Ransomware virus identification and judgment method based on reference page

Abstract

The invention relates to the technical field of network security, in particular to a ransomware identification and judgment method based on a reference page, which comprises the following steps of: S1, receiving the reference page, extracting sending information of the reference page, comparing the sending information with storage information in an information base, if the sending information is matched with the storage information, sending the reference page into an identification classification model, and if the sending information is matched with the storage information, sending the identification classification model into a database; the identification classification model identifies and judges the reference page, and if the judgment result is ransomware, the reference page is deleted; and S2, if the sending information is not matched with the storage information, sending the reference page into a sandbox, constructing a bait file, sending the bait file into the sandbox, carrying out anomaly detection through matching of a malicious feature library and a normal behavior feature library, and outputting each anomaly detection result, the method can effectively solve the problems that an existing ransomware recognition and judgment method is poor in detection accuracy, ransomware in a reference page cannot be effectively recognized and judged, and a network cannot be well protected.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for identifying and judging a ransomware virus based on a reference page. Background Art

[0002] Computer viruses are man-made programs that are destructive, contagious, and latent, and can damage computer information or systems. They are recognized as the number one enemy of data security. Any computer virus that invades the system will have varying degrees of impact on the system and applications. At the very least, it will reduce computer efficiency and occupy system resources. At worst, it can cause data loss and system crashes. Ransomware is a new type of computer virus that is mainly spread in the form of emails, program Trojans, and web page Trojans. The virus is vile and extremely harmful. Once infected, it will cause immeasurable losses to users. The virus uses various encryption algorithms to encrypt files, and then pops up a window to ask the user of the infected computer for cryptocurrency. Users generally cannot decrypt it, and need to purchase cryptocurrency to get the decryption private key for cracking. Otherwise, the file can no longer be read and used normally. Ransomware is often spread through emails, applets, reference pages, etc.

[0003] However, the existing ransomware identification and judgment methods still have shortcomings. Specifically, the existing ransomware identification and judgment methods have poor detection accuracy, are unable to effectively identify and judge the ransomware in the referenced page, and cannot provide good protection for the network.

[0004] Therefore, a method for identifying and judging ransomware based on a reference page is needed to solve the problems raised in the above background technology. Summary of the invention

[0005] The purpose of the present invention is to provide a method for identifying and judging ransomware viruses based on reference pages to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for identifying and judging a ransomware virus based on a reference page includes the following steps:

[0008] S1, receiving the reference page, extracting the sending information of the reference page, comparing the sending information with the stored information in the information library, and if the sending information matches the stored information, sending the reference page to the recognition and classification model, and the recognition and classification model identifies and judges the reference page. If the judgment result is a ransomware virus, the reference page is deleted;

[0009] S2, if the sent information does not match the stored information, the reference page is sent into the sandbox, a bait file is constructed and sent into the sandbox, the reference page is opened, the bait file and directory are monitored, the reference page's operation behavior on the file or directory is recorded, the operation behavior is analyzed to extract behavior features, anomaly detection is performed on the bait file and operation method, and anomaly detection is performed by matching the malicious feature library with the normal behavior feature library, and each anomaly detection result is output;

[0010] S3. Determine whether the corresponding operation application of the reference page is a ransomware virus based on the detection result. If so, mark the IP address of the reference page, send the marked IP address to the information database for storage, and delete the reference page. If not, start executing the reference page.

[0011] As a preferred solution of the present invention, the S1 sending information includes the sending IP address and sending time of the reference page, and the weighted average method is used to calculate the matching degree between the sending information and the stored information in the information library during the comparison process.

[0012] As a preferred solution of the present invention, the identification and classification model construction method in S1 is: obtaining multiple groups of ransomware virus samples, analyzing the memory image data of the ransomware virus samples, and performing redundant preprocessing of the memory image data, the kernel monitors the ransomware virus IRP action sequence, and fuses the preprocessed memory image data with the IRP sequence data, and converts the fused data into an RGB color image, and archives the RGB color image into a similar ransomware virus image library, and randomly selects image pairs from the image library, and labels them to form positive sample pairs and negative sample pairs, prepares training and test data sets, and inputs paired hidden ransomware virus image data and labels into a twin convolutional neural network, trains and tests the model until the test result is lower than a specified threshold, fixes the model parameters, and obtains an identification and classification model.

[0013] As a preferred solution of the present invention, the sandbox in S2 is a Cuckoo sandbox in Cukoohost or AnalysisGuest mode, and the abnormality detection of the operation method includes recycle bin input abnormality detection, file name modification abnormality detection and file addition abnormality detection.

[0014] As a preferred solution of the present invention, the specific operation process of abnormal detection on the bait file in S2 is: set the bait file name to the smallest number or ASCII small character, place the bait file in a directory under a directory name with a small ASCII character under a non-system disk, analyze the behavioral characteristics, and whether there is an application that operates the bait file. If so, determine the application that operates the bait file and output 1, otherwise output 0.

[0015] As a preferred solution of the present invention, the specific method for performing anomaly detection through a malicious feature library in S2 is: packing the collected ransomware application hash values ​​together, constructing a static malicious feature library, generating static features of the application, and performing an anomaly comparison between the static features and the static malicious features. If an anomaly occurs, output 1, otherwise output 0.

[0016] As a preferred solution of the present invention, the method for anomaly detection through matching of a normal behavior feature library in S2 is: obtaining an operation domain set under normal mode through automated analysis, analyzing behavior characteristics, performing feature extraction on application operation behaviors, obtaining an operation domain set of operation behaviors, and performing an anomaly comparison between the operation domain set of operation behaviors and the operation domain set under normal mode; if an anomaly occurs, output 1, otherwise output 0.

[0017] As a preferred solution of the present invention, the specific method of S3 judging whether the corresponding operation application of the reference page is a ransomware virus according to the detection results is: if the output results of the three items of bait file anomaly detection, malicious feature library anomaly detection and normal behavior feature library matching anomaly detection are all 1, it indicates that there is a ransomware virus in the reference page; if any one of the output results of the three items of bait file anomaly detection, malicious feature library anomaly detection and normal behavior feature library matching anomaly detection is 0, it indicates that there is no ransomware virus in the reference page.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] 1. In the present invention, by receiving a reference page, extracting the sending information of the reference page, comparing the sending information with the stored information in the information library, if the sending information matches the stored information, sending the reference page to the recognition and classification model, the recognition and classification model identifies and judges the reference page, if the judgment result is a ransomware virus, the reference page is deleted, if the sending information does not match the stored information, the reference page is sent to the sandbox, a bait file is constructed and sent to the sandbox, the reference page is opened, the bait file and directory are monitored, the operation behavior of the reference page on the file or directory is recorded, the operation behavior is analyzed to extract the behavior characteristics, and the bait is detected. The method performs anomaly detection on bait files and operation methods, and performs anomaly detection by matching malicious feature libraries with normal behavior feature libraries, outputs various anomaly detection results, and determines whether the corresponding operation application of the reference page is a ransomware virus based on the detection results. If so, the IP address of the reference page is marked, and the marked IP address is sent to the information database for storage, and the reference page is deleted at the same time. If not, the reference page is executed, which solves the problem that the existing ransomware virus identification and judgment methods have poor detection accuracy, cannot effectively identify and judge the ransomware virus in the reference page, and cannot provide good protection for the network. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0022] Embodiment, the present invention provides a technical solution:

[0023] A method for identifying and judging a ransomware virus based on a reference page includes the following steps:

[0024] S1, receiving the reference page, extracting the sending information of the reference page, comparing the sending information with the stored information in the information library, and if the sending information matches the stored information, sending the reference page to the recognition and classification model, and the recognition and classification model identifies and judges the reference page. If the judgment result is a ransomware virus, the reference page is deleted;

[0025] S2, if the sent information does not match the stored information, the reference page is sent into the sandbox, a bait file is constructed and sent into the sandbox, the reference page is opened, the bait file and directory are monitored, the reference page's operation behavior on the file or directory is recorded, the operation behavior is analyzed to extract behavior features, anomaly detection is performed on the bait file and operation method, and anomaly detection is performed by matching the malicious feature library with the normal behavior feature library, and each anomaly detection result is output;

[0026] S3. Determine whether the corresponding operation application of the reference page is a ransomware virus based on the detection result. If so, mark the IP address of the reference page, send the marked IP address to the information database for storage, and delete the reference page. If not, start executing the reference page.

[0027] Furthermore, the S1 sending information includes the sending IP address and sending time of the referenced page, and the weighted average method is used to calculate the matching degree between the sending information and the stored information in the information database during the comparison process.

[0028] Furthermore, the identification and classification model construction method in S1 is: obtaining multiple groups of ransomware samples, analyzing the memory image data of the ransomware samples, and performing redundant preprocessing of the memory image data, the kernel monitors the ransomware IRP action sequence, and fuses the preprocessed memory image data with the IRP sequence data, and converts the fused data into an RGB color image, and archives the RGB color image into a similar ransomware image library, and randomly selects image pairs from the image library, and labels them to form positive sample pairs and negative sample pairs, prepares training and test data sets, and inputs paired hidden ransomware image data and labels into a twin convolutional neural network, trains and tests the model until the test result is lower than a specified threshold, fixes the model parameters, and obtains an identification and classification model.

[0029] Furthermore, the sandbox in S2 is a Cuckoo sandbox in Cukoohost or AnalysisGuest mode, and the abnormality detection on the operation method includes recycle bin input abnormality detection, file name modification abnormality detection and file addition abnormality detection.

[0030] Furthermore, the specific operation process of performing abnormal detection on the bait file in S2 is: setting the bait file name to the smallest number or character with the smallest ASCII value, placing the bait file in a directory with a directory name with the smallest ASCII value under a non-system disk, analyzing the behavioral characteristics, whether there is an application that operates the bait file, if so, determining the application that operates the bait file, and outputting 1, otherwise outputting 0.

[0031] Furthermore, the specific method for performing anomaly detection through the malicious feature library in S2 is: packing the collected ransomware application hash values ​​together, constructing a static malicious feature library, generating static features of the application, and performing an anomaly comparison between the static features and the static malicious features. If an anomaly occurs, output 1, otherwise output 0.

[0032] Furthermore, the method for anomaly detection through matching the normal behavior feature library in S2 is: obtaining the operation domain set under the normal mode through automated analysis, analyzing the behavior characteristics, performing feature extraction on the application operation behavior, obtaining the operation domain set of the operation behavior, and performing an anomaly comparison between the operation domain set of the operation behavior and the operation domain set under the normal mode; if an anomaly occurs, output 1, otherwise output 0.

[0033] Furthermore, the specific method of S3 judging whether the corresponding operation application of the reference page is a ransomware virus according to the detection result is: if the output results of the bait file anomaly detection, the malicious feature library anomaly detection and the normal behavior feature library matching anomaly detection are all 1, it indicates that there is a ransomware virus in the reference page; if any one of the output results of the bait file anomaly detection, the malicious feature library anomaly detection and the normal behavior feature library matching anomaly detection is 0, it indicates that there is no ransomware virus in the reference page.

[0034] Specific implementation cases

[0035] Obtain multiple groups of ransomware samples, analyze the memory image data of the ransomware samples, and perform redundant preprocessing of the memory image data. The kernel monitors the ransomware IRP action sequence, fuses the preprocessed memory image data with the IRP sequence data, and converts the fused data into RGB color images. The RGB color images are archived in a similar ransomware image library, and image pairs are randomly selected from the image library and labeled to form positive sample pairs and negative sample pairs. Prepare training and test data sets, input paired hidden ransomware image data and labels into the twin convolutional neural network, train and test the model until the test result is lower than the specified threshold, fix the model parameters, and obtain the recognition and classification model.

[0036] Receive the reference page, extract the sending information of the reference page, the sending information includes the sending IP address and sending time of the reference page, compare the sending information with the stored information in the information database, and use the weighted average method to calculate the matching degree between the two. If the sending information matches the stored information, send the reference page to the recognition and classification model, and the recognition and classification model will identify and judge the reference page. If the judgment result is a ransomware virus, the reference page will be deleted;

[0037] If the sent information does not match the stored information, the reference page is sent to a sandbox, which is a Cuckoo sandbox in Cukoohost or AnalysisGuest mode. A decoy file is constructed and sent to the sandbox. The reference page is opened, the decoy file and directory are monitored, the reference page's operation behavior on the file or directory is recorded, and the operation behavior is analyzed to extract behavior features.

[0038] Perform anomaly detection on the bait file, set the bait file name to the smallest number or ASCII character, place the bait file in a directory with a small ASCII directory name on a non-system disk, analyze the behavior characteristics, and see if there is an application that operates the bait file. If so, determine the application that operates the bait file and output 1, otherwise output 0

[0039] Perform anomaly detection on the operation method for Recycle Bin input, file name modification, and file addition;

[0040] Anomaly detection is performed through the malicious feature library. The collected ransomware application hash values ​​are packaged together to construct a static malicious feature library, generate static features of the application, and compare the static features with the static malicious features for anomalies. If an anomaly occurs, 1 is output, otherwise 0 is output;

[0041] Anomaly detection is performed by matching the normal behavior feature library. The operation domain set in the normal mode is obtained through automatic analysis. The behavior features are analyzed, and the feature extraction of the application operation behavior is performed to obtain the operation domain set of the operation behavior. The operation domain set of the operation behavior is compared with the operation domain set in the normal mode for anomalies. If an anomaly occurs, 1 is output, otherwise 0 is output, and each anomaly detection result is obtained and output;

[0042] If the output results of the bait file anomaly detection, malicious feature library anomaly detection, and normal behavior feature library matching anomaly detection are all 1, it indicates that there is a ransomware virus in the reference page. The IP address of the reference page is marked, the marked IP address is sent to the information database for storage, and the reference page is deleted at the same time;

[0043] If any of the output results of the bait file anomaly detection, malicious feature library anomaly detection, and normal behavior feature library matching anomaly detection is 0, it indicates that there is no ransomware virus in the reference page, and the reference page begins to be executed.

[0044] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for identifying and judging ransomware based on reference pages, characterized in that: The following steps are involved: S1, receiving the reference page, extracting the sending information of the reference page, comparing the sending information with the stored information in the information library, and if the sending information matches the stored information, sending the reference page to the recognition and classification model, and the recognition and classification model identifies and judges the reference page. If the judgment result is a ransomware virus, the reference page is deleted; S2, if the sent information does not match the stored information, the reference page is sent into the sandbox, a bait file is constructed and sent into the sandbox, the reference page is opened, the bait file and directory are monitored, the reference page's operation behavior on the file or directory is recorded, the operation behavior is analyzed to extract behavior features, anomaly detection is performed on the bait file and operation method, and anomaly detection is performed by matching the malicious feature library with the normal behavior feature library, and each anomaly detection result is output; S3. Determine whether the corresponding operation application of the reference page is a ransomware virus based on the detection result. If so, mark the IP address of the reference page, send the marked IP address to the information database for storage, and delete the reference page. If not, start executing the reference page.

2. According to claim 1, a method for identifying and judging a ransomware virus based on a reference page is characterized in that: The S1 sending information includes the sending IP address and sending time of the reference page. During the comparison between the sending information and the stored information in the information database, a weighted average method is used to calculate the matching degree between the two.

3. According to claim 1, a method for identifying and judging a ransomware virus based on a reference page is characterized in that: The identification and classification model construction method in S1 is: obtaining multiple groups of ransomware virus samples, analyzing the memory image data of the ransomware virus samples, and performing redundant preprocessing of the memory image data, the kernel monitors the ransomware virus IRP action sequence, and fuses the preprocessed memory image data with the IRP sequence data, and converts the fused data into an RGB color image, and archives the RGB color image into a similar ransomware virus image library, and randomly selects image pairs from the image library, and labels them to form positive sample pairs and negative sample pairs, prepares training and test data sets, and inputs paired hidden ransomware virus image data and labels into a twin convolutional neural network, trains and tests the model until the test result is lower than a specified threshold, fixes the model parameters, and obtains an identification and classification model.

4. According to claim 1, a method for identifying and judging a ransomware virus based on a reference page is characterized in that: The sandbox in S2 is a Cuckoo sandbox in Cukoohost or AnalysisGuest mode, and the abnormality detection of the operation method includes recycling bin input abnormality detection, file name modification abnormality detection and file addition abnormality detection.

5. According to claim 1, a method for identifying and judging a ransomware virus based on a reference page is characterized in that: The specific operation process of performing abnormal detection on the bait file in S2 is: set the bait file name to the smallest number or ASCII small character, place the bait file in a directory with a small ASCII directory name under a non-system disk, analyze the behavioral characteristics, and whether there is an application that operates the bait file. If so, determine the application that operates the bait file and output 1, otherwise output 0.

6. According to the method for identifying and judging a ransomware virus based on a reference page according to claim 1, it is characterized in that: The specific method of performing anomaly detection through the malicious feature library in S2 is: packing the collected ransomware application hash values ​​together, constructing a static malicious feature library, generating static features of the application, and performing an anomaly comparison between the static features and the static malicious features. If an anomaly occurs, output 1, otherwise output 0.

7. According to claim 1, a method for identifying and judging a ransomware virus based on a reference page is characterized in that: The method for anomaly detection by matching the normal behavior feature library in S2 is: obtaining the operation domain set under the normal mode through automatic analysis, analyzing the behavior characteristics, extracting features of the application operation behavior, obtaining the operation domain set of the operation behavior, and comparing the operation domain set of the operation behavior with the operation domain set under the normal mode for anomalies. If an anomaly occurs, output 1, otherwise output 0.

8. According to claim 1, a method for identifying and judging a ransomware virus based on a reference page is characterized in that: The specific method of S3 judging whether the corresponding operation application of the reference page is a ransomware virus according to the detection result is: if the output results of the bait file anomaly detection, the malicious feature library anomaly detection and the normal behavior feature library matching anomaly detection are all 1, it indicates that there is a ransomware virus in the reference page; if any one of the output results of the bait file anomaly detection, the malicious feature library anomaly detection and the normal behavior feature library matching anomaly detection is 0, it indicates that there is no ransomware virus in the reference page.