Ransomware Trapping and Identification Method, System and Medium Based on Storage Master Protocol

Abstract

The present invention discloses a method, system and medium for ransomware entrapment and identification based on a storage master protocol, belonging to the field of computer security technology. The method includes: sending a configuration command to the first memory snapshot 1 on the device side and caching it; starting to check the host IO commands for the address range. If it is a write command, determine whether the write of the current IO command is authenticated. If authorized, write normally; perform randomness detection when the data written to the current cache meets a preset condition; if the randomness detection is satisfied, set the status of the current IO command as a virus infection flag, and cache the second memory snapshot 2 at this time node and compare it with the first memory snapshot 1. If it exceeds the difference threshold, calculate the hash value of the data slice with the size of the difference value, and clear the data with this characteristic value. Capturing in combination with the front-end protocol and policy can accurately and quickly identify unauthorized encryption and effectively prevent any unauthorized encryption including ransomware.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular, to a method, system and medium for detecting and identifying ransomware based on a storage master protocol. Background Art

[0002] Most of the existing technologies identify viruses through signature recognition, using methods such as entropy value detection of data blocks and snapshot comparison. It is difficult to adapt to the rapid changes of viruses for virus variants and self-adjustment. Summary of the Invention

[0003] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method, system and medium for detecting and identifying ransomware based on a storage master protocol.

[0004] The purpose of the present invention is achieved by the following technical solutions: In the first aspect of the present invention, there is provided a method for detecting and identifying ransomware based on a storage master protocol, including the following steps:

[0005] Step 1: The host virus monitoring and capturing program sends a configuration command to the device side, configures the read-only logical sector address range and user authentication password of the device, captures the first memory snapshot 1 at the current time point and caches it;

[0006] Step 2: After receiving the configuration command from the host side, the device virus trapping program configures the logical sector address range to be read-only and writable with authorization; at the same time, it starts to check the host IO commands for this address range. If it is a write command, it enters Step 3;

[0007] Step 3: The device virus trapping program determines whether the write of the current IO command is authenticated and authorized. If authorized, it writes normally;

[0008] Step 4: When the device virus trapping program detects that the currently cached write data exceeds a preset size or the number of IO commands exceeds a first preset number, it uses a combined method of different random number detection methods to detect the currently cached write data;

[0009] Step 5: The device virus trapping program determines whether the currently cached write data meets the randomness requirement. If it meets, it sets the status of the current IO command as a virus infection flag, then returns a write success, and allows the host side to continue writing;

[0010] Step 6: When the host virus monitoring and capturing program obtains the status reported by the device side as virus infection, it captures the memory of the host, and caches the second memory snapshot 2 at this time node for comparison with the first memory snapshot 1;

[0011] Step 7: If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, calculate and save the hash feature value based on the data of the memory snapshot difference. At the same time, send the virus cleaning command to the device side and execute Step 9; otherwise, send the start policy trap command to the device side and execute Step 8;

[0012] Step 8: The device virus trap program starts to trap, continues to receive and cache the ciphertext data, and then reports to the host side that it cannot be written. After continuously aborting the second preset number of IO commands, it reports success for subsequent IO commands. At the same time, the host virus monitoring and capture program quickly captures the third memory snapshot 3, compares it with the second memory snapshot 2, and repeats Step 7;

[0013] Step 9: After the device virus trap program receives the feature cleaning command and the difference data, it traverses the device data, calculates the hash value of the data slice with the difference value size, and clears the data with the feature value.

[0014] Preferably, the logical sector address range includes a starting logical address and an ending logical address.

[0015] Preferably, Step 2 further includes the following steps:

[0016] If the host IO command within the logical sector address range is not a write command, the subsequent steps are not executed.

[0017] Preferably, Step 3 further includes the following steps:

[0018] If the write of the current IO command is unauthorized, start caching the received data and do not actually write it to the persistent storage medium.

[0019] Preferably, Step 5 further includes the following steps:

[0020] If the currently cached write data does not meet the randomness requirement, directly discard the data of the IO command, abort the write command, and feedback write failure to the host side.

[0021] Preferably, the preset size is 16K, the first preset number is 30, the second preset number is 10, and the difference threshold is 20%.

[0022] Preferably, the random number detection method is the bit frequency detection method or the run distribution detection method or the poker test method.

[0023] The second aspect of the present invention provides: A ransomware trap and recognition system based on a storage master protocol, which is used to implement any one of the above ransomware trap and recognition methods based on a storage master protocol, including:

[0024] A configuration module, which is used to send configuration commands to the device side by using a host virus monitoring and capturing program, configure the read-only logical sector address range and user authentication password of the device, capture and cache the first memory snapshot 1 at the current time point;

[0025] A command check module, which is used to, after the device virus trapping program receives the configuration command from the host side, configure the logical sector address range to be read-only and writable with authorization; at the same time, start to check the host IO commands for this address range. If it is a write command, it is judged whether the write of the current IO command is authenticated and authorized. If authorized, it is written normally;

[0026] A randomness detection module, which is used to, when the device virus trapping program detects that the currently cached written data exceeds a preset size or the number of IO commands exceeds a first preset number, use different combined random number detection methods to detect the currently cached written data; and use the device virus trapping program to judge whether the currently cached written data meets the randomness requirement. If it meets, set the status of the current IO command as a virus infection flag, and then return a write success to allow the host side to continue writing;

[0027] A memory snapshot comparison module, which is used to, when the host virus monitoring and capturing program obtains that the status reported by the device side is virus infection, capture the memory of the host, cache the second memory snapshot 2 at this time node and compare it with the first memory snapshot 1; if the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, calculate and save the hash feature value based on the data of the memory snapshot difference, and at the same time send the virus cleaning command to the device side. After the device virus trapping program receives the feature cleaning command and the difference data, traverse the device data, calculate the hash value of the data slice with the difference value size, and clear the data with this feature value; otherwise, send a start policy trapping command to the device side. The device virus trapping program starts trapping, continues to receive and cache the ciphertext data, and then reports that the host side cannot write. After continuously aborting the second preset number of IO commands, it reports success for the subsequent IO commands. At the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3 and compares it with the second memory snapshot 2 for differences.

[0028] The third aspect of the present invention provides: A computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, any one of the above-mentioned ransomware trapping and recognition methods based on the storage master protocol is implemented.

[0029] The beneficial effects of the present invention are:

[0030] 1) Combining the front-end protocol and strategy for capture can accurately and quickly identify unauthorized encryption and effectively prevent any unauthorized encryption including ransomware. Brief Description of the Drawings

[0031] Figure 1 It is a flowchart of a ransomware trap and identification method based on a storage master protocol. Specific implementation manner

[0032] The following will clearly and completely describe the technical solution of the present invention in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts belong to the scope of protection of the present invention.

[0033] Refer to Figure 1 , the first aspect of the present invention provides: a ransomware trap and identification method based on a storage master protocol, including the following steps:

[0034] Step 1: The host virus monitoring and capturing program sends a configuration command to the device side, configures the read-only logical sector address range and user authentication password of the device, and grabs and caches the first memory snapshot 1 at the current time point;

[0035] Step 2: After receiving the configuration command from the host side, the device virus trapping program configures the logical sector address range to be read-only and writable with authorization; at the same time, it starts to check the host IO commands for this address range. If it is a write command, it enters Step 3;

[0036] Step 3: The device virus trapping program determines whether the write of the current IO command is authenticated and authorized. If authorized, it writes normally;

[0037] Step 4: When the device virus trapping program detects that the currently cached write data exceeds a preset size or the number of IO commands exceeds a first preset number, it uses different random number detection method combinations to detect the currently cached write data;

[0038] Step 5: The device virus trapping program determines whether the currently cached write data meets the randomness requirement. If it meets, it sets the status of the current IO command as a virus infection flag, then returns a write success, and allows the host side to continue writing;

[0039] Step 6: When the host virus monitoring and capturing program obtains the status reported by the device side as virus infection, it grabs the memory of the host and caches the second memory snapshot 2 at this time node for comparison with the first memory snapshot 1;

[0040] Step 7: If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, calculate and save the hash feature value based on the data with memory snapshot differences, and at the same time send the virus cleaning command to the device side and execute Step 9; otherwise, send the start policy trapping command to the device side and execute Step 8;

[0041] Step 8: The device virus trapping program starts trapping, continues to receive and cache the ciphertext data, then reports that the host side cannot write. After continuously aborting the second preset number of IO commands, it reports success for subsequent IO commands. At the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3, compares it with the second memory snapshot 2, and repeats Step 7;

[0042] Step 9: After the device virus trapping program receives the feature clearing command and the differential data, it traverses the device data, calculates the hash value of the data slice with the differential value size, and clears the data with the feature value.

[0043] In this embodiment, based on the storage underlying control protocol, multiple methods are used comprehensively to effectively identify and prevent ransomware. First, by setting the partition range on the host side (SATA based on sata security feature), the highly secure data partition is locked, allowing only read-only access to the high-security area. Authentication verification is performed for writes. If there is an unauthorized write IO command, the controller software actively identifies and analyzes the written data, and performs a ciphertext randomness combination detection verification (single-bit frequency detection, poker test, run total detection) on the written data, that is, any combination of 15 common random number detection methods. If any two or more of the detections are satisfied, the data is considered random data, and the host is told that the write is OK so that it can continue to write. Continuously detect 16K data. If its randomness meets the requirements, it is determined that the data is suspected ransomware encrypted data, and the host is replied that the write is successful. Then continue to receive host data. Accumulatively receive 12,8K written data. If its randomness meets the requirements, it is determined that the data is unauthorized encrypted data. The received 128K data is in the cache, and the disk only obtains the written cache data for analysis, and the actual data does not fall to the disk. It is confirmed that the 128K data is unauthorized encrypted data, and a backup identifier is made for the program executed in the memory. The program content is sent to the disk as a virus sample identifier for storage, and the ransom data is completely discarded. This operation is only for discarding the encryption method without user authorization on the host side. In Step 8, the device virus trapping program starts trapping, continues to receive and cache the ciphertext data, then reports that the host side cannot write. After continuously aborting the second preset number of IO commands, it reports success for subsequent IO commands. Such an intermittent operation can ensure that the host does not remove the device from the current bus.

[0044] In some embodiments, the logical sector address range includes a starting logical address and an ending logical address.

[0045] In some embodiments, Step 2 further includes the following steps:

[0046] If the host IO command in the logical sector address range is not a write command, the subsequent steps are not executed.

[0047] In some embodiments, step 3 further includes the following steps:

[0048] If the write of the current IO command is unauthorized, start caching to receive data and do not actually write it to the persistent storage medium.

[0049] In some embodiments, step 5 further includes the following steps:

[0050] If the currently cached write data does not meet the randomness requirement, directly discard the data of the IO command, abort the write command, and feedback write failure to the host side.

[0051] In some embodiments, the preset size is 16K, the first preset number is 30, the second preset number is 10, and the difference threshold is 20%.

[0052] In some embodiments, the random number detection method is the bit frequency detection method or the run distribution detection method or the poker test method.

[0053] In this embodiment, the random number detection method is not limited to the three listed here. Any combination of 15 common random number detection methods that meets any two or more of the detections is considered random data.

[0054] The second aspect of the present invention provides: A ransomware trapping and identification system based on a storage master protocol for implementing any one of the above ransomware trapping and identification methods based on a storage master protocol, including:

[0055] A configuration module for using a host virus monitoring and capturing program to send a configuration command to the device side, configuring the read-only logical sector address range and user authentication password of the device, capturing the first memory snapshot 1 at the current time point and caching it;

[0056] A command check module for, after the device virus trapping program receives the configuration command from the host side, configuring the logical sector address range to be read-only and writable with authorization; at the same time, starting to check the host IO commands for this address range. If it is a write command, determine whether the write of the current IO command is authenticated and authorized. If authorized, write normally;

[0057] A randomness detection module for, when the device virus trapping program detects that the currently cached write data exceeds the preset size or the number of IO commands exceeds the first preset number, using different combinations of random number detection methods to detect the currently cached write data; and using the device virus trapping program to determine whether the currently cached write data meets the randomness requirement. If it meets, set the status of the current IO command as a virus infection flag, then return write success, and let the host side continue to write;

[0058] A memory snapshot comparison module is used to capture the memory of the host when the host virus monitoring and capturing program obtains that the status reported by the device side is virus infection, and cache the second memory snapshot 2 at this time node for comparison with the first memory snapshot 1. If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, calculate and save the hash feature value based on the data of the memory snapshot difference. At the same time, send the virus removal command to the device side. After the device virus trapping program receives the feature removal command and the difference data, traverse the device data, calculate the hash value of the data slice with the difference value size, and clear the data with the feature value. Otherwise, send the start policy trapping command to the device side. The device virus trapping program starts trapping, continues to receive and cache the ciphertext data, and then reports that the host side cannot write. After continuously aborting the second preset number of IO commands, report success for the subsequent IO commands. At the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3 for difference comparison with the second memory snapshot 2.

[0059] The third aspect of the present invention provides: A computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, any one of the above-mentioned ransomware trapping and recognition methods based on the storage master protocol is implemented.

[0060] The above are only the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be within the scope of the concept described herein, through the above teachings or the technology or knowledge in related fields for modification. And the modifications and changes made by those skilled in the art that do not depart from the spirit and scope of the present invention should all be within the protection scope of the appended claims of the present invention.

Claims

1. A method for detecting and identifying ransomware based on a storage master protocol, characterized in that: It includes the following steps: Step 1: The host virus monitoring and capturing program issues a configuration command to the device side, configures the read-only logical sector address range and user authentication password of the device, grabs the first memory snapshot 1 at the current time point and caches it; Step 2: After receiving the configuration command from the host side, the device virus trapping program configures the logical sector address range to be read-only and writable with authorization; at the same time, it starts to check the host IO commands in this address range. If it is a write command, it enters Step 3; Step 3: The device virus trapping program determines whether the write of the current IO command is authenticated and authorized. If authorized, it writes normally; Step 4: When the device virus trapping program detects that the currently cached written data exceeds the preset size or the number of IO commands exceeds the first preset number, it uses different combined random number detection methods to detect the currently cached written data; Step 5: The device virus trapping program determines whether the currently cached written data meets the randomness requirement. If it meets, it sets the status of the current IO command as a virus infection flag, then returns a write success, and allows the host side to continue writing; Step 6: When the host virus monitoring and capturing program obtains the status reported by the device side as virus infection, it grabs the memory of the host, and caches the second memory snapshot 2 at this time node for comparison with the first memory snapshot 1; Step 7: If the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, it calculates and saves the hash feature value based on the data with memory snapshot differences, and at the same time issues the virus cleaning command to the device side and executes Step 9; otherwise, it issues a start policy trapping command to the device side and executes Step 8; Step 8: The device virus trapping program starts trapping, continues to receive and cache ciphertext data, then reports that the host side cannot write. After continuously aborting the second preset number of IO commands, it reports success for subsequent IO commands. At the same time, the host virus monitoring and capturing program quickly grabs the third memory snapshot 3, compares it with the second memory snapshot 2, and repeats Step 7; Step 9: After receiving the feature cleaning command and the difference data, the device virus trapping program traverses the device data, calculates the hash value of the data slice with the difference value size, and clears the data with this feature value.

2. The method for detecting and identifying ransomware based on a storage master protocol according to claim 1, wherein: The logical sector address range includes a starting logical address and an ending logical address.

3. The method for identifying and trapping ransomware based on a storage master protocol according to claim 1, characterized in that: Step 2 further includes the following steps: If the host IO command in the logical sector address range is not a write command, the subsequent steps are not executed.

4. The ransomware entrapment and recognition method based on a storage master protocol according to claim 1, wherein: Step 3 further includes the following steps: If the write of the current IO command is not authorized, it starts to cache the received data and does not actually write it to the persistent storage medium.

5. The ransomware entrapment and recognition method based on a storage control protocol according to claim 1, wherein: Step 5 further includes the following steps: If the currently cached written data does not meet the randomness requirement, it directly discards the data of this IO command, aborts the write command, and feedbacks a write failure to the host side.

6. The ransomware entrapment and recognition method based on a storage control protocol according to claim 1, wherein: The preset size is 16K, the first preset number is 30, the second preset number is 10, and the difference threshold is 20%.

7. The method for detecting and identifying ransomware based on a storage master protocol according to any one of claims 1-6, characterized in that: The random number detection method is a bit frequency detection method or a run distribution detection method or a poker test method.

8. A ransomware entrapment and recognition system based on a storage master protocol, characterized in that: A method for implementing a ransomware entrapment and recognition method based on a storage master protocol as described in any one of claims 1-6, including: A configuration module, configured to use a host virus monitoring and capturing program to send a configuration command to the device side, configure the read-only logical sector address range and user authentication password of the device, capture and cache the first memory snapshot 1 at the current time point; A command checking module, configured to, after the device virus entrapment program receives the configuration command from the host side, configure the logical sector address range to be read-only and writable with authorization; at the same time, start checking the host IO commands for this address range. If it is a write command, determine whether the write of the current IO command is authenticated and authorized. If authorized, write normally; A randomness detection module, configured to, when the device virus entrapment program detects that the currently cached written data exceeds a preset size or the number of IO commands exceeds a first preset number, use a combination of different random number detection methods to detect the currently cached written data; and use the device virus entrapment program to determine whether the currently cached written data meets the randomness requirements. If it meets, set the status of the current IO command as a virus infection flag, then return a write success, and let the host side continue to write; A memory snapshot comparison module, configured to, when the host virus monitoring and capturing program obtains that the status reported by the device side is virus infection, capture the memory of the host, and cache the second memory snapshot 2 at this time node for comparison with the first memory snapshot 1; if the comparison difference between the second memory snapshot 2 and the first memory snapshot 1 exceeds the difference threshold, calculate and save the hash feature value based on the data with the memory snapshot difference, and at the same time send the virus cleaning command to the device side. After the device virus entrapment program receives the feature cleaning command and the difference data, traverse the device data, calculate the hash value of the data slice with the difference value size, and clear the data with this feature value; otherwise, send a start policy entrapment command to the device side. The device virus entrapment program starts entrapment, continues to receive and cache the ciphertext data, then reports that the host side cannot write. After continuously aborting the second preset number of IO commands, report success for the subsequent IO commands. At the same time, the host virus monitoring and capturing program quickly captures the third memory snapshot 3 for differential comparison with the second memory snapshot 2.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, the method for implementing a ransomware entrapment and recognition method based on a storage master protocol as described in any one of claims 1-7 is realized.

Images