Ransomware defense method, device, electronic device and computer storage medium

Abstract

The present application provides a method, device, electronic device and computer storage medium for defending against ransomware. After obtaining the behavior data of the user and the behavior data of the system process, the current attack stage of the ransomware is determined according to the behavior data of the user and the behavior data of the system process; then, the behavior data of the user and the behavior data of the system process are associated according to a preset association relationship to obtain an associated behavior; for the current attack stage of the ransomware, the weight of the associated behavior is dynamically adjusted to obtain a target weight of the associated behavior; then, a first threat score is calculated according to the associated behavior and the target weight of the associated behavior; if the first threat score is greater than the warning threshold, a warning message is generated. Thus, the purpose of quickly responding to potential ransomware threats is achieved, and possible economic losses are effectively reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and computer storage medium for defending against ransomware. Background Art

[0002] Existing ransomware detection methods mainly rely on monitoring and analysis at the network, host and file levels. However, as the complexity of ransomware variants increases, traditional methods are insufficient in dealing with new threats. In addition, existing methods usually respond only after the ransomware actually launches an attack (such as data encryption), failing to effectively prevent potential economic losses.

[0003] Therefore, there is an urgent need for a more advanced detection method that can identify ransomware activities before they launch an attack and take defensive measures in advance. Summary of the invention

[0004] In view of this, the present application provides a ransomware defense method, device, electronic device and computer storage medium, which dynamically adjust the behavior weight according to the identified ransomware attack life cycle, thereby quickly responding to potential ransomware threats and effectively reducing possible economic losses.

[0005] The first aspect of the present application provides a method for defending against ransomware, comprising:

[0006] Obtain user behavior data and system process behavior data;

[0007] Determine the current attack stage of the ransomware based on the user's behavior data and the system process's behavior data;

[0008] Associating the user's behavior data with the system process's behavior data according to a preset association relationship to obtain associated behaviors;

[0009] According to the current attack stage of the ransomware, the weight of the associated behavior is dynamically adjusted to obtain a target weight of the associated behavior;

[0010] A first threat score is calculated based on the associated behavior and the target weight of the associated behavior;

[0011] If the first threat score is greater than the warning threshold, a warning message is generated.

[0012] Optionally, determining the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data includes:

[0013] Determine the abnormal analysis result of the current system process according to the number of file input and output operations in the behavior data of the system process;

[0014] Generate baseline behavior data based on the user's behavior data and the user's historical behavior data;

[0015] The user's behavior data and the baseline behavior data are input into a user behavior analysis model, and a user behavior deviation value is output; wherein the user behavior analysis model is obtained by training a deep learning model according to a training sample set; the training sample set includes N first training sample user behavior data, M second training sample user behavior data, and true abnormal analysis results corresponding to the second training sample user behavior data; N and M are positive integers;

[0016] If the user behavior deviation value is greater than the deviation value threshold, and the current system process abnormality analysis result shows that there is an abnormality, it is determined that the current stage is encryption.

[0017] Optionally, determining the abnormality analysis result of the current system process according to the number of file input and output operations in the behavior data of the system process includes:

[0018] For each file in the behavior data of the system process, determine the aggregate score of the file according to the weight of the type to which the file belongs and the number of input and output operations of the file;

[0019] Calculate a first aggregate score based on the aggregate scores of all the files;

[0020] If the first aggregate score is greater than a first aggregate score threshold, it is determined that an abnormality exists in the current system process.

[0021] Optionally, the method for constructing the user behavior analysis model includes:

[0022] Constructing a training sample set; wherein the training sample set includes N first training sample user behavior data, M second training sample user behavior data, and real abnormality analysis results corresponding to the second training sample user behavior data; N and M are positive integers;

[0023] Generate training sample baseline behavior data according to all first training sample user behavior data and target second training sample user behavior data; wherein the target second training sample user behavior data is any second training sample user behavior data;

[0024] Inputting the training sample baseline behavior data and the target second training sample user behavior data into a deep learning model, and outputting a predicted deviation value of the target second training sample user behavior data;

[0025] Generate a predicted anomaly analysis result corresponding to the target second training sample user behavior data according to the predicted deviation value of the target second training sample user behavior data;

[0026] The parameters in the deep learning model are adjusted by using the error between the anomaly analysis result corresponding to the target second training sample user behavior data and the real anomaly analysis result corresponding to the target second training sample user behavior data until the error between the anomaly analysis result corresponding to the target second training sample user behavior data and the real anomaly analysis result corresponding to the target second training sample user behavior data meets the preset convergence condition, and the deep learning model is used as the user behavior analysis model.

[0027] Optionally, dynamically adjusting the weight of the associated behavior for the current attack stage of the ransomware to obtain a target weight of the associated behavior includes:

[0028] If the current attack stage of the ransomware is the encryption stage, obtaining the number of file input and output operations and the number of sensitive directory input and output operations under the associated behavior;

[0029] For each file, determine an aggregate score of the file according to the weight of the type to which the file belongs and the number of input and output operations of the file, and determine a second aggregate score according to the aggregate scores of all files;

[0030] For each sensitive directory, determine an aggregate score of the sensitive directory according to the weight of the sensitive directory and the number of input and output operations of the sensitive directory, and determine a third aggregate score according to the aggregate scores of all sensitive directories;

[0031] The weight of the associated behavior is adjusted according to the second aggregate score and the third aggregate score to obtain a target weight of the associated behavior.

[0032] Optionally, if there are multiple consecutive associated behaviors, the user's behavior data and the system process's behavior data are associated according to a preset association relationship, and after the associated behaviors are obtained, the method further includes:

[0033] Aggregate all related behaviors to obtain a dynamic behavior chain;

[0034] For each associated behavior in the dynamic behavior chain, dynamically adjust the weight of the associated behavior to obtain an aggregate weight of the associated behavior;

[0035] A second threat score is calculated based on the time weighting factor, all associated behaviors, and the aggregate weight of the associated behaviors;

[0036] If the second threat score is greater than the warning threshold, a warning message is generated.

[0037] Optionally, after associating the user's behavior data with the system process's behavior data according to a preset association relationship to obtain the associated behavior, the method further includes:

[0038] Vectorizing the associated behavior to obtain an associated behavior vector;

[0039] Comparing the associated behavior vector with the historical attack vector in the attack pattern database to obtain a similarity comparison result;

[0040] If the similarity comparison result indicates that the current attack is similar to the historical attack, a weight increase coefficient of the associated behavior is determined according to the similarity between the associated behavior vector and the historical attack vector in the attack pattern database;

[0041] The target weight of the associated behavior is determined according to the current weight of the associated behavior and the weight increase coefficient of the associated behavior.

[0042] A second aspect of the present application provides a ransomware defense device, including:

[0043] A first acquisition unit, used to acquire user behavior data and system process behavior data;

[0044] An attack stage determination unit, used to determine the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data;

[0045] An association unit, used to associate the user's behavior data with the system process's behavior data according to a preset association relationship to obtain an associated behavior;

[0046] A first dynamic adjustment unit is used to dynamically adjust the weight of the associated behavior according to the current attack stage of the ransomware to obtain a target weight of the associated behavior;

[0047] A first calculation unit, configured to calculate a first threat score according to the associated behavior and the target weight of the associated behavior;

[0048] The first warning unit is configured to generate warning information if the first threat score is greater than a warning threshold.

[0049] Optionally, the attack stage determination unit includes:

[0050] A first determining unit, configured to determine an abnormality analysis result of a current system process according to the number of file input and output operations in the behavior data of the system process;

[0051] A first generating unit, configured to generate baseline behavior data according to the user's behavior data and the user's historical behavior data;

[0052] An analysis unit, configured to input the user's behavior data and the baseline behavior data into a user behavior analysis model, and output a user behavior deviation value; wherein the user behavior analysis model is obtained by training a deep learning model according to a training sample set; the training sample set includes N first training sample user behavior data, M second training sample user behavior data, and true abnormal analysis results corresponding to the second training sample user behavior data; N and M are positive integers;

[0053] The second determination unit is used to determine that the current process is in the encryption stage if the user behavior deviation value is greater than the deviation value threshold and the current system process abnormality analysis result shows that there is an abnormality.

[0054] Optionally, the first analysis unit includes:

[0055] A third determination unit is used to determine, for each file in the behavior data of the system process, an aggregate score of the file according to a weight of a type to which the file belongs and a number of input and output operations of the file;

[0056] A second calculation unit, configured to calculate a first aggregate score according to the aggregate scores of all the files;

[0057] The fourth determining unit is configured to determine that an abnormality exists in the current system process if the first aggregate score is greater than a first aggregate score threshold.

[0058] Optionally, the construction unit of the user behavior analysis model includes:

[0059] A training sample set construction unit, used to construct a training sample set; wherein the training sample set includes N first training sample user behavior data, M second training sample user behavior data, and true abnormality analysis results corresponding to the second training sample user behavior data; N and M are positive integers;

[0060] A second generating unit, configured to generate training sample baseline behavior data according to all first training sample user behavior data and target second training sample user behavior data; wherein the target second training sample user behavior data is any second training sample user behavior data;

[0061] A training unit, used to input the training sample baseline behavior data and the target second training sample user behavior data into a deep learning model, and output a predicted deviation value of the target second training sample user behavior data;

[0062] A third generating unit, configured to generate a predicted abnormality analysis result corresponding to the target second training sample user behavior data according to the predicted deviation value of the target second training sample user behavior data;

[0063] An adjustment unit is used to adjust the parameters in the deep learning model by using the error between the abnormal analysis result corresponding to the target second training sample user behavior data and the real abnormal analysis result corresponding to the target second training sample user behavior data, until the error between the abnormal analysis result corresponding to the target second training sample user behavior data and the real abnormal analysis result corresponding to the target second training sample user behavior data meets a preset convergence condition, and the deep learning model is used as the user behavior analysis model.

[0064] Optionally, the first dynamic adjustment unit includes:

[0065] A second acquisition unit is configured to acquire, if the current attack stage of the ransomware is the encryption stage, the number of file input and output operations and the number of sensitive directory input and output operations under the associated behavior;

[0066] a fifth determining unit, configured to determine, for each file, an aggregate score of the file according to a weight of a type to which the file belongs and a number of input and output operations of the file, and determine a second aggregate score according to the aggregate scores of all files;

[0067] a sixth determining unit, configured to determine, for each sensitive directory, an aggregate score of the sensitive directory according to a weight of the sensitive directory and a number of input and output operations of the sensitive directory, and determine a third aggregate score according to the aggregate scores of all sensitive directories;

[0068] The first dynamic adjustment subunit is configured to adjust the weight of the associated behavior according to the second aggregate score and the third aggregate score to obtain a target weight of the associated behavior.

[0069] Optionally, the ransomware defense device further includes:

[0070] Aggregation unit, used to aggregate all related behaviors to obtain a dynamic behavior chain;

[0071] A second dynamic adjustment unit is used to dynamically adjust the weight of each associated behavior in the dynamic behavior chain to obtain an aggregate weight of the associated behavior;

[0072] A third calculation unit, configured to calculate a second threat score according to the time weighting factor, all associated behaviors, and an aggregate weight of the associated behaviors;

[0073] The second warning unit is configured to generate warning information if the second threat score is greater than a warning threshold.

[0074] Optionally, the ransomware defense device further includes:

[0075] A vectorization unit, used for vectorizing the associated behavior to obtain an associated behavior vector;

[0076] A comparison unit, used to compare the associated behavior vector with the historical attack vector in the attack pattern database to obtain a similar comparison result;

[0077] A seventh determination unit, configured to determine a weight increase coefficient of the associated behavior according to a similarity between the associated behavior vector and a historical attack vector in an attack pattern database if the similarity comparison result indicates that the current attack is similar to the historical attack;

[0078] The eighth determining unit is used to determine the target weight of the associated behavior according to the current weight of the associated behavior and the weight increase coefficient of the associated behavior.

[0079] A third aspect of the present application provides an electronic device, including:

[0080] one or more processors;

[0081] a storage device having one or more programs stored thereon;

[0082] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for defending against ransomware as described in any one of the first aspects.

[0083] A fourth aspect of the present application provides a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for defending against ransomware as described in any one of the first aspects is implemented.

[0084] As can be seen from the above scheme, the present application provides a method, device, electronic device and computer storage medium for defending against ransomware. After obtaining the user's behavior data and the system process's behavior data, the current attack stage of the ransomware is determined according to the user's behavior data and the system process's behavior data; then, the user's behavior data and the system process's behavior data are associated according to a preset association relationship to obtain an associated behavior; for the current attack stage of the ransomware, the weight of the associated behavior is dynamically adjusted to obtain the target weight of the associated behavior; then, according to the associated behavior and the target weight of the associated behavior, a first threat score is calculated; if the first threat score is greater than the warning threshold, a warning message is generated. Thus, the purpose of quickly responding to potential ransomware threats is achieved, and possible economic losses are effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0086] Figure 1 A specific flow chart of a method for defending against ransomware provided in an embodiment of the present application;

[0087] Figure 2 A flowchart of a method for determining the current attack stage of ransomware provided in another embodiment of the present application;

[0088] Figure 3 A flowchart of a method for determining abnormal analysis results of a current system process provided by another embodiment of the present application;

[0089] Figure 4 A flowchart of a method for constructing a user behavior analysis model provided in another embodiment of the present application;

[0090] Figure 5 A flowchart of a method for dynamically adjusting weights provided in another embodiment of the present application;

[0091] Figure 6 A flowchart of a method for defending against ransomware provided in another embodiment of the present application;

[0092] Figure 7 A flowchart of a method for defending against ransomware provided in another embodiment of the present application;

[0093] Figure 8 A schematic diagram of a ransomware defense device provided in another embodiment of the present application;

[0094] Fig. 9 A schematic diagram of an electronic device for implementing a method for defending against ransomware provided in another embodiment of the present application. DETAILED DESCRIPTION

[0095] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0096] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0097] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0098] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0099] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0100] The present application embodiment provides a method for defending against ransomware, such as Figure 1 As shown, the specific steps include:

[0101] S101. Obtaining user behavior data and system process behavior data.

[0102] Among them, user behavior includes but is not limited to biological behavior, environmental behavior, operational behavior, etc.; biological behavior includes but is not limited to typing speed, mouse trajectory, touch screen gestures, etc.; environmental behavior includes but is not limited to geographic location, device type, network environment (such as intranet or extranet), access time, etc.; operational habits include but are not limited to file access mode, application usage frequency, etc., which are not limited here. Biological behavior data is used to detect whether user operations are abnormal. For example, when ransomware is executed through remote control or scripts, its behavior pattern will be inconsistent with normal user operations. Environmental behavior data can help detect potential abnormal behaviors such as remote login and cross-device access. By analyzing operational habit data, abnormal behaviors in which a large number of files are read or modified in a short period of time can be discovered.

[0103] S102: Determine the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data.

[0104] Optionally, in another embodiment of the present application, an implementation of step S102 is as follows: Figure 2 As shown, including:

[0105] S201. Determine an abnormality analysis result of the current system process according to the number of file input and output operations in the behavior data of the system process.

[0106] Optionally, in another embodiment of the present application, an implementation of step S201 is as follows: Figure 3 As shown, including:

[0107] S301 : For each file in the behavior data of the system process, determine an aggregate score of the file according to the weight of the type to which the file belongs and the number of input and output operations of the file.

[0108] S302: Calculate a first aggregate score based on the aggregate scores of all files.

[0109] Specifically, by performing weighted calculation on the read and write operations of all files, the ransomware virus can be identified for accessing and modifying a large number of files in a short period of time. The first aggregate score (based on the aggregate result of file input and output (IO) operations) can be calculated by the following formula:

[0110] Among them, IO(f k ) indicates file f k Input and output operations, w k It is a weight set according to the file type, such as applying different weights to documents, pictures, database files, etc.

[0111] S303: If the first aggregate score is greater than the first aggregate score threshold, it is determined that there is an abnormality in the current system process.

[0112] Among them, the first aggregation score threshold is set and adjusted in advance by technicians, experts, etc. and is not limited here.

[0113] S202: Generate baseline behavior data based on the user's behavior data and the user's historical behavior data.

[0114] Among them, baseline behavior data includes but is not limited to baseline biological behavior, baseline environmental behavior, baseline operating habit data, etc., which are not limited here.

[0115] Baseline biological behavior includes but is not limited to typing speed, mouse trajectory, touch screen gestures, etc., which record the user's daily operating patterns; baseline environmental behavior includes but is not limited to the user's commonly used geographical location, device type, network environment, etc., to ensure that the user operates in a known environment; baseline operating habit data includes but is not limited to file access patterns, application usage frequency, system resource usage, etc., which constitute the user's typical operating habits in a specific time and environment.

[0116] It should be noted that the generated baseline behavior data will be used as the historical behavior data of the new user when the current attack stage of the ransomware is determined next time, and will be combined with the new user's behavior data to generate new baseline behavior data, thereby making the baseline behavior data more timely.

[0117] S203: Input the user's behavior data and baseline behavior data into a user behavior analysis model, and output a user behavior deviation value.

[0118] Among them, the user behavior analysis model is obtained by training the deep learning model according to the training sample set; the training sample set includes N first training sample user behavior data, M second training sample user behavior data and the real abnormality analysis results corresponding to the second training sample user behavior data; N and M are positive integers.

[0119] Specifically, the user behavior analysis model is used to compare the deviation between the user behavior data obtained in real time and the baseline behavior data to determine the abnormality of the user behavior, that is, the user behavior deviation value.

[0120] The following are specific analyses and deviation examples for different types of behaviors (biological behaviors, environmental behaviors, and operational habits):

[0121] 1. Biobehavioral bias

[0122] Biological behaviors such as typing speed, mouse trajectory, and touch screen gestures are usually highly individual. Based on these characteristics, the user behavior analysis model can calculate the deviation value (such as "similarity score") between the real-time user's behavior data and the baseline behavior data, and judge abnormalities with a set threshold.

[0123] Typing speed: In the baseline behavior data, the user types an average of 80 words per minute, but in the detected user's behavior data, the typing speed drops sharply to 40 words per minute. This deviation may indicate that the user has been replaced by someone else or a different input method has been used, which is considered abnormal.

[0124] Mouse trajectory: In the baseline behavior data, the user's mouse operation shows a smooth and uniform curve. However, in the real-time detection of the user's behavior data, a large number of "straight" trajectories or abrupt click positions appear, deviating from the baseline trajectory pattern. This may indicate the presence of automated tools or remote manipulation.

[0125] 2. Environmental Behavior Bias

[0126] Environmental behavior includes geographic location, device type, network environment, etc. By analyzing this information, the system can identify whether the operation conforms to the user's typical environment and then determine the deviation. For example:

[0127] Geographic location: The location in the user's baseline behavior data is usually a fixed location (such as a company or home). If the operation location in the user's behavior data is detected to switch from country A to country B within a short period of time, a deviation score will be calculated to determine whether it is a potential risk behavior.

[0128] Network environment: The network environment in the baseline behavior data is the company's intranet IP or home WiFi. If the operation source in the user's behavior data is detected to be from an unknown public WiFi or an IP address from a different country, it will be considered that the behavior deviates from the baseline and may be an abnormal operation or a potential threat.

[0129] 3. Operational habit data deviation

[0130] Operation habit deviation is based on the file, application, and resource usage patterns of the user's daily operations. By comparing the operation habit data with the baseline behavior data, it is determined whether the user's operation is within the expected range. For example:

[0131] File access frequency: The operating habits in the baseline behavior data show that users edit 2-3 files per hour. If it is detected in real time that a large number of files (such as more than 10) are continuously accessed and modified in a short period of time in the user's baseline behavior data, this behavior may indicate data leakage or ransomware infection. This significant deviation will be marked as an anomaly.

[0132] Application usage pattern: Baseline behavior data shows that users only use a certain software at specific times each week, but real-time detection of users' baseline behavior data shows frequent and unexpected usage. This deviation indicates that the software may be exploited by malicious programs, and the system triggers an abnormal warning.

[0133] In the specific implementation process of this application, the user behavior analysis model can generate a numerical probability or score (deviation value) for each behavior type. If the deviation value is lower than the deviation value threshold, it is considered that the user's behavior data obtained in real time does not deviate from the baseline behavior data. If the deviation value is higher than the deviation value threshold, it is considered that the user's behavior data obtained in real time deviates from the baseline behavior data, and the operation is marked as abnormal. For example:

[0134] When the biological behavior deviation value is lower than 80%, the environmental behavior deviation value is lower than 70%, and the operating habit deviation value is lower than 65%, the current operation is considered to deviate from the baseline and is determined to be an abnormal operation.

[0135] Furthermore, during the specific implementation of the present application, the user behavior analysis model can be continuously updated to ensure that it can adapt to subtle changes in user behavior and capture abnormal fluctuations in a timely manner.

[0136] S204: If the user behavior deviation value is greater than the deviation value threshold, and the abnormal analysis result of the current system process indicates that an abnormality exists, it is determined that the current process is in the encryption stage.

[0137] It can be understood that the above is only an exemplary explanation of the method for determining the encryption stage. In the specific implementation process of this application, if an unauthorized process is identified to be started in the system, or a suspicious network connection attempts to communicate with the outside, it is determined that the current stage is the initial infection stage; if an attempt to obtain management privileges is detected (such as increasing user privileges through system vulnerabilities or process hijacking), it is determined that the current stage is the privilege escalation stage; if there are abnormal network scanning and credential theft behaviors in the internal network, and the attacker attempts to spread laterally in the system, it is determined that the current stage is the lateral movement stage; if large-scale file access, encryption library calls, and a large number of file read and write operations in a short period of time are detected, it is determined that the current stage is the encryption stage; if a ransom prompt file appears in the system, or the ransomware prompts the user to pay the ransom through an encrypted message, it is determined that the current stage is the ransom demand stage.

[0138] Optionally, in another embodiment of the present application, an implementation method of a method for constructing a user behavior analysis model is as follows: Figure 4 As shown, including:

[0139] S401: Construct a training sample set.

[0140] The training sample set includes N first training sample user behavior data, M second training sample user behavior data, and real abnormality analysis results corresponding to the second training sample user behavior data; N and M are positive integers.

[0141] S402: Generate training sample baseline behavior data according to all first training sample user behavior data and target second training sample user behavior data.

[0142] The target second training sample user behavior data is any second training sample user behavior data.

[0143] S403: Input the training sample baseline behavior data and the target second training sample user behavior data into the deep learning model, and output the predicted deviation value of the target second training sample user behavior data.

[0144] S404: Generate a predicted anomaly analysis result corresponding to the target second training sample user behavior data according to the predicted deviation value of the target second training sample user behavior data.

[0145] S405: Determine whether the error between the abnormality analysis result corresponding to the target second training sample user behavior data and the real abnormality analysis result corresponding to the target second training sample user behavior data satisfies a preset convergence condition.

[0146] The preset convergence condition is preset and changed by a technician or authorized staff and is not limited here.

[0147] It should be noted that, in the specific implementation process of the present application, it is not limited to using the preset convergence conditions to train the model, and the model can also be trained using a preset number of iterations, which is also not limited here.

[0148] Specifically, if it is determined that the error between the anomaly analysis result corresponding to the target second training sample user behavior data and the actual anomaly analysis result corresponding to the target second training sample user behavior data meets the preset convergence condition, step S406 is executed; if it is determined that the error between the anomaly analysis result corresponding to the target second training sample user behavior data and the actual anomaly analysis result corresponding to the target second training sample user behavior data does not meet the preset convergence condition, step S407 is executed.

[0149] S406: Use the deep learning model as a user behavior analysis model.

[0150] S407: Adjust the parameters in the deep learning model using the error between the abnormal analysis result corresponding to the target second training sample user behavior data and the real abnormal analysis result corresponding to the target second training sample user behavior data.

[0151] During the specific implementation of this application, if new attack features appear, the parameters of the existing model will be adjusted. For example, if the system finds that a new type of ransomware exhibits new features during an attack (such as abnormal file access frequency, specific file extension preference), the model parameters will be adjusted to make the model more sensitive to these new features. This can be achieved by fine-tuning the hyperparameters of the model. This application will also store newly detected ransomware behavior samples in a database, update the training sample set in a timely manner, and regularly use these samples to retrain the behavior model. This iterative training enables the model to gradually accumulate the characteristics of new ransomware and maintain the detection effect of the latest threats. After training, the model will be deployed to the monitoring system to replace the old model, so that the system responds to new threats more quickly.

[0152] S103: Associating the user's behavior data with the system process's behavior data according to a preset association relationship to obtain associated behaviors.

[0153] The preset association relationship is pre-set and modified by staff, experts, etc., and is not limited here. The preset association relationship includes but is not limited to permission association, file access mode association, application and process operation mode association, etc., and is not limited here.

[0154] Among them, permission association includes but is not limited to when a process is detected trying to elevate system permissions, the system will detect whether the user has the corresponding permissions. If the user's permission behavior has not changed but the process initiates permission escalation, there may be an anomaly; file access mode association includes but is not limited to when the user's behavior shows that it has accessed a specific directory, the system will further monitor whether the associated process is trying to access a large number of other files at the same time, or initiate abnormal file writing and encryption behaviors; application and process operation mode association includes but is not limited to if the user opens an application, but multiple associated processes initiate high-frequency file access or network connections at the same time, the system will mark it as a potential malicious behavior through association analysis to identify whether it meets the behavior chain of ransomware.

[0155] S104. With respect to the current attack stage of the ransomware, the weights of the associated behaviors are dynamically adjusted to obtain target weights of the associated behaviors.

[0156] Continuing with the above example, if in the initial infection stage, a higher weight is given to the process startup frequency and permission escalation request, and the associated user operation behavior is obtained at the same time. If there is no related user operation, the abnormal score is increased. If in the lateral movement stage, more attention is paid to the process's network connection request and the user's file access directory to determine whether it conforms to the normal operation mode; if in the encryption stage, if it is detected that the user behavior deviates from the norm and the process behavior is abnormal (such as accessing and writing a large number of files), the information of both will be combined for comprehensive analysis to determine whether there is ransomware encryption activity.

[0157] For example: In the initial infection stage, the system will increase the weight of malicious process startup and network communication behavior; the weight of malicious process and network communication behavior will increase by 30%-50%. At this stage, the system focuses on the abnormal increase of unauthorized process startup and unknown network connections; in the privilege escalation stage, the weight of operations involving privilege changes (such as the acquisition of administrative privileges) may increase by 50%-70%. This is because the risk of privilege change behavior is very high at this stage and requires highly sensitive detection; in the data encryption stage, the weight increase of file reading, writing and encryption behavior is usually between 70%-90%. This stage focuses on large-scale file operations or encryption library call behaviors to prevent ransomware from actually performing encryption operations. When ransomware calls system encryption libraries or third-party encryption APIs, the system can detect these call behaviors and apply higher weights during aggregate analysis. In general, the weight of encryption behavior will increase by 50%-80%, depending on the following factors: 1. The severity of the behavior: Encryption behavior is the core operation of ransomware, and the weight of encryption library and API calls is usually increased to ensure that any deviation in encryption operations is detected. 2. Security level set by the system: At a high security level, the weight of encryption behavior may be directly increased to 80% or higher; in a normal environment, it may be maintained at a 50%-60% increase to reduce the false positive rate. Through this mechanism, the system is able to capture key behaviors in the preparation stage of the ransomware before it actually performs encryption operations. API call monitoring: The system monitors API calls of all processes at runtime, especially encryption-related libraries (such as OpenSSL, AES, etc.). When an encryption call is detected, the system increases the aggregate weight by 80% to enhance sensitivity to encryption behavior. Ransomware usually attacks specific types of files (such as documents, spreadsheets, pictures). The system applies additional weights to these file extensions (such as .docx, xls, pdf, etc.) so that they can be identified first during the encryption process. For example, the system will pay special attention to large-scale read and write operations of these files in a short period of time.

[0158] Optionally, in another embodiment of the present application, an implementation of step S104 is as follows: Figure 5 As shown, including:

[0159] S501. If the current attack stage of the ransomware is the encryption stage, the number of file input and output operations and the number of sensitive directory input and output operations under the associated behavior are obtained.

[0160] S502: For each file, determine an aggregate score of the file according to the weight of the type to which the file belongs and the number of input and output operations of the file, and determine a second aggregate score according to the aggregate scores of all files.

[0161] It can be understood that the specific implementation of step S502 can refer to the specific implementation of steps S301 to S302, which will not be repeated here.

[0162] S503: For each sensitive directory, determine an aggregate score of the sensitive directory according to the weight of the sensitive directory and the number of input and output operations of the sensitive directory, and determine a third aggregate score according to the aggregate scores of all sensitive directories.

[0163] Understandably, ransomware usually targets critical data, such as user documents, corporate databases, etc. Apply higher weights to these sensitive directories to prioritize abnormal access and modification behaviors to these directories.

[0164] In the specific implementation process of this application, the third aggregate score (abnormal aggregate score of the high-risk file directory) can be calculated by the following calculation method: dir :

[0165] Among them, w dir Weights for sensitive directories, such as C: / Users / Documents, to ensure that file access behaviors to important directories such as "C: / Users / Documents" are detected and responded to first.

[0166] S504: Adjust the weight of the associated behavior according to the second aggregate score and the third aggregate score to obtain a target weight of the associated behavior.

[0167] Feed the second and third aggregate scores as independent modules to Computing module, Computing modules will be gradually integrated and output to form a more comprehensive threat score.

[0168] S105: Calculate a first threat score according to the associated behavior and the target weight of the associated behavior.

[0169] In the specific implementation process of this application, the following formula can be used to calculate the first threat score (abnormal behavior aggregation value under dynamic behavior aggregation):

[0170] Among them, w j (t) is a dynamic weight, which is adjusted according to the identified behavior stage to ensure that the system can prioritize features that are more sensitive to ransomware behavior at different attack stages;

[0171] f(b i，j ) represents the behavior vector B i The jth attribute b ofi，j A nonlinear transformation function for processing. This function is used to process the original behavior data (such as standardization, logarithm, weighting, etc.) so as to more accurately reflect the degree of abnormality in the aggregate calculation.

[0172] S106: If the first threat score is greater than the warning threshold, generate warning information.

[0173] Among them, the warning threshold is set and changed in advance by technicians, experts, etc. and is not limited here.

[0174] In the specific implementation process of this application, if it is determined that there is a ransomware attack, the relevant process or file operation can also be immediately blocked or isolated. For example, if the system finds that a process attempts to access a large number of sensitive directories and perform batch encryption operations, the system will immediately restrict the access rights of the process, or isolate it to a safe area to prevent the spread of infection. When abnormal behavior of a process is detected, the permissions of the process will be automatically restricted, such as revoking the administrative permissions of the process to prevent it from further accessing sensitive data in the file system.

[0175] In actual application scenarios, ransomware attacks often involve multiple continuous behavior stages. These behaviors may appear to be less threatening individually, but when combined together, they will present an obvious attack chain. Therefore, in another embodiment of the present application, if there are multiple continuous associated behaviors, then the user's behavior data and the system process's behavior data are associated according to a preset association relationship. After the associated behaviors are obtained, an implementation method of the ransomware defense method is as follows: Figure 6 As shown, it also includes:

[0176] S601. Aggregate all related behaviors to obtain a dynamic behavior chain.

[0177] S602: For each associated behavior in the dynamic behavior chain, dynamically adjust the weight of the associated behavior to obtain an aggregate weight of the associated behavior.

[0178] S603: Calculate a second threat score according to the time weighting factor, all associated behaviors, and the aggregate weights of the associated behaviors.

[0179] In the specific implementation process of this application, the second threat score can be calculated using the following calculation formula:

[0180] Among them, α t The time weighting factor ensures that the system aggregates and analyzes multiple recent abnormal behaviors to identify ransomware attack chains.

[0181] For example, when privilege escalation, system scanning, and encryption preparation are combined, the system will dynamically increase the aggregate weight of these behaviors, making the aggregate score or It is easier to reach the preset warning threshold. When the calculation result exceeds the threshold, the system automatically triggers the warning and issues an alarm in response to the potential ransomware attack. Quickly warn of potential ransomware attacks.

[0182] S604: If the second threat score is greater than the warning threshold, generate warning information.

[0183] In the actual application of this application, there may be repeated and similar ransomware attacks. Therefore, this application builds a database of common attack patterns (such as large-scale file modification, encryption library calls, etc.) by learning from historical ransomware attack behaviors. When the system detects similar behaviors, it automatically adjusts the aggregation weight to quickly respond to potential threats. Therefore, in another embodiment of this application, the user's behavior data and the system process's behavior data are associated according to a preset association relationship. After the associated behavior is obtained, an implementation method of the ransomware defense method is as follows: Figure 7 As shown, it also includes:

[0184] S701: vectorize the associated behavior to obtain an associated behavior vector.

[0185] S702: Compare the associated behavior vector with the historical attack vector in the attack pattern database to obtain a similarity comparison result.

[0186] In the specific implementation process of this application, similarity comparison can be completed by the following calculation formula:

[0187] Among them, V real is the associated behavior vector, V attack is the historical attack vector, and F is the similarity.

[0188] Specifically, when the calculated similarity is greater than a similarity threshold, it is determined that the current attack is similar to the historical attack; otherwise, it is determined that the current attack is not similar to the historical attack.

[0189] S703: If the similarity comparison result shows that the current attack is similar to the historical attack, determine the weight increase coefficient of the associated behavior according to the similarity between the associated behavior vector and the historical attack vector in the attack pattern database.

[0190] S704: Determine a target weight of the associated behavior according to the current weight of the associated behavior and the weight increase coefficient of the associated behavior.

[0191] In the specific implementation process of this application, the target weight of the associated behavior can be calculated according to the following calculation formula:

[0192] Among them, w j is the initial weight, and α is the weight increase coefficient, which is usually adjusted dynamically according to the similarity. It can be understood that the higher the similarity, the greater the weight increase coefficient.

[0193] In the specific implementation process of this application, an adaptive adjustment mechanism based on time decay can also be added: in the short term of attack pattern matching, the system keeps the weight increased; if there is no new matching behavior after a period of time (such as 15 minutes), the weight will decay back to the initial value at a certain ratio. This time decay adjustment can avoid continuous false alarms of the system and optimize the response sensitivity.

[0194] Through the above-mentioned adaptive weight adjustment mechanism, the present application can quickly increase the monitoring weight of related behaviors after detecting behaviors similar to historical attack patterns, thereby achieving rapid early warning and timely response to potential ransomware threats.

[0195] In the specific implementation process of this application, the following learning and matching formula can also be used to ensure that known threats can be handled first:

[0196] Among them, a p is the detected attack mode, w p is the historical learning weight. When it is greater than the similarity threshold, determine a p If it is a known threat, otherwise it is an unknown threat, the steps of obtaining the user's behavior data and the system process's behavior data in the above embodiment will be executed.

[0197] It should be noted that attack patterns refer to specific behavioral combination features learned from historical ransomware attacks, and are not completely equivalent to attack stages. They are usually specific behavioral combinations exhibited by ransomware in a certain stage or multiple stages. For example, attack patterns may include specific behavioral feature combinations such as "frequent file modification + encryption library call" or "privilege escalation request + network scanning + credential theft". Attack patterns are more detailed and focus on the combination of multiple behavioral features. These combinations can occur within a certain stage or across stages. They are specific combination features summarized after learning historical attack behaviors, while attack stages refer to the life cycle stages of attacks, and patterns can exist across stages.

[0198] From the above scheme, it can be seen that the present application provides a method for defending against ransomware, which determines the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data after obtaining the user's behavior data and the system process's behavior data; then, the user's behavior data and the system process's behavior data are associated according to a preset association relationship to obtain an associated behavior; for the current attack stage of the ransomware, the weight of the associated behavior is dynamically adjusted to obtain a target weight of the associated behavior; then, the first threat score is calculated according to the associated behavior and the target weight of the associated behavior; if the first threat score is greater than the warning threshold, a warning message is generated. This is to quickly respond to potential ransomware threats and effectively reduce possible economic losses.

[0199] The present application embodiment provides a ransomware defense device, such as Figure 8 As shown, specifically including:

[0200] The first acquisition unit 801 is used to acquire user behavior data and system process behavior data.

[0201] The attack stage determination unit 802 is used to determine the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data.

[0202] The association unit 803 is used to associate the user's behavior data with the system process's behavior data according to a preset association relationship to obtain associated behavior.

[0203] The first dynamic adjustment unit 804 is used to dynamically adjust the weight of the associated behavior according to the current attack stage of the ransomware to obtain a target weight of the associated behavior.

[0204] The first calculation unit 805 is used to calculate a first threat score according to the associated behavior and the target weight of the associated behavior.

[0205] The first warning unit 806 is configured to generate warning information if the first threat score is greater than a warning threshold.

[0206] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 1 As shown, no further description is given here.

[0207] As can be seen from the above scheme, the present application provides a ransomware defense device. After the first acquisition unit 801 acquires the user's behavior data and the system process's behavior data, the attack stage determination unit 802 determines the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data; then, the association unit 803 associates the user's behavior data and the system process's behavior data according to a preset association relationship to obtain an associated behavior; the first dynamic adjustment unit 804 dynamically adjusts the weight of the associated behavior according to the current attack stage of the ransomware to obtain a target weight of the associated behavior; then, the first calculation unit 805 calculates the first threat score according to the associated behavior and the target weight of the associated behavior; if the first threat score is greater than the warning threshold, the first warning unit 806 generates warning information. Thus, the purpose of quickly responding to potential ransomware threats is achieved, and possible economic losses are effectively reduced.

[0208] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0209] Another embodiment of the present application provides an electronic device, such as Fig. 9 As shown, including:

[0210] One or more processors 901.

[0211] The storage device 902 stores one or more programs.

[0212] When the one or more programs are executed by the one or more processors 901, the one or more processors 901 implement the method for defending against ransomware as described in any one of the above embodiments.

[0213] Another embodiment of the present application provides a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for defending against ransomware as described in any one of the above embodiments is implemented.

[0214] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0215] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0216] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0217] Another embodiment of the present application provides a computer program product, which, when executed, is used to execute the above-mentioned method for defending against ransomware.

[0218] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0219] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in this application is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing this application.

[0220] Although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present application. Certain features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0221] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A method for defending against ransomware, characterized in that: include: Obtain user behavior data and system process behavior data; Determine the current attack stage of the ransomware based on the user's behavior data and the system process's behavior data; Associating the user's behavior data with the system process's behavior data according to a preset association relationship to obtain associated behaviors; According to the current attack stage of the ransomware, the weight of the associated behavior is dynamically adjusted to obtain a target weight of the associated behavior; A first threat score is calculated based on the associated behavior and the target weight of the associated behavior; If the first threat score is greater than the warning threshold, a warning message is generated.

2. The method for defending against ransomware according to claim 1, characterized in that: Determining the current attack stage of the ransomware based on the user's behavior data and the system process's behavior data includes: Determine the abnormal analysis result of the current system process according to the number of file input and output operations in the behavior data of the system process; Generate baseline behavior data based on the user's behavior data and the user's historical behavior data; The user's behavior data and the baseline behavior data are input into a user behavior analysis model, and a user behavior deviation value is output; wherein the user behavior analysis model is obtained by training a deep learning model according to a training sample set; the training sample set includes N first training sample user behavior data, M second training sample user behavior data, and true abnormal analysis results corresponding to the second training sample user behavior data; N and M are positive integers; If the user behavior deviation value is greater than the deviation value threshold, and the current system process abnormality analysis result shows that there is an abnormality, it is determined that the current stage is encryption.

3. The method for defending against ransomware according to claim 2, characterized in that: Determining the abnormality analysis result of the current system process according to the number of file input and output operations in the behavior data of the system process includes: For each file in the behavior data of the system process, determine the aggregate score of the file according to the weight of the type to which the file belongs and the number of input and output operations of the file; Calculate a first aggregate score based on the aggregate scores of all the files; If the first aggregate score is greater than a first aggregate score threshold, it is determined that an abnormality exists in the current system process.

4. The method for defending against ransomware according to claim 2, characterized in that: The method for constructing the user behavior analysis model comprises: Constructing a training sample set; wherein the training sample set includes N first training sample user behavior data, M second training sample user behavior data, and real abnormality analysis results corresponding to the second training sample user behavior data; N and M are positive integers; Generate training sample baseline behavior data according to all first training sample user behavior data and target second training sample user behavior data; wherein the target second training sample user behavior data is any second training sample user behavior data; Inputting the training sample baseline behavior data and the target second training sample user behavior data into a deep learning model, and outputting a predicted deviation value of the target second training sample user behavior data; Generate a predicted anomaly analysis result corresponding to the target second training sample user behavior data according to the predicted deviation value of the target second training sample user behavior data; The parameters in the deep learning model are adjusted by using the error between the anomaly analysis result corresponding to the target second training sample user behavior data and the real anomaly analysis result corresponding to the target second training sample user behavior data, until the error between the anomaly analysis result corresponding to the target second training sample user behavior data and the real anomaly analysis result corresponding to the target second training sample user behavior data meets the preset convergence condition, and the deep learning model is used as the user behavior analysis model.

5. The method for defending against ransomware according to claim 2, characterized in that: The step of dynamically adjusting the weight of the associated behavior in the current attack phase of the ransomware to obtain the target weight of the associated behavior includes: If the current attack stage of the ransomware is the encryption stage, obtaining the number of file input and output operations and the number of sensitive directory input and output operations under the associated behavior; For each file, determine an aggregate score of the file according to the weight of the type to which the file belongs and the number of input and output operations of the file, and determine a second aggregate score according to the aggregate scores of all files; For each sensitive directory, determine an aggregate score of the sensitive directory according to the weight of the sensitive directory and the number of input and output operations of the sensitive directory, and determine a third aggregate score according to the aggregate scores of all sensitive directories; The weight of the associated behavior is adjusted according to the second aggregated score and the third aggregated score to obtain a target weight of the associated behavior.

6. The method for defending against ransomware according to claim 1, characterized in that: If there are multiple consecutive associated behaviors, the user's behavior data and the system process's behavior data are associated according to a preset association relationship, and after the associated behaviors are obtained, the method further includes: Aggregate all related behaviors to obtain a dynamic behavior chain; For each associated behavior in the dynamic behavior chain, dynamically adjust the weight of the associated behavior to obtain an aggregate weight of the associated behavior; A second threat score is calculated based on the time weighting factor, all associated behaviors, and the aggregate weight of the associated behaviors; If the second threat score is greater than the warning threshold, a warning message is generated.

7. The method for defending against ransomware according to claim 1, characterized in that: After associating the user's behavior data with the system process's behavior data according to a preset association relationship to obtain the associated behavior, the method further includes: Vectorizing the associated behavior to obtain an associated behavior vector; Comparing the associated behavior vector with the historical attack vector in the attack pattern database to obtain a similarity comparison result; If the similarity comparison result indicates that the current attack is similar to the historical attack, a weight increase coefficient of the associated behavior is determined according to the similarity between the associated behavior vector and the historical attack vector in the attack pattern database; The target weight of the associated behavior is determined according to the current weight of the associated behavior and the weight increase coefficient of the associated behavior.

8. A ransomware defense device, characterized in that: include: A first acquisition unit, used to acquire user behavior data and system process behavior data; An attack stage determination unit, used to determine the current attack stage of the ransomware according to the user's behavior data and the system process's behavior data; An association unit, used to associate the user's behavior data with the system process's behavior data according to a preset association relationship to obtain an associated behavior; A first dynamic adjustment unit is used to dynamically adjust the weight of the associated behavior according to the current attack stage of the ransomware to obtain a target weight of the associated behavior; A first calculation unit, configured to calculate a first threat score according to the associated behavior and the target weight of the associated behavior; The first warning unit is configured to generate warning information if the first threat score is greater than a warning threshold.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method for defending against ransomware as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method for defending against ransomware as claimed in any one of claims 1 to 7 is implemented.

Images