicious file; whether the file format of the reorganized data is consistent with the file format of the suspicious file; if the reorganized data meets the second preset condition, the reorganization is confirmed to be successful, and the candidate encryption algorithm and key marking vector that are successfully decrypted are recorded; otherwise, the reorganization is confirmed to have failed.

[0119] It can be understood that the various embodiments described in the first embodiment are also applicable to the second embodiment if there is no conflict. Based on the consideration of brevity of description, they will not be repeated here.

[0120] Embodiment 3 Combination Figure 3 As shown, an embodiment of the present application provides an electronic device, including a processor 7 and a memory 8. Optionally, the device may also include a communication interface 9 and a bus 6. Among them, the processor 7, the communication interface 9, and the memory 8 can communicate with each other through the bus 6. The communication interface 9 can be used for information transmission. The processor 7 can call the logic instructions in the memory 8 to execute the method for processing the ransomware virus of the above embodiment.

[0121] In addition, the logic instructions in the memory 8 mentioned above can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0122] The memory 8 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 7 executes the function application and data processing by running the program instructions / modules stored in the memory 8, that is, the method for processing the ransomware virus in the above embodiment is implemented.

[0123] The memory 8 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 8 may include a high-speed random access memory and may also include a non-volatile memory.

[0124] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the above-mentioned method for processing a ransomware virus.

[0125] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned method for processing a ransomware virus.

[0126] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0127] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method of the embodiment of the present application. The aforementioned storage medium may be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, and other media that can store program codes, or a transient storage medium.

[0128] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0129] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application. At the same time, the above embodiments can be combined with each other to form new embodiments without conflict.

Claims

1. A method for processing a ransomware virus, characterized in that: include: Triggering the execution of a suspicious file imported into a preset sandbox, and monitoring a first behavioral feature of the suspicious file; The first behavior feature represents the operation behavior of the suspicious file during operation; The suspicious file is a file that is assumed to carry a ransomware virus; Determine the operation status of the encryption algorithm according to the first behavior feature and a preset second behavior feature; the second behavior feature represents the operation behavior during the operation of the encryption algorithm; When the encryption algorithm operation condition is that the encryption algorithm is running, recording the encrypted data, encryption algorithm characteristics and key marking vector; Determining a candidate encryption algorithm according to the encryption algorithm characteristics; The encrypted data is decrypted using the candidate encryption algorithm and the key signature vector.

2. The method according to claim 1, characterized in that Determining the operation status of the encryption algorithm according to the first behavior feature and the preset second behavior feature includes: determining a first target similarity between the first behavior feature and the second behavior feature; When the first target similarity is higher than the first preset similarity, the encryption algorithm operation status is confirmed as the encryption algorithm is running; otherwise, the encryption algorithm operation status is confirmed as the encryption algorithm is not running.

3. The method according to claim 2, characterized in that The first behavior feature includes: target call instructions, target memory access mode, target function call chain, target encryption duration and target encrypted file size; the second behavior feature includes: sample call instructions, sample memory access mode, sample function call chain, sample encryption duration and sample encrypted file size; determining the first target similarity between the first behavior feature and the second behavior feature includes: Calculating a first sample similarity between the target call instruction and the sample call instruction; Calculating a second sample similarity between the target memory access pattern and the sample memory access pattern; Calculating a third sample similarity between the target function call chain and the sample function call chain; Calculating a fourth sample similarity between the target encryption duration and the sample encryption duration; calculating a fifth sample similarity between the target encrypted file size and the sample encrypted file size; The first target similarity is determined according to the first sample similarity, the second sample similarity, the third sample similarity, the fourth sample similarity, and the fifth sample similarity.

4. The method according to claim 1, characterized in that: The first behavior feature further includes: retrieving the file type; before determining the candidate encryption algorithm according to the encryption algorithm feature, the method further includes: determining a first compromise metric value based on the key signature vector; determining a second harm metric value based on the retrieved file type; backing up the suspicious file according to the first harm metric value and the second harm metric value; Stop running the suspicious file and run the backup file.

5. The method according to claim 1, characterized in that The encryption algorithm features include: calling instructions, encryption operation mode and key length; determining a candidate encryption algorithm according to the encryption algorithm features includes: The candidate encryption algorithm corresponding to the calling instruction, the encryption operation mode and the key length is searched in a preset encryption algorithm database; the encryption algorithm database stores the corresponding relationship between the calling instruction, the encryption operation mode, the key length and the candidate encryption algorithm.

6. The method according to claim 5, characterized in that There are a plurality of candidate encryption algorithms, and decrypting the encrypted data using the candidate encryption algorithms and the key tag vector comprises: Determine the priority of each of the candidate encryption algorithms according to the calling instruction, the encryption operation mode and the key length; The encrypted data is decrypted using the candidate encryption algorithm and the key tag vector according to the priority.

7. The method according to any one of claims 1 to 6, characterized in that: After decrypting the encrypted data using the candidate encryption algorithm and the key tag vector, the method further includes: Verify whether the decrypted data meets a first preset condition; the first preset condition meets at least one of the following: the file format of the decrypted data is the same as that of the encrypted data, the file structure of the decrypted data is the same as that of the encrypted data, the content of the decrypted data is the same as that of the encrypted data before encryption, and the decrypted data can be executed normally; If the decrypted data meets the first preset condition, the decryption is confirmed to be successful; otherwise, the decryption is confirmed to be unsuccessful.

8. The method according to claim 7, characterized in that There are multiple encrypted data; the method also includes: Recombining the decrypted data corresponding to each of the encrypted data to obtain recombined data; Verify whether the reorganized data meets a second preset condition; the second preset condition includes: whether the hash value of the reorganized data is consistent with the hash value of the suspicious file, and whether the file format of the reorganized data is consistent with the file format of the suspicious file; If the reorganized data meets the second preset condition, the reorganization is confirmed to be successful, and the candidate encryption algorithm and the key marking vector that are successfully decrypted are recorded; otherwise, the reorganization is confirmed to be unsuccessful.

9. A device for processing a ransomware virus, characterized in that: include: A monitoring module, used for triggering the execution of a suspicious file imported into a preset sandbox and monitoring a first behavior feature of the suspicious file; The first behavior feature represents the operation behavior of the suspicious file during operation; An operation status determination module, used to determine the operation status of the encryption algorithm according to the first behavior feature and a preset second behavior feature; the second behavior feature represents the operation behavior during the operation of the encryption algorithm; A recording module, used for recording encrypted data, encryption algorithm characteristics and key marking vector when the encryption algorithm operation condition is that the encryption algorithm is running; An algorithm derivation module, used to determine a candidate encryption algorithm according to the encryption algorithm characteristics; A decryption module is used to decrypt the encrypted data using the candidate encryption algorithm and the key marking vector.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the method for processing a ransomware virus according to any one of claims 1 to 8.

Images