Ransomware detection method and device, storage medium and computer program product

Abstract

The invention discloses a ransomware detection method and device, a storage medium and a computer program product, and relates to the technical field of computers.The method comprises the steps that a target file directory needing to be monitored is determined, and file type distribution information of the target file directory is obtained; wherein the file type distribution information comprises the types of the files contained in the target file directory and the distribution proportion of each type of files; and acquiring a bait file, and spraying the bait file to the target file directory based on the file type distribution information to realize detection of the ransomware virus. According to the method, the file type distribution information of the target file directory is dynamically acquired, and the bait file is accurately sprayed to the target directory according to the file type distribution information, so that the type and the distribution proportion of the bait file are highly consistent with the real file environment of the user system, the concealment of the bait file is improved, and the user experience is improved. Ransomware identification is avoided, bait files are avoided, and the accuracy and reliability of ransomware detection are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a ransomware virus detection method and device, a storage medium, and a computer program product. Background Art

[0002] Ransomware is a common type of malware, the main feature of which is that it encrypts user files, making them unable to access or modify them, thereby forcing users to pay a ransom to unlock the files. Currently, ransomware detection technology mainly relies on the delivery and monitoring of bait files, and identifies the presence of ransomware by detecting whether the bait files are encrypted or manipulated. However, in related technologies, the concealment of bait files is low, resulting in a high probability that the ransomware will identify the bait files.

[0003] Therefore, how to improve the concealment of bait files, thereby reducing the possibility of ransomware identifying bait files, is a technical problem that those skilled in the art need to solve. Summary of the invention

[0004] The present invention provides a ransomware virus detection method and device, a storage medium and a computer program product, which improve the concealment of bait files, thereby reducing the possibility of ransomware viruses identifying bait files.

[0005] The present invention provides a method for detecting a ransomware virus, comprising:

[0006] Determine the target file directory to be monitored, and obtain file type distribution information of the target file directory; wherein the file type distribution information includes the types of files contained in the target file directory and the distribution ratio of each type of files;

[0007] Obtain bait files and spray them to the target file directory based on file type distribution information;

[0008] If an operation on the bait file is detected, the process performing the operation is determined to be a ransomware process, and the ransomware process is processed according to a preset monitoring strategy.

[0009] The present invention also provides a ransomware virus detection device, comprising:

[0010] The first acquisition module is used to determine the target file directory to be monitored and obtain the file type distribution information of the target file directory; wherein the file type distribution information includes the types of files contained in the target file directory and the distribution ratio of each type of files;

[0011] A spraying module, used to obtain bait files and spray the bait files to the target file directory based on file type distribution information;

[0012] The processing module is used to determine that the process performing the operation is a ransomware process when an operation on a bait file is detected, and to process the ransomware process according to a preset monitoring strategy.

[0013] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned ransomware virus detection methods when executing the computer program.

[0014] The present invention also provides a computer-readable storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned ransomware virus detection methods are implemented.

[0015] The present invention also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned ransomware virus detection methods when executed by a processor.

[0016] The beneficial effects of the present invention are as follows: the ransomware virus detection method provided by the present invention dynamically obtains the file type distribution information of the target file directory, and accurately sprays the bait file to the target directory according to the file type distribution information, so that the type and distribution ratio of the bait file are highly consistent with the real file environment of the user system. This design not only effectively improves the concealment of the bait file, avoids the ransomware virus from identifying and avoiding the bait file, but also significantly enhances the accuracy and reliability of the ransomware virus detection. At the same time, by real-time monitoring of the operation behavior of the bait file and quickly identifying the ransomware virus process, combined with the preset monitoring strategy for targeted processing, the present invention can timely prevent the destructive behavior of the ransomware virus and protect the security of the user system and data. The present invention also discloses a ransomware virus detection device and an electronic device, a computer-readable storage medium and a computer program product, which can also achieve the above-mentioned technical effects.

[0017] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 The present invention is a flowchart of a method for detecting a ransomware virus according to an exemplary embodiment;

[0020] Figure 2The present invention is a flowchart of a bait file updating method according to an exemplary embodiment;

[0021] Figure 3 The present invention is a framework diagram of a ransomware intrusion detection system according to an exemplary embodiment;

[0022] Figure 4 The present invention is a flowchart of bait document spraying according to an exemplary embodiment;

[0023] Figure 5 A whitelist determination flow chart according to an exemplary embodiment is shown;

[0024] Figure 6 The present invention is a flowchart of an ePBF ransomware monitoring function according to an exemplary embodiment;

[0025] Figure 7 A flowchart of updating a bait file is shown according to an exemplary embodiment;

[0026] Figure 8 The present invention is a structural diagram of a ransomware virus detection device according to an exemplary embodiment;

[0027] Fig. 9 The figure is a structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] It should be noted that, in the description of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0031] An embodiment of the present invention provides a ransomware virus detection method, and the method is described in detail in conjunction with the execution process of the ransomware virus detection method.

[0032] See also Figure 1 , according to an exemplary embodiment, a flowchart of a method for detecting a ransomware virus is shown, such as Figure 1 As shown, including:

[0033] S101: Determine a target file directory to be monitored, and obtain file type distribution information of the target file directory; wherein the file type distribution information includes the types of files contained in the target file directory and the distribution ratio of each type of files;

[0034] The target file directory refers to the file storage directory in the user system that needs to be detected for ransomware, such as / home, / opt or other custom directories. File type distribution information refers to the statistical information of different types of files in the target file directory, including the file type and the distribution ratio of each type of file in the directory.

[0035] In this step, the target file directory is traversed through the system scanning tool or file analysis module, the types and numbers of all files in the directory are counted, and then the distribution ratio of each type of file is calculated. For example, using the Linux system command or script tool to scan the / home directory, it is counted that there are 100 .txt files, 300 .db files, and a total of 400 files, so it is concluded that .txt files account for 25% and .db files account for 75%.

[0036] This step provides an accurate basis for the subsequent generation and delivery of bait files, so that the bait files can highly match the actual file type distribution of the target directory, thereby effectively reducing the possibility of ransomware identifying bait files and improving the concealment and accuracy of detection.

[0037] S102: obtaining a bait file, and spraying the bait file to a target file directory based on file type distribution information;

[0038] Among them, bait files refer to fake files used to lure ransomware to operate, and their purpose is to identify the existence of ransomware by detecting the operation of bait files. Spraying refers to placing bait files in the target file directory according to specific distribution rules, mixing them with real files, and increasing the probability of ransomware triggering detection.

[0039] In this step, based on the file type distribution information obtained in the previous step, a decoy file with the same file type distribution as the target file directory is generated or obtained. For example, if the target directory contains 75% .db files and 25% .txt files, a corresponding number of .db and .txt decoy files are generated or obtained according to the proportions, and they are randomly or regularly placed in the target file directory.

[0040] By accurately matching the file type distribution of the target directory, the bait file can be better disguised as a real file, reducing the risk of being identified by the ransomware virus. At the same time, the dynamic spraying mechanism makes the distribution of bait files more natural, further improving the concealment and effectiveness of detection.

[0041] As a feasible implementation method, after determining the target file directory that needs to be monitored, it also includes: obtaining overall file type distribution information; wherein the overall file type distribution information includes the total number of files contained in all target file directories, the file type, and the overall distribution ratio of each type of file; accordingly, obtaining bait files, and spraying the bait files to the target file directory based on the file type distribution information, including: obtaining a target number of bait files based on the overall file type distribution information; wherein the target number is the product of the total number and a preset ratio, and the distribution ratio of each type of file in the obtained target number of bait files conforms to the overall distribution ratio; spraying bait files to each target file directory based on the file type distribution information of each target file directory.

[0042] Among them, the overall file type distribution information refers to the comprehensive statistical information of the files in all target file directories, including the total number of files, file types, and the distribution ratio of each file type in the entire system. For example, there are 1,000 files in all target file directories, of which .txt files account for 30%, .db files account for 50%, and .py files account for 20%. The target number refers to the total number of bait files calculated based on the overall file type distribution information, which is usually the product of the total number of files in all target file directories and the preset ratio. For example, if the total number of files in all target file directories is 1,000 and the preset ratio is 10%, the target number is 100. The preset ratio refers to the ratio of bait files to real files preset by the system, which is used to control the density of bait file placement. For example, a preset ratio of 10% means that the number of bait files is 10% of the number of real files. The overall distribution ratio refers to the distribution ratio of each file type in the entire system, for example, .txt files account for 30%, .db files account for 50%, and .py files account for 20%.

[0043] In the specific implementation, firstly, all target file directories are scanned, the number of files and file types in each directory are counted, and this information is summarized to calculate the overall file type distribution ratio. For example, the system scans the / home, / opt, and / var directories, and the total number of files is counted as 1000, of which 300 are .txt files, 500 are .db files, and 200 are .py files. The overall distribution ratio is 30% for .txt, 50% for .db, and 20% for .py. Secondly, the total number of bait files is calculated according to a preset ratio (for example, 10%). If the total number of files is 1000 and the preset ratio is 10%, the target number is 100. Then, the target number of bait files is generated or obtained according to the overall distribution ratio. For example, 30 .txt bait files, 50 .db bait files, and 20 .py bait files are generated to meet the overall distribution ratio. Finally, according to the file type distribution information of each target file directory, the bait files are distributed to each directory in proportion. For example, if .txt files account for a high proportion in the / home directory, more .txt bait files will be allocated to the / home directory; if .db files account for a large proportion in the / opt directory, more .db bait files will be allocated to the / opt directory.

[0044] For example, suppose an enterprise server system contains multiple target file directories that need to be monitored, such as / home (user documents), / opt (database files), and / var (log files). The system scans and finds that: the / home directory has 400 files, of which .txt accounts for 70% and .docx accounts for 30%; the / opt directory has 300 files, of which .db accounts for 80% and .log accounts for 20%; the / var directory has 300 files, of which .log accounts for 60% and .conf accounts for 40%. The overall file type distribution is: .txt accounts for 28%, .docx accounts for 12%, .db accounts for 24%, .log accounts for 24%, and .conf accounts for 12%. The total number of files is 1000, the preset ratio is 10%, and the target number is 100. According to the overall distribution ratio, 28 .txt bait files, 12 .docx bait files, 24 .db bait files, 24 .log bait files, and 12 .conf bait files are generated. Then, according to the file type distribution of each target file directory, these decoy files are distributed to various directories to ensure that the type and proportion of decoy files in each target file directory are highly matched with the real files.

[0045] By generating and spraying bait files based on the overall file type distribution information, we ensure that the type and proportion of the bait files are highly consistent with the real files in the system, reducing the possibility of ransomware identifying the bait files. By calculating the target number through the overall distribution ratio and the preset ratio, we can achieve precise control of the density of bait file placement, which can effectively cover the file types in the system without affecting system performance due to too many bait files. The bait file placement strategy not only considers the file type distribution of a single directory, but also takes into account the file type distribution of the entire system, making it easier for ransomware to trigger detection globally, improving the comprehensiveness and accuracy of detection.

[0046] It should be noted that this embodiment does not limit the method for obtaining the bait file, and the bait file can be obtained through a local library, or dynamically generated and distributed from a remote server.

[0047] As a feasible implementation method, obtaining the bait file includes: obtaining the bait file from a local bait file library.

[0048] The local bait file library refers to a collection of bait files stored in the local system. These files are pre-generated and saved locally for ransomware virus detection. In the specific implementation, the required bait files are directly selected and obtained from the locally stored bait file library. The types and quantities of these files can be dynamically adjusted according to the file type distribution information of the target file directory.

[0049] Directly obtain bait files from the local computer without interacting with the remote server, which reduces the acquisition time and improves the detection efficiency. It is suitable for situations where there is no network connection or the network is unstable, ensuring that the system can still detect ransomware when it is offline. It reduces system complexity and reduces dependence on the network and remote servers, which is suitable for scenarios with high real-time requirements.

[0050] As another feasible implementation method, obtaining the bait file includes: the ransomware detection module sends a request for obtaining the bait file to a remote server; receiving a remote attestation challenge sent by the remote server, and generating remote attestation information based on the remote attestation challenge; sending the remote attestation information to the remote server so that the remote server verifies that the ransomware detection module is running in a trusted execution environment; establishing a secure channel with the remote server, and obtaining the bait file from the remote server through the secure channel.

[0051] The remote server refers to an external server that provides bait files, which usually has the ability to dynamically generate and distribute bait files. The remote attestation challenge refers to a verification request initiated by the remote server, which is used to verify whether the ransomware detection module is running in a trusted execution environment. Trusted Execution Environment (TEE) is a secure execution environment that ensures that code and data are not tampered with or leaked during operation. A secure channel refers to an encrypted communication link established through an encrypted communication protocol to ensure the security of data transmission.

[0052] In a specific implementation, the ransomware detection module sends a request to obtain a bait file to a remote server. The remote server sends a remote attestation challenge containing a random number. The ransomware detection module obtains the measurement value of the trusted execution environment based on the random number, and signs the measurement value with a private key to generate remote attestation information. The remote attestation information is sent to the remote server, which verifies the signature and compares the measurement value with the reference value. After the verification is passed, the ransomware detection module establishes a secure channel with the remote server and obtains the bait file through the channel.

[0053] As a feasible implementation method, a remote attestation challenge sent by a remote server is received, and remote attestation information is generated based on the remote attestation challenge, including: receiving a remote attestation challenge sent by a remote server; wherein the remote attestation challenge includes a random number; obtaining a measurement value of a trusted execution environment based on the random number, signing the measurement value using a private key generated by the trusted execution environment, and generating remote attestation information based on the signed measurement value; accordingly, the remote server verifies the signature of the measurement value in the remote attestation information, and compares whether the measurement value in the remote attestation information is consistent with a pre-stored reference value. If the signature verification passes and the measurement value is consistent with the reference value, the ransomware detection module runs in the trusted execution environment.

[0054] The measurement value is generated by the trusted execution environment, which can describe the current running status of the trusted execution environment and is used to verify the integrity and security of the trusted execution environment. Signature refers to the encryption of data using a private key to verify the integrity and source of the data.

[0055] In a specific implementation, the ransomware detection module receives a remote attestation challenge containing a random number sent by a remote server. Based on the random number, the measurement value of the trusted execution environment is obtained. The measurement value is signed using a private key generated by the trusted execution environment. The signed measurement value generates remote attestation information and is sent to the remote server. The remote server verifies the signature and compares the measurement value with a pre-stored reference value. If the verification is successful, it is confirmed that the ransomware detection module is running in the trusted execution environment.

[0056] Through the remote attestation mechanism, the ransomware detection module is ensured to run in a trusted execution environment to prevent the ransomware detection module from being maliciously tampered with or attacked. A trust relationship is established between the remote server and the ransomware detection module to ensure the security of subsequent communications and file transfers.

[0057] As a feasible implementation method, after the remote server verifies that the ransomware detection module is running in a trusted execution environment, it also includes: negotiating a key with the remote server based on remote certification information; correspondingly, after obtaining a bait file from the remote server through a secure channel, it also includes: performing signature verification on the obtained bait file based on the public key generated by the remote server to verify the legitimacy of the bait file.

[0058] Among them, the public key refers to the key used to verify the signature, which is used in pairs with the private key. Signature verification refers to verifying the integrity and source of the signature data through the public key to ensure that the data has not been tampered with.

[0059] In the specific implementation, after verifying that the ransomware detection module runs in a trusted execution environment, the remote server negotiates a key with the detection module based on the remote proof information. The ransomware detection module obtains the bait file from the remote server through a secure channel. The ransomware detection module uses the public key generated by the remote server to perform signature verification on the obtained bait file to ensure the legitimacy of the bait file.

[0060] The signature verification mechanism ensures that the bait file has not been tampered with and the source is reliable, preventing malicious file injection. Public key encryption technology is used to ensure the security and integrity of the file transmission process.

[0061] As a preferred implementation, after the bait files are sprayed to the target file directory, the method further includes: modifying the properties of the bait files sprayed to the target file directory according to the property information of the non-bait files in the target file directory.

[0062] Among them, attribute information refers to the metadata of the file, including the file's permissions, owner, user group, last access time (atime), last modification time (mtime), last change time (ctime), etc.

[0063] In the specific implementation, after placing the bait file in the target file directory, the system scans the non-bait files (real files) in the target directory. The attribute information of the non-bait files is obtained, including file permissions, owners, user groups, access time, etc. According to the attribute information of the non-bait files, the corresponding attributes of the bait files are modified to make them highly consistent with the attributes of the real files.

[0064] For example, the cat process is used to update the last access time, the vi process is used to update the last modification time and the last change time, and the partial content value of the bait file is updated. The chmod, chown, and chgrp processes are used to update the permissions of the bait file, the file owner, and the user group to which the file belongs.

[0065] By modifying the properties of the bait file to make it highly consistent with the real file, the possibility of ransomware identifying the bait file is reduced. The properties of the bait file are consistent with the real file, making it more difficult for the ransomware to distinguish which files are bait files, thereby improving the reliability of the detection system. The file properties in the target file directory may change over time, and dynamically modifying the properties of the bait file can ensure that the detection system is always effective.

[0066] As a feasible implementation method, after detecting the operation on the bait file, it also includes: determining whether the process performing the operation is a whitelist process; wherein the whitelist process includes a process that modifies file attributes; if not, entering the step of determining that the process performing the operation is a ransomware process.

[0067] Among them, whitelist processes refer to pre-defined processes that are allowed to operate on files. These processes are usually used for normal file management or maintenance tasks, such as file editing, backup, etc. Ransomware processes refer to processes that are detected to operate on bait files. If the process is not in the whitelist, it is considered a ransomware process.

[0068] In the specific implementation, after detecting the operation on the bait file, the system records the process information of the operation. The system checks whether the process is in the whitelist, which usually contains processes that are allowed to modify file attributes, such as cat, vi, chmod, chown, chgrp, etc. If the process performing the operation is not in the whitelist, the system marks it as a ransomware process and enters the subsequent processing flow.

[0069] The whitelist mechanism can prevent normal operating processes from being misjudged as ransomware processes, thus improving the accuracy of the detection system. The whitelist can be dynamically adjusted according to actual needs to adapt to different system environments and operating requirements. For processes not in the whitelist, the system can quickly identify and take measures to prevent further damage from the ransomware.

[0070] As a feasible implementation method, after spraying the bait file to the target file directory based on the file type distribution information, it also includes: mounting a process monitoring event at the mount point so as to monitor the operation of the process on the files in the target file directory through the process monitoring event.

[0071] The mount point refers to a specific location in the system used to monitor process behavior, which is usually related to file system operations, such as file opening, deletion, and renaming. Process monitoring events refer to the system's monitoring mechanism for process behavior, which is used to record and analyze the operations of processes on files.

[0072] In the specific implementation, after the bait file is sprayed into the target file directory, the process monitoring event is mounted at the mount point, and the operation behavior of the process on the files in the target file directory is monitored in real time through these mount points. When the operation of the bait file is monitored, the relevant process information is recorded and the subsequent detection process is entered.

[0073] For example, suppose that several .db decoy files are sprayed in the target file directory / opt / database. Mount monitoring events at the mount points of file system operations (such as lsm / file_open, lsm / inode_unlink, lsm / inode_rename). When a process attempts to open or delete the decoy file, the operation behavior is captured through these mount points, and the process information performing the operation is recorded.

[0074] S103: If an operation on the bait file is detected, the process performing the operation is determined to be a ransomware process, and the ransomware process is processed according to a preset monitoring strategy.

[0075] Operations refer to the reading, writing, encryption, deletion, and renaming of files. Ransomware usually encrypts or deletes files. Preset monitoring strategies refer to predefined strategies for dealing with ransomware behaviors, such as logging, issuing alerts, and terminating suspicious processes.

[0076] In this step, the file operation behavior in the target file directory is monitored in real time through the file monitoring module. Once the encryption, deletion or other suspicious operations of the bait file are detected, the system immediately determines that the process performing the operation is a ransomware process and processes it according to the preset monitoring strategy. For example, record the operation log, issue an alarm to notify the administrator, terminate the suspicious process or isolate the infected file. That is, as a feasible implementation method, the ransomware process is processed according to the preset monitoring strategy, including: terminating the ransomware process and / or reporting the ransomware process according to the preset monitoring strategy.

[0077] For example, in the / home directory, the system detects a process trying to encrypt a .txt bait file. The system immediately identifies the process as a ransomware process and terminates it according to the preset policy. It also records detailed operation logs and notifies the system administrator. In this way, the system can detect the ransomware behavior in the early stage and prevent it from further damaging other files in the system.

[0078] This step achieves rapid response and accurate processing of ransomware behavior, and can detect and block ransomware behavior before it encrypts real files, minimizing data loss. At the same time, by recording operation logs and notifying administrators, it provides an important basis for subsequent security analysis and system recovery.

[0079] The ransomware virus detection method provided by the embodiment of the present invention dynamically obtains the file type distribution information of the target file directory, and accurately sprays the bait file to the target directory according to the file type distribution information, so that the type and distribution ratio of the bait file are highly consistent with the real file environment of the user system. This design not only effectively improves the concealment of the bait file, avoids the ransomware virus from identifying and avoiding the bait file, but also significantly enhances the accuracy and reliability of ransomware virus detection. At the same time, by real-time monitoring of the operation behavior of the bait file and quickly identifying the ransomware virus process, combined with the preset monitoring strategy for targeted processing, the embodiment of the present invention can promptly prevent the destructive behavior of the ransomware virus and protect the security of the user system and data.

[0080] The embodiment of the present invention discloses a bait file updating method. Specifically:

[0081] See also Figure 2 , according to an exemplary embodiment, a flowchart of a bait file updating method is shown, such as Figure 2 As shown, including:

[0082] S201: When the update time of the bait file is reached, determine whether the proportion of non-bait files with updated attributes in the target file directory in the current update cycle to all non-bait files in the target file directory is greater than a first preset value; if so, proceed to S202; if not, proceed to S203;

[0083] The attribute update refers to the change of the file's metadata (such as permissions, owner, access time, etc.). The first preset value is a preset ratio threshold, which is used to determine whether the frequency of file attribute update is high enough to trigger the update of the bait file attribute.

[0084] In this step, when the update time of the bait file is reached, the system counts the number of non-bait files whose attributes have changed in the target file directory during the current update cycle, and calculates their proportion to all non-bait files. If the proportion is greater than the first preset value, then proceed to S202; otherwise, proceed to S203.

[0085] This step dynamically determines whether the attributes of the decoy file need to be updated by judging the update ratio of the file attributes. This not only reduces unnecessary operations, but also ensures that the attributes of the decoy file can be kept consistent with the real file environment in a timely manner, improving the concealment of the decoy file and the reliability of the detection system.

[0086] S202: Update the attributes of the bait files in the target file directory according to the current attribute information of the non-bait files in the target file directory, and proceed to S203;

[0087] The current attribute information refers to the metadata of the non-bait file at the current moment, including permissions, owners, access time, etc.

[0088] In this step, the current attribute information of the non-bait file in the target file directory is obtained, and the attribute of the bait file is modified to be consistent with the non-bait file. After completion, the process proceeds to S203.

[0089] S203: Determine whether the number of newly added non-bait files in the current update cycle is greater than a second preset value; if so, proceed to S204;

[0090] The second preset value is a preset quantity threshold value, which is used to determine whether the number of newly added files is large enough to trigger the update of the file type distribution information.

[0091] In this step, the number of newly added non-bait files in the target file directory during the current update cycle is counted. If the number of newly added files is greater than the second preset value, the process proceeds to S204; otherwise, the process ends.

[0092] This step dynamically determines whether the file type distribution information needs to be updated by judging the number of newly added files. This ensures that the system can adapt to changes in the file directory in a timely manner, maintain the dynamic consistency of the distribution of decoy files, and improve the adaptability and reliability of the detection system.

[0093] S204: Update the file type distribution information of the target file directory;

[0094] In this step, the target file directory is rescanned, the number and proportion of each file type are counted, and the file type distribution information is updated. By dynamically updating the file type distribution information, the system can timely reflect the changes in the target file directory, provide an accurate basis for the subsequent generation and spraying of bait files, and ensure that the type and distribution of bait files are consistent with the real file environment.

[0095] S205: Obtain a bait file, and spray the bait file to a target file directory based on file type distribution information;

[0096] In this step, according to the updated file type distribution information, the system obtains or generates bait files of corresponding types and places these bait files in the target file directory.

[0097] S206: Modify the attributes of the bait files sprayed into the target file directory according to the attribute information of the non-bait files in the target file directory.

[0098] In this step, the current attribute information of non-bait files in the target file directory is obtained, and the attributes of the bait files after spraying are modified to be consistent with those of non-bait files. By dynamically updating the attributes of the bait files to keep them consistent with the attributes of the real files, the ransomware is further confused, the possibility of identifying the bait files is reduced, and the concealment and effectiveness of the detection system are improved.

[0099] It can be seen that this embodiment provides a mechanism for dynamically updating bait files to improve the adaptability and effectiveness of the ransomware detection system. By periodically checking the attribute changes and newly added files of non-bait files in the target file directory, the attributes and distribution of the bait files are dynamically adjusted to ensure that the bait files are highly consistent with the real file environment. This mechanism can not only effectively confuse the ransomware, but also adapt to the dynamic changes of system files, and improve the reliability and concealment of the detection system.

[0100] On the basis of the above embodiment, a machine learning model is introduced to analyze the file behavior pattern and attribute changes in the target file directory, so as to realize a more intelligent bait file update strategy and ransomware behavior prediction. Specifically, the following steps are included: collect the attribute information of the file and the file operation behavior in the target file directory, and input these data as features into the machine learning model. Use historical data to train the machine learning model so that it can identify the difference between normal file behavior patterns and ransomware behavior patterns. The model can be based on supervised learning (such as classification algorithm) or unsupervised learning (such as anomaly detection algorithm). Use the machine learning model to predict the change trend of file attributes in the target file directory. According to the prediction results, adjust the attributes and distribution of the bait file in advance to make it more consistent with the dynamic changes of the real files in the system. When the operation of the bait file is detected, the machine learning model is used to analyze the characteristics of the operation behavior to predict whether the behavior is a ransomware behavior. If the model predicts a high-risk behavior, the corresponding treatment measures are taken immediately. Feedback the detected ransomware behavior and false positives to the model to continuously optimize the accuracy and reliability of the model.

[0101] It can be seen that the machine learning model can predict the changing trend of file attributes and adjust the attributes and distribution of bait files in advance to keep them highly consistent with the real file environment, further reducing the possibility of ransomware identifying bait files. Using machine learning models to analyze and predict operational behaviors can more accurately identify ransomware behaviors, reduce false alarm rates, and improve the reliability of the detection system. By predicting ransomware behavior, the system can promptly detect and prevent ransomware from further damaging other files in the system at the early stage of ransomware behavior, achieve active defense, and minimize data loss. By feeding the detection results back to the model, the system can continuously optimize the performance of the model, adapt to the ever-changing ransomware attack methods and system environment, and ensure the long-term effectiveness of the detection system.

[0102] An application embodiment provided by the present invention is described below. The framework diagram of the ransomware intrusion detection system is as follows: Figure 3 As shown, the ransomware detection control module is in user mode and runs in a trusted execution environment. The code and data in the module are protected by the trusted execution environment, which can effectively resist attacks on the ransomware monitoring module by malicious adversaries. The bait file remote server exists independently of the user business system. By calling the bait file generation function, a large number of bait files of various types are dynamically generated in real time and stored in the bait file remote library. The ransomware monitoring module runs in kernel mode and performs real-time detection of ransomware.

[0103] Among them, the ransomware monitoring module mainly includes the local library of bait files, process whitelist function, bait file acquisition function, bait file spraying function, log management function, bait file verification function, system file analysis function, and bait file update function.

[0104] Bait file local library: stores bait files, located on the user's Linux system. There are two types of bait files: those preset when installing the ransomware intrusion detection system, those obtained from the bait file remote server, and those saved in the bait file local library when the local bait file is updated.

[0105] Process whitelist function: set the user processes of specific users in the user system to belong to the whitelist. You can set multiple specific users. Even if these whitelist processes operate the bait file, they will not trigger an alarm. For example, in order to achieve periodic updates of bait files, you need to save processes such as cat, vi, chmod, chown, chgrp, etc. in the process whitelist.

[0106] Bait file acquisition function: When the ransomware intrusion detection system is initialized, it is necessary to obtain bait files of specified types and quantities. There are two ways to obtain bait files: the first is to directly obtain them from the local bait file library, but the bait files stored in the local bait file library are all pre-set and cannot be updated in real time. The second is to update in real time from the bait file remote server. The bait file remote server dynamically generates a large number of bait files of various types in real time by calling the bait file generation function, and stores them in the bait file remote library.

[0107] Bait file spraying function: spray bait files in the file monitoring directory, and at the same time take into account the file type distribution ratio of different bait file directories. File type distribution includes two types of distribution data, the first is the distribution ratio of file types in the overall file monitoring directory, and the second is the distribution ratio of file types in different file monitoring directories.

[0108] Log management function: manage the ransomware warning logs reported by the kernel state, and perform corresponding display and storage operations.

[0109] Bait file verification function: The bait file generated by the bait file remote server may be tampered by a third party when it is sent to the user system. Therefore, the bait file verification function uses the certificate of the bait file remote server to perform signature verification operations on all bait files from the bait file remote server to prove the legitimacy and integrity of the bait file.

[0110] System file analysis function: Different user systems have different deployed business systems, so all file types are different. When the ransomware knows that there is a detection system based on bait files in the user's business system, it may identify the bait files, and then not encrypt the bait files, but only encrypt the files of the user's business system, thereby bypassing the detection system. In order to prevent the ransomware from identifying the bait files, it is necessary to ensure that the bait files can meet the distribution ratio of the file types in the monitoring directory. Use the system file analysis function to analyze the file type distribution of the user system. The file type distribution includes two types of distribution data. The first is the distribution ratio of the file types in the overall file monitoring directory, and the second is the distribution ratio of the file types under different file monitoring directories. The first type of data is used to determine the type and quantity of bait files, which belongs to the macro distribution of bait files; the second type of data is used to determine how to spray the obtained bait files into different file monitoring directories according to the corresponding proportion, which belongs to the fine-grained control of bait spraying.

[0111] Decoy file update function: As the user system runs, the permissions, file owners, user groups to which files belong, last access time, last change time, and last modification time of files in the file monitoring directory will also change. At the same time, many new normal files will be generated in the system. In order to make the attributes of the decoy files and normal files maintain the same distribution pattern, it is necessary to perform update operations on the decoy files. The user-mode decoy file update function implements periodic updates of decoy files. Specific users in the system update the permissions, file owners, user groups to which files belong, last access time, last modification time, and last modification time of the decoy files in the system. Before the system is initialized, the processes of specific users of cat, vi, chmod, chown, and chgrp need to be added to the process whitelist function. The cat command is used to update the last access time, the vi command is used to update the last modification time and the last modification time, and the values ​​of some content of the decoy files are updated at the same time. The permissions, file owners, and user groups to which files belong of the decoy files are updated through chmod, chown, and chgrp, and the updated decoy files are saved in the decoy file local library. For normal files newly added to the system, the bait files no longer match the file type distribution of the file monitoring directory, and the bait files need to be updated. The corresponding bait files are obtained using the bait file acquisition function, and the distribution ratio of the bait files matches the distribution ratio of the file types in the overall file monitoring directory. The bait files can be obtained from the bait file local library or from the bait file remote server. At the same time, the bait files are sprayed, and the bait files that do not match the system status are deleted. The update strategy of the bait files is sent to the monitoring strategy function of the kernel state, and the latest bait detection strategy is enabled.

[0112] The bait file remote server provides the user's ransomware detection system with bait file generation function, bait file remote library, bait file distribution function, and remote proof verification function.

[0113] Bait file generation function: It can periodically generate new bait files of various types and then store them in the remote library of bait files. The bait file generation function can read and write existing bait files in the remote library of bait files, thereby ensuring that the bait files are dynamically operated in real time and are not zombie files. At the same time, the remote server of the bait files has a legitimate certificate for signing the bait files.

[0114] Bait file remote library: used to store bait files generated by bait files. The bait file remote library contains a large number of real-time bait files to meet various user system requirements.

[0115] Bait file distribution function: used to process the bait file acquisition request sent by the user, so as to distribute the corresponding bait file according to the user's requirements. At the same time, it can also call the remote proof verification function to verify that the user's ransomware detection control module is running in a trusted execution environment, thereby establishing a secure communication channel to ensure the security of bait file distribution.

[0116] Remote attestation verification function: It can verify that the user's ransomware detection control module is running in a trusted execution environment. The remote attestation verification function first sends a remote attestation challenge message to the ransomware detection control module. Then the ransomware detection control module obtains the measurement value of the trusted execution environment based on the challenge value, and signs it based on the hardware private key produced by the trusted execution environment to produce a remote attestation report. The ransomware detection control module sends the remote attestation report to the remote attestation verification function of the bait file remote server, verifies the signature of the remote attestation report of the ransomware detection control module, and compares the reference value therein to see if it is consistent with the pre-stored reference value. If all verifications are passed, the ransomware detection control module is running in a trusted execution environment. Then key negotiation can be performed based on the remote attestation report to establish a secure communication channel.

[0117] The ransomware monitoring module includes ePBF (Extended Berkeley Packet Filter) ransomware monitoring function, monitoring strategy function, log reporting function and other modules.

[0118] ePBF ransomware monitoring function: Based on the ePBF function, the corresponding file operation function is hooked in LSM (Linux Security Module), and the ransomware is scanned in real time according to the monitoring strategy function. When a virus is detected, corresponding processing is performed according to the settings of the policy file, including log reporting, process alarm, process killing and other operations.

[0119] Monitoring strategy function: Saves the process whitelist of specific users with user-mode settings and the corresponding bait file path. Provides a strategic basis for the ePBF ransomware monitoring function.

[0120] Log reporting function: When the ePBF ransomware monitoring function detects the intrusion of the ransomware, it will report the log to the user.

[0121] The process of spraying bait documents is as follows: Figure 4As shown, the file monitoring directory of the ransomware detection control module is determined by using the system file analysis function. The bait directory is determined according to the file monitoring directory. Then, the file type distribution of the user system is analyzed according to the file monitoring directory. The corresponding bait file is obtained by using the bait file acquisition function, and the distribution ratio of the bait file conforms to the distribution ratio of the file type of the overall file monitoring directory. This makes it impossible for the ransomware to distinguish between normal files and bait files. There are two ways to obtain the bait file: the first is to obtain it directly from the local library of the bait file, and the second is to update it in real time from the remote server of the bait file. Users can freely choose between the two methods. When the second method is selected, the remote proof verification function of the remote server of the bait file verifies that the user's ransomware detection control module is running in a trusted execution environment. The remote proof verification function issues a remote proof challenge to the user, and the challenge contains a random number. Then the ransomware detection control module obtains the measurement value of the trusted execution environment based on the challenge value, and signs it based on the hardware private key produced by the trusted execution environment to produce a remote proof report. The ransomware detection control module sends the remote proof report to the remote proof verification function of the bait file remote server, verifies the signature of the remote proof information of the ransomware detection control module, and compares whether the reference value therein is consistent with the pre-stored reference value. If all verifications are passed, the ransomware detection control module runs in a trusted execution environment. Then the ransomware detection control module and the bait file remote server can negotiate keys based on the remote proof information, establish a secure communication channel, and request the bait file remote server that meets the file type distribution ratio. The bait file distribution function obtains the latest bait file from the bait file remote library according to the request and sends it to the ransomware detection control module. The ransomware detection control module pre-stores the signature public key of the bait file remote server. The bait file verification function uses the public key to verify the signature of the obtained bait file and confirm the legitimacy of the bait file. Save the bait file to the bait file local library. The bait file spraying function first determines the type and quantity of the bait file according to the distribution ratio of the file type of the overall file monitoring directory, which belongs to the number of bait files in a macro sense. Then, according to the distribution ratio of file types in different file monitoring directories, the bait files are placed in the bait directories according to the corresponding file type ratio. According to the attributes of other normal files in the directory where the bait files are located, the specific user sets the permissions, file owners, and user groups of the bait files to make the attribute information of the bait files and normal files more similar. The distribution of the bait files is sent to the mapping space of the ePBF of the detection strategy function in the kernel state and saved in the ePBFmap format.

[0122] The whitelist determination process is as follows Figure 5As shown in the figure, a specific user can set which specific user's user processes belong to the whitelist through the process whitelist function. Even if the specific user's processes in these whitelists operate the bait file, the alarm will not be triggered. For example, in order to achieve periodic updates of the bait file, it is necessary to save processes such as cat, vi, chmod, chown, and chgrp in the process whitelist. The process whitelist is sent to the ePBF mapping space of the monitoring policy function in the kernel state and saved in the ePBF map format.

[0123] The ePBF ransomware monitoring function process is as follows Figure 6 As shown, the ePBF ransomware monitoring function is started: the process monitoring event is mounted at the mount point of LSM through the ePBF technology. The mount points include lsm / file_open, lsm / inode_unlink, and lsm / inode_rename, which are used to track the system's file editing, deletion, and renaming operations. The ePBF ransomware monitoring function obtains all events of the mount point and queries it in the monitoring policy. If the corresponding current operation object is found to be a bait file in the monitoring policy, it is judged by the whitelist function. If it is not a whitelist process, it is considered to be a ransomware virus and the log is reported. The kernel state log reporting function reports the intrusion detection event to the user state log management function, and the user state displays and stores the intrusion detection log. Whether to kill the ransomware process is determined based on the matched monitoring policy.

[0124] The process of updating the decoy file is as follows: Figure 7As shown, it is determined whether the update time of the bait file update function in the user state has been reached. The update time can be set to once a day or once every few hours. If the periodic update time is reached, the bait file update function determines whether there is an attribute update operation of a normal file. If there is an update operation, it is further determined whether the attribute update operation exceeds the threshold. If the update operation exceeds the threshold, the attribute distribution law of the updated file is obtained, and the attribute information of the bait file is changed according to the attribute distribution law of the updated file. The updated bait file is saved in the bait file local library. It is determined whether a new normal file is generated. If so, it is further determined whether the new normal file exceeds the threshold. When the new normal file exceeds the threshold, it means that the current bait file no longer meets the distribution ratio of the file type of the overall file monitoring directory, and the bait file needs to be updated. The file type distribution of the file monitoring directory is determined by the system file analysis function. According to the file type distribution ratio, the corresponding bait file is obtained by using the bait file acquisition function. The distribution ratio of the bait file meets the distribution ratio of different file types in the system. There are also two ways to obtain the bait file, which will not be repeated here. The decoy file spraying function places the decoy files in the decoy directory according to the file type distribution ratio under different file monitoring directories, and deletes the decoy files that do not conform to the system status. According to the attributes of other normal files in the directory where the decoy files are located, a specific user sets the permissions, file owner, and user group of the decoy files to make the attribute information of the decoy files and normal files more similar. The update policy of the decoy files (the decoy files currently existing in the target file directory) is sent to the detection policy function in the kernel state, and the latest decoy detection policy is enabled.

[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0126] A ransomware detection device provided by an embodiment of the present invention is introduced below. The ransomware detection device described below and the ransomware detection method described above can be referenced to each other.

[0127] See also Figure 8 , according to an exemplary embodiment, a structural diagram of a ransomware virus detection device is shown, such as Figure 8 As shown, including:

[0128] The first acquisition module 100 is used to determine the target file directory to be monitored and acquire the file type distribution information of the target file directory; wherein the file type distribution information includes the types of files contained in the target file directory and the distribution ratio of each type of files;

[0129] A spraying module 200 is used to obtain bait files and spray the bait files to a target file directory based on file type distribution information;

[0130] The processing module 300 is used to determine that the process performing the operation is a ransomware process when an operation on the bait file is detected, and process the ransomware process according to a preset monitoring strategy.

[0131] The ransomware detection device provided by the embodiment of the present invention dynamically obtains the file type distribution information of the target file directory, and accurately sprays the bait file to the target directory according to the file type distribution information, so that the type and distribution ratio of the bait file are highly consistent with the real file environment of the user system. This design not only effectively improves the concealment of the bait file, avoids the ransomware virus from identifying and avoiding the bait file, but also significantly enhances the accuracy and reliability of ransomware virus detection. At the same time, by real-time monitoring of the operation behavior of the bait file and quickly identifying the ransomware virus process, combined with the preset monitoring strategy for targeted processing, the embodiment of the present invention can timely prevent the destructive behavior of the ransomware virus and protect the security of the user system and data.

[0132] Based on the above embodiment, as a preferred implementation, it also includes:

[0133] The second acquisition module is used to acquire overall file type distribution information; wherein the overall file type distribution information includes the total number of files contained in all target file directories, the file types, and the overall distribution ratio of each type of files;

[0134] Correspondingly, the spraying module 200 is specifically used for: obtaining a target number of bait files based on the overall file type distribution information; wherein the target number is the product of the total number and a preset ratio, and the distribution ratio of each type of file in the obtained target number of bait files conforms to the overall distribution ratio; and spraying the bait files to each target file directory based on the file type distribution information of each target file directory.

[0135] Based on the above embodiment, as a preferred implementation, the spraying module 200 includes:

[0136] The first acquisition unit is used to acquire the bait file from the local bait file library.

[0137] Based on the above embodiment, as a preferred implementation, the spraying module 200 includes:

[0138] A first sending unit, configured for the ransomware detection module to send a request for obtaining a bait file to a remote server;

[0139] A generating unit, configured to receive a remote attestation challenge sent by a remote server, and generate remote attestation information based on the remote attestation challenge;

[0140] A second sending unit is used to send the remote certification information to the remote server so that the remote server verifies that the ransomware virus detection module runs in a trusted execution environment;

[0141] The second acquisition unit is used to establish a secure channel with the remote server and acquire the bait file from the remote server through the secure channel.

[0142] Based on the above embodiment, as a preferred implementation mode, the generating unit is specifically used to: receive a remote attestation challenge sent by a remote server; wherein the remote attestation challenge includes a random number; obtain a measurement value of a trusted execution environment based on the random number, sign the measurement value using a private key generated by the trusted execution environment, and generate remote attestation information based on the signed measurement value;

[0143] Accordingly, the remote server verifies the signature of the measurement value in the remote proof information, and compares the measurement value in the remote proof information with the pre-stored reference value. If the signature verification passes and the measurement value is consistent with the reference value, the ransomware detection module runs in a trusted execution environment.

[0144] Based on the above embodiment, as a preferred implementation, the spraying module 200 further includes:

[0145] A negotiation unit, configured to negotiate a key with a remote server based on remote certification information;

[0146] The verification unit is used to perform signature verification on the obtained bait file based on the public key generated by the remote server to verify the legitimacy of the bait file.

[0147] Based on the above embodiment, as a preferred implementation, it also includes:

[0148] The modification module is used to modify the attributes of the bait files sprayed into the target file directory according to the attribute information of the non-bait files in the target file directory.

[0149] Based on the above embodiment, as a preferred implementation, it also includes:

[0150] The judgment module is used to judge whether the process performing the operation is a whitelist process; wherein the whitelist process includes a process that modifies file attributes; if not, it is determined that the process performing the operation is a ransomware process.

[0151] Based on the above embodiment, as a preferred implementation, it also includes:

[0152] The first update module is used to determine whether the proportion of non-bait files with updated attributes in the target file directory within the current update cycle to all non-bait files in the target file directory is greater than a first preset value when the update time of the bait file is reached; if so, update the attributes of the bait files in the target file directory according to the current attribute information of the non-bait files in the target file directory.

[0153] Based on the above embodiment, as a preferred implementation, it also includes:

[0154] The second update module is used to determine whether the number of newly added non-bait files in the current update cycle is greater than a second preset value when the update time of the bait file is reached; if so, update the file type distribution information of the target file directory and restart the workflow of the spray module 200.

[0155] Based on the above embodiment, as a preferred implementation, it also includes:

[0156] The monitoring module is used to mount the process monitoring event at the mount point so as to monitor the operation of the process on the files in the target file directory through the process monitoring event.

[0157] Based on the above embodiment, as a preferred implementation mode, the processing module 300 is specifically used to: end the ransomware process and / or report the ransomware process according to a preset monitoring strategy.

[0158] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0159] An embodiment of the present invention further provides an electronic device, Fig. 9 FIG. 1 is a structural diagram of an electronic device according to an exemplary embodiment. Fig. 9 As shown, the electronic equipment includes:

[0160] Communication interface 1, capable of exchanging information with other devices such as network devices;

[0161] The processor 2 is connected to the communication interface 1 to implement information exchange with other devices, and is used to execute the ransomware virus detection method provided by one or more technical solutions when running a computer program. The computer program is stored in the memory 3.

[0162] Of course, in actual application, the various components in the electronic device are coupled together through the bus system 4. It can be understood that the bus system 4 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 4 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Fig. 9Various buses are labeled as bus system 4.

[0163] The memory 3 in the embodiment of the present invention is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0164] It can be understood that the memory 3 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 3 described in the embodiments of the present invention is intended to include but is not limited to these and any other suitable types of memories.

[0165] The method disclosed in the above embodiment of the present invention can be applied to the processor 2, or implemented by the processor 2. The processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 2 or the instruction in the form of software. The above processor 2 can be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 3. The processor 2 reads the program in the memory 3 and completes the steps of the above method in combination with its hardware.

[0166] When the processor 2 executes the program, the corresponding processes in the various methods of the embodiments of the present invention are implemented, which will not be described in detail here for the sake of brevity.

[0167] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned ransomware virus detection method embodiments when running.

[0168] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0169] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by the processor 2, the steps in any of the above-mentioned ransomware virus detection method embodiments are implemented.

[0170] An embodiment of the present invention further provides another computer program product, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by the processor 2, the steps in any of the above-mentioned ransomware virus detection method embodiments are implemented.

[0171] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0172] The above is a detailed introduction to a ransomware virus detection method and device, storage medium and computer program product provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified in several ways, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for detecting ransomware, characterized in that: include: Determine a target file directory that needs to be monitored, and obtain file type distribution information of the target file directory; wherein the file type distribution information includes the types of files contained in the target file directory and the distribution ratio of each type of files; Obtaining a bait file, and spraying the bait file to the target file directory based on the file type distribution information; If an operation on the bait file is detected, the process performing the operation is determined to be a ransomware process, and the ransomware process is processed according to a preset monitoring strategy.

2. The ransomware virus detection method according to claim 1, characterized in that: After determining the target file directory to be monitored, the method further includes: Obtaining overall file type distribution information; wherein the overall file type distribution information includes the total number of files contained in all the target file directories, the file types, and the overall distribution ratio of each type of files; Accordingly, the step of obtaining the bait file and spraying the bait file to the target file directory based on the file type distribution information includes: Acquire a target number of bait files based on the overall file type distribution information; wherein the target number is the product of the sum of the numbers and a preset ratio, and the distribution ratio of each type of file in the acquired target number of bait files conforms to the overall distribution ratio; Spray bait files to each target file directory based on the file type distribution information of each target file directory.

3. The ransomware virus detection method according to claim 1, characterized in that: The step of obtaining the bait file comprises: Get the bait file from the local bait file library.

4. The ransomware virus detection method according to claim 1, characterized in that: The step of obtaining the bait file comprises: The ransomware detection module sends a request to obtain the bait file to the remote server; receiving a remote attestation challenge sent by the remote server, and generating remote attestation information based on the remote attestation challenge; Sending the remote certification information to the remote server so that the remote server verifies that the ransomware detection module runs in a trusted execution environment; A secure channel is established with the remote server, and the bait file is obtained from the remote server through the secure channel.

5. The ransomware virus detection method according to claim 4, characterized in that: The receiving the remote attestation challenge sent by the remote server and generating remote attestation information based on the remote attestation challenge includes: Receiving a remote attestation challenge sent by the remote server; wherein the remote attestation challenge includes a random number; Obtaining a measurement value of a trusted execution environment based on the random number, signing the measurement value using a private key generated by the trusted execution environment, and generating remote attestation information based on the signed measurement value; Correspondingly, the remote server verifies the signature of the measurement value in the remote certification information, and compares whether the measurement value in the remote certification information is consistent with the pre-stored reference value. If the signature verification passes and the measurement value is consistent with the reference value, the ransomware detection module runs in a trusted execution environment.

6. The ransomware virus detection method according to claim 4, characterized in that: After the remote server verifies that the ransomware detection module is running in a trusted execution environment, the method further includes: negotiate a key with the remote server based on the remote attestation information; Correspondingly, after obtaining the bait file from the remote server through the secure channel, the method further includes: The obtained bait file is signature-verified based on the public key generated by the remote server to verify the legitimacy of the bait file.

7. The ransomware virus detection method according to claim 1, characterized in that: After spraying the bait file to the target file directory, the method further includes: The attributes of the bait files sprayed to the target file directory are modified according to the attribute information of the non-bait files in the target file directory.

8. The ransomware virus detection method according to claim 7, characterized in that: After the operation on the bait file is detected, the method further includes: Determine whether the process executing the operation is a whitelist process; wherein the whitelist process includes a process for modifying file attributes; If not, proceed to the step of determining that the process performing the operation is a ransomware process.

9. The ransomware virus detection method according to claim 7, characterized in that: After modifying the attributes of the bait files sprayed to the target file directory according to the attribute information of the non-bait files in the target file directory, the method further includes: When the update time of the bait file is reached, determining whether the proportion of non-bait files with updated attributes in the target file directory in the current update cycle to all non-bait files in the target file directory is greater than a first preset value; If so, the attributes of the bait files in the target file directory are updated according to the current attribute information of the non-bait files in the target file directory.

10. The ransomware virus detection method according to claim 1, characterized in that: After spraying the bait file to the target file directory based on the file type distribution information, the method further includes: When the update time of the bait file is reached, determining whether the number of newly added non-bait files in the current update cycle is greater than a second preset value; If so, the file type distribution information of the target file directory is updated, and the step of obtaining the bait file is re-entered, and the step of spraying the bait file to the target file directory based on the file type distribution information.

11. The ransomware virus detection method according to claim 1, characterized in that: After spraying the bait file to the target file directory based on the file type distribution information, the method further includes: The process monitoring event is mounted at the mount point so as to monitor the operation of the process on the files in the target file directory through the process monitoring event.

12. The ransomware virus detection method according to claim 1, characterized in that: The processing of the ransomware process according to a preset monitoring strategy includes: The ransomware process is terminated and / or reported according to a preset monitoring strategy.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps performed by the ransomware virus detection method according to any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the steps performed by the ransomware virus detection method according to any one of claims 1 to 12 are implemented.

15. A computer program product, characterized in that It includes a computer program, which, when executed, implements the steps performed by the ransomware virus detection method according to any one of claims 1 to 12.

Images