Ransomware trapping identification method and system based on storage master control protocol, and medium

Abstract

The invention discloses a ransomware trapping identification method and system based on a storage master control protocol, and a medium, and belongs to the technical field of computer security. The method comprises the following steps: issuing a configuration command to a first memory snapshot 1 on a device side and caching; starting to check a host IO command in the address range, if the command is a write-in command, judging whether the write-in of the current IO command is authenticated or not, and if the write-in is authorized, normally writing; if the current cache write-in data meets a preset condition, carrying out randomness detection; and if the randomness detection is met, setting the state of the current IO command as a virus infection mark, caching a second memory snapshot 2 of the time node, comparing the second memory snapshot 2 with the first memory snapshot 1, if a difference threshold value is exceeded, calculating a hash value of a data piece with the size of the difference value, and clearing the data with the characteristic value. The front-end protocol and strategy are combined for decapture, so that the unauthorized encryption can be accurately and quickly identified, and any unauthorized encryption including ransomware can be effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a method, system and medium for trapping and identifying ransomware viruses based on a storage master control protocol. Background Art

[0002] Most of the existing technologies identify viruses through feature recognition, using entropy detection data blocks, snapshot comparison and other methods. This makes it difficult to adapt to the rapid changes of viruses as they mutate and self-adjust. Summary of the invention

[0003] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method, system and medium for identifying ransomware virus trapping based on a storage master control protocol.

[0004] The objective of the present invention is achieved through the following technical solutions: The first aspect of the present invention provides: a ransomware virus trapping and identification method based on a storage master control protocol, comprising the following steps: Step 1: The host virus monitoring and capture program sends a configuration command to the device side, configures the device's read-only logical sector address range and user authentication password, captures the first memory snapshot 1 at the current time point and caches it; Step 2: After receiving the configuration command from the host side, the device virus trapping program configures the logical sector address range as read-only and authorizes writing; at the same time, it starts to check the host IO command in the address range. If it is a write command, it proceeds to step 3; Step 3: The device virus trapping program determines whether the writing of the current IO command is authenticated. If authorized, it is written normally; Step 4: When the device virus trapping program detects that the current cache write data exceeds a preset size or the number of IO commands exceeds a first preset number, different random number detection methods are combined to detect the current cache write data; Step 5: The device virus trapping program determines whether the current cache write data meets the randomness requirement. If so, it sets the status of the current IO command to a virus infection flag, and then returns a write success, allowing the host side to continue writing; Step 6: When the host virus monitoring and capturing program obtains the status reported by the device side as virus infection, it captures the host memory, and caches the second memory snapshot 2 of the time node for comparison with the first memory snapshot 1; Step 7: If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, the hash feature value is calculated and saved based on the data of the memory snapshot difference, and the virus removal command is sent to the device side and step 9 is executed; otherwise, the start policy trapping command is sent to the device side and step 8 is executed; Step 8: The device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports that the host side cannot write. After continuously terminating the second preset number of IO commands, it reports success for subsequent IO commands. At the same time, the host virus monitoring and capture program quickly captures the third memory snapshot 3, compares it with the second memory snapshot 2, and repeats step 7; Step 9: After receiving the feature clearing command and the difference data, the device virus trapping program traverses the device data, calculates the hash value of the data slice with the difference value, and clears the data with the feature value.

[0005] Preferably, the logical sector address range includes a starting logical address and an ending logical address.

[0006] Preferably, the step 2 further comprises the following steps: If the host IO command in the logical sector address range is not a write command, the subsequent steps are not executed.

[0007] Preferably, the step 3 further comprises the following steps: If the write of the current IO command is not authorized, the cache is started to receive the data, and the data is not actually written to the persistent storage medium.

[0008] Preferably, the step 5 further comprises the following steps: If the current cache write data does not meet the randomness requirement, the data of the IO command is directly discarded, the write command is aborted, and the write failure is fed back to the host side. Preferably, the preset size is 16K, the first preset number is 30, the second preset number is 10, and the difference threshold is 20%.

[0009] Preferably, the random number detection method is a bit frequency detection method, a run distribution detection method, or a poker test method.

[0010] The second aspect of the present invention provides: a ransomware virus trapping and identification system based on a storage master control protocol, which is used to implement any of the above-mentioned ransomware virus trapping and identification methods based on a storage master control protocol, including: A configuration module, used to use a host virus monitoring and capture program to send a configuration command to the device side, configure the device's read-only logical sector address range and user authentication password, capture the first memory snapshot 1 at the current time point and cache it; The command checking module is used to configure the logical sector address range as read-only and authorizable to write after the device virus trapping program receives the configuration command from the host side; at the same time, it starts to check the host IO command in the address range. If it is a write command, it determines whether the writing of the current IO command is authenticated. If it is authorized, it is written normally; The randomness detection module is used to detect the current cache write data by combining different random number detection methods when the device virus trapping program detects that the current cache write data exceeds the preset size or the number of IO commands exceeds the first preset number; and use the device virus trapping program to determine whether the current cache write data meets the randomness requirement, and if so, set the status of the current IO command to a virus infection flag, and then return a write success, allowing the host side to continue writing; The memory snapshot comparison module is used to capture the host's memory when the host virus monitoring and capturing program obtains that the status reported by the device side is virus infection, and caches the second memory snapshot 2 of the time node for comparison with the first memory snapshot 1; if the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, the hash feature value is calculated and saved based on the data of the memory snapshot difference, and the virus removal command is issued to the device side at the same time, and after the device virus trapping program receives the feature removal command and the difference data, the device data is traversed, the hash value of the data slice with the difference value size is calculated, and the data with the feature value is cleared; otherwise, a start policy trapping command is issued to the device side, and the device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports that the host side cannot write, and after continuously suspending the second preset number of IO commands, the subsequent IO commands are reported as successful, and at the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3 and compares the difference with the second memory snapshot 2.

[0011] A third aspect of the present invention provides: a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, any of the above-mentioned ransomware virus trapping and identification methods based on the storage master control protocol is implemented.

[0012] The beneficial effects of the present invention are: 1) Combined with front-end protocols and strategies for capture, it can accurately and quickly identify unauthorized encryption and effectively prevent any unauthorized encryption including ransomware. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 The flowchart of the ransomware virus trapping and identification method based on the storage master control protocol is shown in FIG. DETAILED DESCRIPTION

[0014] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0015] See also Figure 1The first aspect of the present invention provides: a ransomware virus trapping and identification method based on a storage master control protocol, comprising the following steps: Step 1: The host virus monitoring and capture program sends a configuration command to the device side, configures the device's read-only logical sector address range and user authentication password, captures the first memory snapshot 1 at the current time point and caches it; Step 2: After receiving the configuration command from the host side, the device virus trapping program configures the logical sector address range as read-only and authorizes writing; at the same time, it starts to check the host IO command in the address range. If it is a write command, it proceeds to step 3; Step 3: The device virus trapping program determines whether the writing of the current IO command is authenticated. If authorized, it is written normally; Step 4: When the device virus trapping program detects that the current cache write data exceeds a preset size or the number of IO commands exceeds a first preset number, different random number detection methods are combined to detect the current cache write data; Step 5: The device virus trapping program determines whether the current cache write data meets the randomness requirement. If so, it sets the status of the current IO command to a virus infection flag, and then returns a write success, allowing the host side to continue writing; Step 6: When the host virus monitoring and capturing program obtains the status reported by the device side as virus infection, it captures the host memory, and caches the second memory snapshot 2 of the time node for comparison with the first memory snapshot 1; Step 7: If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, the hash feature value is calculated and saved based on the data of the memory snapshot difference, and the virus removal command is sent to the device side and step 9 is executed; otherwise, the start policy trapping command is sent to the device side and step 8 is executed; Step 8: The device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports that the host side cannot write. After continuously terminating the second preset number of IO commands, it reports success for subsequent IO commands. At the same time, the host virus monitoring and capture program quickly captures the third memory snapshot 3, compares it with the second memory snapshot 2, and repeats step 7; Step 9: After receiving the feature clearing command and the difference data, the device virus trapping program traverses the device data, calculates the hash value of the data slice with the difference value, and clears the data with the feature value.

[0016] In this embodiment, based on the storage underlying control protocol, a variety of methods are used to effectively identify and prevent ransomware viruses. First, by setting the partition range on the host side (SATA is based on sata security feature), the high-security data partition is locked, and the high-security area is allowed to be read-only. Authentication verification is performed for writing. If there is an unauthenticated write IO command, the controller software actively identifies and analyzes the written data, and performs a combination detection and verification of the ciphertext randomness of the encryption algorithm on the written data (single-bit frequency detection, Poker test, total number of runs test), that is, any combination of 15 commonly used random number detection methods. If any two or more of the tests are met, it is considered to be random data, and the host is told to write OK so that it can continue to write. 16K data is continuously tested. If its randomness meets the requirements, the data is judged to be suspected ransomware virus encrypted data, and the host is replied to write successfully. Then continue to receive host data, and receive a total of 128K written data. If its randomness meets the requirements, the data is judged to be unauthorized encrypted data. The received 128K data is in the cache, and the disk only obtains the write cache data for analysis, and the actual data is not written to the disk. Confirm that the 128K data is unauthorized encrypted data, and back up the execution program in the memory, and send the program content to the disk as a virus sample mark for storage, and the ransomware data is completely discarded. This operation is only for the encryption method without user authorization on the host side. In step 8, the device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports to the host that it cannot write. After continuously terminating the second preset number of IO commands, it reports success for subsequent IO commands. Such interval operations can ensure that the host will not remove the device from the current bus.

[0017] In some embodiments, the logical sector address range includes a starting logical address and an ending logical address.

[0018] In some embodiments, the step 2 further comprises the following steps: If the host IO command in the logical sector address range is not a write command, the subsequent steps are not executed.

[0019] In some embodiments, step 3 further comprises the following steps: If the write of the current IO command is not authorized, the cache is started to receive the data, and the data is not actually written to the persistent storage medium.

[0020] In some embodiments, the step 5 further comprises the following steps: If the current cache write data does not meet the randomness requirement, the data of the IO command is directly discarded, the write command is aborted, and the write failure is fed back to the host side. In some embodiments, the preset size is 16K, the first preset number is 30, the second preset number is 10, and the difference threshold is 20%.

[0021] In some embodiments, the random number detection method is a bit frequency detection method, a run distribution detection method, or a poker test method.

[0022] In this embodiment, the random number detection method is not limited to the three listed above. Any combination of 15 commonly used random number detection methods that satisfies any two or more of the detections is considered to be random data.

[0023] The second aspect of the present invention provides: a ransomware virus trapping and identification system based on a storage master control protocol, which is used to implement any of the above-mentioned ransomware virus trapping and identification methods based on a storage master control protocol, including: A configuration module, used to use a host virus monitoring and capture program to send a configuration command to the device side, configure the device's read-only logical sector address range and user authentication password, capture the first memory snapshot 1 at the current time point and cache it; The command checking module is used to configure the logical sector address range as read-only and authorizable to write after the device virus trapping program receives the configuration command from the host side; at the same time, it starts to check the host IO command in the address range. If it is a write command, it determines whether the writing of the current IO command is authenticated. If it is authorized, it is written normally; The randomness detection module is used to detect the current cache write data by combining different random number detection methods when the device virus trapping program detects that the current cache write data exceeds the preset size or the number of IO commands exceeds the first preset number; and use the device virus trapping program to determine whether the current cache write data meets the randomness requirement, and if so, set the status of the current IO command to a virus infection flag, and then return a write success, allowing the host side to continue writing; The memory snapshot comparison module is used to capture the host's memory when the host virus monitoring and capturing program obtains that the status reported by the device side is virus infection, and caches the second memory snapshot 2 of the time node for comparison with the first memory snapshot 1; if the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, the hash feature value is calculated and saved based on the data of the memory snapshot difference, and the virus removal command is issued to the device side at the same time, and after the device virus trapping program receives the feature removal command and the difference data, the device data is traversed, the hash value of the data slice with the difference value size is calculated, and the data with the feature value is cleared; otherwise, a start policy trapping command is issued to the device side, and the device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports that the host side cannot write, and after continuously suspending the second preset number of IO commands, the subsequent IO commands are reported as successful, and at the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3 and compares the difference with the second memory snapshot 2.

[0024] A third aspect of the present invention provides: a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, any of the above-mentioned ransomware virus trapping and identification methods based on the storage master control protocol is implemented.

[0025] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A ransomware virus trapping and identification method based on a storage master control protocol, characterized in that: The following steps are involved: Step 1: The host virus monitoring and capture program sends a configuration command to the device side, configures the device's read-only logical sector address range and user authentication password, captures the first memory snapshot 1 at the current time point and caches it; Step 2: After receiving the configuration command from the host side, the device virus trapping program configures the logical sector address range as read-only and authorizes writing; at the same time, it starts to check the host IO command in the address range. If it is a write command, it proceeds to step 3; Step 3: The device virus trapping program determines whether the writing of the current IO command is authenticated. If authorized, it is written normally; Step 4: When the device virus trapping program detects that the current cache write data exceeds a preset size or the number of IO commands exceeds a first preset number, different random number detection methods are combined to detect the current cache write data; Step 5: The device virus trapping program determines whether the current cache write data meets the randomness requirement. If so, it sets the status of the current IO command to a virus infection flag, and then returns a write success, allowing the host side to continue writing; Step 6: When the host virus monitoring and capturing program obtains the status reported by the device side as virus infection, it captures the host memory, and caches the second memory snapshot 2 of the time node for comparison with the first memory snapshot 1; Step 7: If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, the hash feature value is calculated and saved based on the data of the memory snapshot difference, and the virus removal command is sent to the device side and step 9 is executed; otherwise, the start policy trapping command is sent to the device side and step 8 is executed; Step 8: The device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports that the host side cannot write. After continuously terminating the second preset number of IO commands, it reports success for subsequent IO commands. At the same time, the host virus monitoring and capture program quickly captures the third memory snapshot 3, compares it with the second memory snapshot 2, and repeats step 7; Step 9: After receiving the feature clearing command and the difference data, the device virus trapping program traverses the device data, calculates the hash value of the data slice with the difference value, and clears the data with the feature value.

2. According to claim 1, the method for trapping and identifying ransomware based on the storage master control protocol is characterized in that: The logical sector address range includes a start logical address and an end logical address.

3. The ransomware virus trapping and identification method based on the storage master control protocol according to claim 1 is characterized in that: The step 2 further comprises the following steps: If the host IO command in the logical sector address range is not a write command, the subsequent steps are not executed.

4. According to claim 1, the method for trapping and identifying ransomware based on the storage master control protocol is characterized in that: The step 3 further comprises the following steps: If the write of the current IO command is not authorized, the cache is started to receive the data, and the data is not actually written to the persistent storage medium.

5. According to claim 1, the method for trapping and identifying ransomware based on the storage master control protocol is characterized in that: The step 5 further comprises the following steps: If the current cache write data does not meet the randomness requirement, the data of the IO command is directly discarded, the write command is aborted, and the write failure is fed back to the host side.

6. The ransomware virus trapping and identification method based on the storage master control protocol according to claim 1 is characterized in that: The preset size is 16K, the first preset number is 30, the second preset number is 10, and the difference threshold is 20%.

7. The ransomware virus trapping and identification method based on the storage master control protocol according to any one of claims 1 to 6, characterized in that: The random number detection method is a bit frequency detection method, a run distribution detection method or a poker test method.

8. A ransomware virus trapping and identification system based on a storage master control protocol, characterized by: The method for identifying ransomware virus trapping based on the storage master control protocol according to any one of claims 1 to 6 comprises: A configuration module, used to use a host virus monitoring and capture program to send a configuration command to the device side, configure the device's read-only logical sector address range and user authentication password, capture the first memory snapshot 1 at the current time point and cache it; The command checking module is used to configure the logical sector address range as read-only and authorizable to write after the device virus trapping program receives the configuration command from the host side; at the same time, it starts to check the host IO command in the address range. If it is a write command, it determines whether the writing of the current IO command is authenticated. If it is authorized, it is written normally; The randomness detection module is used to detect the current cache write data by combining different random number detection methods when the device virus trapping program detects that the current cache write data exceeds the preset size or the number of IO commands exceeds the first preset number; and use the device virus trapping program to determine whether the current cache write data meets the randomness requirement, and if so, set the status of the current IO command to a virus infection flag, and then return a write success, allowing the host side to continue writing; The memory snapshot comparison module is used to capture the host's memory when the host virus monitoring and capturing program obtains that the status reported by the device side is virus infection, and caches the second memory snapshot 2 of the time node for comparison with the first memory snapshot 1; if the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, the hash feature value is calculated and saved based on the data of the memory snapshot difference, and the virus removal command is issued to the device side at the same time, and after the device virus trapping program receives the feature removal command and the difference data, the device data is traversed, the hash value of the data slice with the difference value size is calculated, and the data with the feature value is cleared; otherwise, a start policy trapping command is issued to the device side, and the device virus trapping program starts trapping, continues to receive and cache ciphertext data, and then reports that the host side cannot write, and after continuously suspending the second preset number of IO commands, the subsequent IO commands are reported as successful, and at the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3 and compares the difference with the second memory snapshot 2.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are loaded and executed by the processor, the ransomware virus trapping and identification method based on the storage master control protocol as described in any one of claims 1 to 7 is implemented.

Images