Discovery method and system based on inducible mail ransomware virus

Abstract

The invention relates to the technical field of network security, in particular to an inducible mail ransomware virus-based discovery method, which comprises the following steps of: S1, receiving a mail, sending the mail into a sandbox, extracting binary executable file embedded information in the mail, screening out key characters in the information, and utilizing a weighting algorithm to obtain a binary executable file; key characters screened out of the information are matched with information in a ransomware information base for judgment, if the matching value of the key characters and the information in the ransomware information base exceeds a safety threshold value, it is indicated that the mail contains existing ransomware in the ransomware information base, and the sandbox and the internal file are sent into a deletion program together; and S2, if the matching degree of the key characters screened out of the information and the information in the ransomware information base is lower than a security threshold, the problems that the ransomware in an existing inducible mail is well disguised, the recognition success rate of a conventional discovery method is low, and a secure network environment cannot be provided for a user can be effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a discovery method and system based on an induced email ransomware virus. Background Art

[0002] Ransomware is one of the network security threats that has grown rapidly and caused great harm in recent years. It is a kind of malicious software that criminals use to hijack user files and other assets or resources by encrypting files, locking screens, etc., and use them to extort money from users. Ransomware is also called ransomware virus. Criminals use phishing methods such as sending emails to implant ransomware into victim computers or servers to encrypt documents on the hard disk or even the entire hard disk. They then demand ransoms of varying amounts from the victim companies or individuals before decrypting them. Ransomware viruses are generally spread through misleading emails.

[0003] However, the existing ransomware detection methods still have shortcomings. Specifically, the ransomware in the existing misleading emails is well disguised, and the recognition success rate of conventional detection methods is low, which cannot provide users with a safe network environment.

[0004] Therefore, a method and system for discovering an induced email ransomware virus is needed to solve the problems raised in the above background technology. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for discovering an inducement-based email ransomware virus to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for discovering an inducement-type email ransomware virus comprises the following steps:

[0008] S1, receiving the email, sending the email to the sandbox, extracting the embedded information of the binary executable file in the email, filtering out the key characters in the information, and using the weighted algorithm to match the key characters filtered out in the information with the information in the ransomware virus information library. If the matching value of the two exceeds the safety threshold, it indicates that the email contains the ransomware virus already in the virus library, and the sandbox and internal files are sent to the deletion program together;

[0009] S2: If the matching degree between the key characters screened out in the information and the information in the ransomware information library is lower than the safety threshold, separate the body and attachments in the email in the sandbox, create a bait file in the sandbox, calculate the average information entropy of the bait file, put the bait file in the sandbox, run the body and attachments separately, open the watchdog library and continuously monitor the bait file. When an abnormal state occurs, calculate the average information entropy of the current bait file and compare it with the average information entropy calculated initially. If the difference between the two exceeds the preset value, it is confirmed that the current process is threatened, extract the key information of the files in the sandbox, input the extracted key information into the ransomware information library, and send the sandbox and internal files to the deletion program together;

[0010] S3 opens the highest permissions of the operating system to the deletion program, extends the command language interpreter instruction set of the deletion program, and uses the instructions in the extended instruction set to delete the sandbox containing the ransomware virus.

[0011] As a preferred solution of the present invention, the specific method for extracting embedded information of a binary executable file in an email in S1 is: parsing the binary executable file structure in the email, determining whether the binary executable file structure contains embedded images, and if so, extracting all embedded image information, including metadata information, attribute information, and text information in the image.

[0012] As a preferred solution of the present invention, the method for establishing the ransomware virus information library in S1 is: obtaining a ransomware virus sample, collecting the API function sequence of the ransomware virus sample, using the API function sequence to statically scan the static file features of the ransomware virus sample, and matching them with the rule library to identify the characteristic information and storage location of the ransomware virus, and classifying the ransomware virus samples into storage libraries of different levels according to the characteristic information and storage location to establish a ransomware virus information library.

[0013] As a preferred solution of the present invention, the specific method for matching the key characters screened out from the information with the information in the ransomware virus information library in S1 is: counting the number of matches between the ransomware keyword information of the sample to be tested and the information of each repository in the ransomware virus information library, using each matching number and the weight value of the corresponding reputation library, according to a weighted algorithm, calculating the detection weight of the sample to be tested, comparing the detection weight with a preset standard detection threshold, and obtaining a matching degree value.

[0014] As a preferred solution of the present invention, the calculation formula of the average information entropy in S2 is: in represents the average information entropy, m represents the total number of files in the sandbox, Indicates the proportionality coefficient, E j1 represents the information entropy of the j-th file header, Ej2 represents the information entropy of the remaining part of the jth file, p ji represents the probability of the i-th information in the j-th file appearing; n j1 、n j2 Indicates the number of types of information that appear in the file header and the rest of the file of the jth file, K=1,2.

[0015] As a preferred solution of the present invention, the bait file in S2 is generated according to the application or system directory, the bait file name is the smallest number or small ASCII character, and the file sizes of the generated multiple bait files are different.

[0016] As a preferred solution of the present invention, the abnormal state occurring in S2 includes the corresponding operations of files in the directory being moved, new files in the directory being created, files in the directory being deleted and / or files in the directory being modified.

[0017] A discovery system based on induced email ransomware virus, including

[0018] The information base establishment module is used to establish a ransomware information base based on existing ransomware samples;

[0019] Extraction and judgment module, extract key information characters of files in emails and match them with ransomware information database;

[0020] The bait judgment module creates a bait folder in the sandbox and judges the operation of the bait file based on the files in the email;

[0021] The deletion module uses the instructions in the instruction set to delete the sandbox containing the ransomware.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] 1. In the present invention, by receiving an email, sending the email into a sandbox, extracting the embedded information of the binary executable file in the email, screening out the key characters in the information, using a weighted algorithm, matching and judging the key characters screened out in the information with the information in the ransomware virus information library, if the matching value of the two exceeds the safety threshold, it indicates that the email contains the ransomware virus already in the virus library, and the sandbox and the internal files are sent to the deletion program together, if the matching degree of the key characters screened out in the information and the information in the ransomware virus information library is lower than the safety threshold, the body and attachments in the email in the sandbox are separated, a bait file is established in the sandbox, the average information entropy of the bait file is calculated, the bait file is placed in the sandbox, the body and attachments are run respectively, the watchdog library is opened and the bait file is continuously monitored, and when an abnormal state occurs, the average information entropy of the current bait file is calculated and compared with the average information entropy obtained by the initial calculation, if the two are different When the distance exceeds the preset value, it is confirmed that there is a threat to the current process, and the key information of the files in the sandbox is extracted, and the extracted key information is input into the ransomware virus information library, and the sandbox and the internal files are sent to the deletion program together, and the relationship information of the existing ransomware virus samples is used to search the email, which can effectively detect the ransomware virus that matches it in the email. After the email passes the search of the virus information library, the decoy file is used to lure out the virus with better concealment in the email to run, which can effectively improve the recognition success rate of the ransomware virus hidden deep inside the sub-email, and at the same time, the identified virus key information is input into the information library, which increases the information richness of the information library and improves the next detection success rate of the virus information library. The entire recognition process is carried out in the sandbox and will not affect the external program. It solves the problem that the ransomware virus in the existing decoy email is well disguised, the recognition success rate of the conventional discovery method is low, and it cannot provide users with a safe network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a schematic diagram of the system block structure of the present invention. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] To facilitate understanding of the present invention, the present invention will be described more comprehensively below with reference to the relevant drawings. Several embodiments of the present invention are given. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0027] It should be noted that when an element is referred to as being "fixed on" another element, it may be directly on the other element or there may also be a central element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may also be a central element. The terms "vertical", "horizontal", "left", "right" and similar expressions used in this article are for illustrative purposes only.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0029] For examples, see Figure 1 , the present invention provides a technical solution:

[0030] A discovery method based on an inducement-type email ransomware virus, the following steps:

[0031] S1, receiving the email, sending the email to the sandbox, extracting the embedded information of the binary executable file in the email, filtering out the key characters in the information, and using the weighted algorithm to match the key characters filtered out in the information with the information in the ransomware virus information library. If the matching value of the two exceeds the safety threshold, it indicates that the email contains the ransomware virus already in the virus library, and the sandbox and internal files are sent to the deletion program together;

[0032] S2: If the matching degree between the key characters screened out in the information and the information in the ransomware information library is lower than the safety threshold, separate the body and attachments in the email in the sandbox, create a bait file in the sandbox, calculate the average information entropy of the bait file, put the bait file in the sandbox, run the body and attachments separately, open the watchdog library and continuously monitor the bait file. When an abnormal state occurs, calculate the average information entropy of the current bait file and compare it with the average information entropy calculated initially. If the difference between the two exceeds the preset value, it is confirmed that the current process is threatened, extract the key information of the files in the sandbox, input the extracted key information into the ransomware information library, and send the sandbox and internal files to the deletion program together;

[0033] S3 opens the highest permissions of the operating system to the deletion program, extends the command language interpreter instruction set of the deletion program, and uses the instructions in the extended instruction set to delete the sandbox containing the ransomware virus.

[0034] Furthermore, the specific method for extracting embedded information of the binary executable file in the email in S1 is: parsing the binary executable file structure in the email, determining whether the binary executable file structure contains embedded images, and if so, extracting all embedded image information, including metadata information, attribute information and text information in the image.

[0035] Furthermore, the method for establishing the ransomware information library in S1 is: obtaining a ransomware sample, collecting the API function sequence of the ransomware sample, using the API function sequence to statically scan the static file features of the ransomware sample, and matching them with the rule library to identify the characteristic information and storage location of the ransomware, and classifying the ransomware samples into different levels of storage libraries according to the characteristic information and storage location to establish a ransomware information library.

[0036] Furthermore, the specific method for matching the key characters screened out from the information with the information in the ransomware information library in S1 is: counting the number of matches between the ransomware keyword information of the sample to be tested and the information of each repository in the ransomware information library, using the number of matches and the weight value of the corresponding reputation library, according to the weighted algorithm, calculating the detection weight of the sample to be tested, comparing the detection weight with the preset standard detection threshold, and obtaining a matching degree value.

[0037] Furthermore, the calculation formula of the average information entropy in S2 is: in represents the average information entropy, m represents the total number of files in the sandbox, Indicates the proportionality coefficient, E j1 represents the information entropy of the j-th file header, E j2 represents the information entropy of the remaining part of the jth file, p ji represents the probability of the i-th information in the j-th file appearing; n j1 、n j2 Indicates the number of types of information that appear in the file header and the rest of the file of the jth file, K=1,2.

[0038] Furthermore, the bait file in S2 is generated according to the application or system directory, the bait file name is the smallest number or small ASCII character, and the file sizes of the generated multiple bait files are different.

[0039] Furthermore, the abnormal state occurring in S2 includes corresponding operations of files in the directory being moved, new files in the directory being created, files in the directory being deleted, and / or files in the directory being modified.

[0040] A discovery system based on induced email ransomware virus, including

[0041] The information base establishment module is used to establish a ransomware information base based on existing ransomware samples;

[0042] The extraction and judgment module extracts the key information characters of the files in the email and matches them with the ransomware information database;

[0043] The bait judgment module creates a bait folder in the sandbox and judges the operation of the bait file based on the files in the email;

[0044] The deletion module uses the instructions in the instruction set to delete the sandbox containing the ransomware.

[0045] Specific implementation cases

[0046] The information base establishment module obtains the ransomware virus samples and collects the API function sequences of the ransomware virus samples. The information base establishment module uses the API function sequences to statically scan the static file features of the ransomware virus samples and matches them with the rule base to identify the feature information and storage location of the ransomware virus. The information base establishment module classifies the ransomware virus samples into different levels of storage libraries according to the feature information and storage location to establish a ransomware virus information library.

[0047] Receive the email, and the extraction and judgment module sends the email to the sandbox. The extraction and judgment module parses the binary executable file structure in the email and determines whether the binary executable file structure contains embedded images. If it contains embedded images, all embedded image information is extracted, including metadata information, attribute information and text information in the image, and key characters in the information are screened out;

[0048] The extraction and judgment module counts the number of matches between the ransom keyword information of the sample to be tested and the information of each repository in the ransomware virus information library, and uses the number of matches and the weight value of the corresponding reputation library to calculate the detection weight of the sample to be tested according to the weighted algorithm, and compares the detection weight with the preset standard detection threshold to obtain the matching degree value. If the matching value of the two exceeds the safety threshold, it indicates that the email contains the ransomware virus already in the virus library, and the extraction and judgment module sends the sandbox and internal files to the deletion program together;

[0049] If the matching degree between the key characters screened out in the information and the information in the ransomware information database is lower than the safety threshold, the extraction judgment module separates the body and attachments in the email in the sandbox;

[0050] The bait judgment module generates bait files in the sandbox according to the application or system directory. The bait file name is the smallest number or ASCII character, and the file sizes of the generated multiple bait files are different. The average information entropy of the bait file is calculated, and the bait file is placed in the sandbox. The main text and attachments are run separately, and the watchdog library is opened to continuously monitor the bait file. When abnormal conditions such as files in the directory being moved, new files in the directory being created, files in the directory being deleted, and / or files in the directory being modified occur, the average information entropy of the current bait file is calculated. The calculation formula for the average information entropy is: in represents the average information entropy, m represents the total number of files in the sandbox, Indicates the proportionality coefficient, E j1 represents the information entropy of the j-th file header, E j2 represents the information entropy of the remaining part of the jth file, p ji represents the probability of the i-th information in the j-th file appearing; n j1 、n j2 Indicates the number of types of information that appear in the file header and the rest of the file of the jth file, K = 1, 2;

[0051] Compare it with the average information entropy calculated initially. If the difference between the two exceeds the preset value, it is confirmed that there is a threat in the current process, and the key information of the files in the sandbox is extracted. The extracted key information is input into the ransomware information library, and the sandbox and the internal files are sent to the deletion module together.

[0052] The highest permissions of the operating system are opened to the deletion module, the deletion module extends the command language interpreter instruction set, and the instructions in the extended instruction set are used to delete the sandbox containing the ransomware virus.

[0053] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for discovering an induced email ransomware virus, characterized in that: The following steps are involved: S1, receiving the email, sending the email to the sandbox, extracting the embedded information of the binary executable file in the email, filtering out the key characters in the information, and using the weighted algorithm to match the key characters filtered out in the information with the information in the ransomware virus information library. If the matching value of the two exceeds the safety threshold, it indicates that the email contains the ransomware virus already in the virus library, and the sandbox and internal files are sent to the deletion program together; S2: If the matching degree between the key characters screened out in the information and the information in the ransomware information library is lower than the safety threshold, separate the body and attachments in the email in the sandbox, create a bait file in the sandbox, calculate the average information entropy of the bait file, put the bait file in the sandbox, run the body and attachments separately, open the watchdog library and continuously monitor the bait file. When an abnormal state occurs, calculate the average information entropy of the current bait file and compare it with the average information entropy calculated initially. If the difference between the two exceeds the preset value, it is confirmed that the current process is threatened, extract the key information of the files in the sandbox, input the extracted key information into the ransomware information library, and send the sandbox and internal files to the deletion program together; S3 opens the highest permissions of the operating system to the deletion program, extends the command language interpreter instruction set of the deletion program, and uses the instructions in the extended instruction set to delete the sandbox containing the ransomware virus.

2. A method for discovering an induced email ransomware virus according to claim 1, characterized in that: The specific method for extracting the embedded information of the binary executable file in the email in S1 is: parsing the binary executable file structure in the email, determining whether the binary executable file structure contains embedded pictures, and if so, extracting all the embedded picture information, including metadata information, attribute information and text information in the picture.

3. A method for discovering an induced email ransomware virus according to claim 1, characterized in that: The method for establishing the ransomware information library in S1 is as follows: obtaining a ransomware sample, collecting an API function sequence of the ransomware sample, using the API function sequence to statically scan the static file features of the ransomware sample, and matching them with a rule library to identify the feature information and storage location of the ransomware, and classifying the ransomware sample into storage repositories of different levels according to the feature information and storage location to establish a ransomware information library.

4. A method for discovering an induced email ransomware virus according to claim 1, characterized in that: The specific method for matching the key characters screened out from the information with the information in the ransomware information library in S1 is: counting the number of matches between the ransomware keyword information of the sample to be tested and the information of each repository in the ransomware information library, using the number of matches and the weight value of the corresponding reputation library, according to the weighted algorithm, calculating the detection weight of the sample to be tested, comparing the detection weight with the preset standard detection threshold, and obtaining a matching degree value.

5. A method for discovering an induced email ransomware virus according to claim 1, characterized in that: The calculation formula of the average information entropy in S2 is: Where E represents the average information entropy, m represents the total number of files in the sandbox, Indicates the proportionality coefficient, E j1 represents the information entropy of the j-th file header, E j2 represents the information entropy of the remaining part of the jth file, p ji represents the probability of the i-th information in the j-th file appearing; n j1 、n j2 Indicates the number of types of information that appear in the file header and the rest of the file of the jth file, K=1,2.

6. A method for discovering an inducement-type email ransomware virus according to claim 1, characterized in that: The bait file in S2 is generated according to the application or system directory, the bait file name is the smallest number or ASCII small character, and the file sizes of the generated multiple bait files are different.

7. A method for discovering an induced email ransomware virus according to claim 1, characterized in that: The abnormal state in S2 includes the following operations: files in the directory are moved, new files in the directory are created, files in the directory are deleted, and / or files in the directory are modified.

8. A discovery system based on an induced email ransomware virus, using the method of any one of claims 1 to 7, characterized in that: include The information base establishment module is used to establish a ransomware information base based on existing ransomware samples; The extraction and judgment module extracts the key information characters of the files in the email and matches them with the ransomware information database; The bait judgment module creates a bait folder in the sandbox and judges the operation of the bait file based on the files in the email; The deletion module uses the instructions in the instruction set to delete the sandbox containing the ransomware.

Images