Attack and defense drill method for ransomware virus

Abstract

The invention discloses an attack and defense exercise method for ransomware, which relates to the technical field of computer network security, and comprises the following steps: a command end generates a plurality of self-defined ransomware with unique identification (ID) according to the number of users and predefined exercise time, and positions user equipment according to the ID, the security awareness of a certain independent user is improved; inputting the plurality of self-defined blackmail viruses into a plurality of user equipment, and further comprises the following steps: acquiring operation information of each self-defined blackmail virus; according to the operation information, whether each self-defined ransomware is successfully operated or not is judged, and after disguise, when the ransomware is triggered, the operation information of the self-defined ransomware is sent. According to the method provided by the invention, the safety awareness and technical level of an enterprise can be effectively improved, and the occurrence rate of data loss, economic loss and other consequences caused by ransomware infection is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to an attack and defense drill method for ransomware viruses. Background Art

[0002] With the continuous development of network security technology, attack and defense drills have gradually become a normalized work in China. Whether it is the national-level "Network Protection Action" or the provincial and municipal-level attack and defense drills, they cover almost all key areas of various industries. These drills have played an important role in improving security awareness and improving corporate security protection, but security incidents caused by ransomware are still common, and their economic losses are particularly serious. In recent years, through the analysis of a large number of ransomware incidents, it can be found that the attack mode of ransomware has changed from "wide-ranging" large-scale infection to "precise sniping" high-value targets. The attack chain is more complex and more destructive, which puts higher demands on the defense capabilities of enterprises. In this context, it is particularly important to carry out special attack and defense drills for ransomware, which can not only help organizations simulate real attack scenarios and verify the effectiveness of existing protection systems, but also improve emergency response and recovery capabilities, and provide strong guarantees for organizations to build full-chain defense capabilities against ransomware.

[0003] The existing solution that is closest to the present invention is the "defense system against ransomware". In the implementation of this system, although the purpose is defense, a virtual machine implementation solution is adopted. First, the ransomware in the real ransomware incident is released into the virtual, and then the sample is executed and its behavior is observed. Finally, professional personnel will carry out specific defense processing before, during, during and after the behavior.

[0004] Attack and defense drills cannot specifically simulate the ransomware environment: It is impossible to perform targeted simulations on the ransomware environment alone. In addition, in traditional attack and defense drills, the Trojans used by the attackers cannot carry the function of the ransomware due to the particularity of the drills. Therefore, it is impossible to conduct drills against ransomware in traditional attack and defense drills.

[0005] The ransomware defense system lacks a real environment: Although the release of the virtual environment ensures its security, it lacks authenticity. Ransomware incidents often occur in a real user environment, but real ransomware cannot be placed in a real user environment, so there will be a contradiction.

[0006] The problem of resource recovery in attack and defense drills: In attack and defense drills, often after the end, some of the conquered defenders are unable to restore the real environment in time or at all for some reason. Some attackers will use tools with better "concealment" that still remain in the defender's assets and cannot be discovered in time.

[0007] Therefore, in view of this, the existing structure and deficiencies are studied and improved, and an attack and defense drill method against ransomware is proposed. Summary of the invention

[0008] The purpose of the present invention is to provide an attack and defense drill method for ransomware viruses to solve the problems raised in the above background technology.

[0009] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: an attack and defense drill method for ransomware, comprising: a command end generates a plurality of ransomware with customized unique identification IDs according to the number of users and a predefined drill time, and locates the user device according to the ID identification to improve the security awareness of a certain independent user; and the plurality of customized ransomware are put into a plurality of user devices.

[0010] Furthermore, it also includes: obtaining the running information of each customized ransomware virus; judging whether each customized ransomware virus is successfully run according to the running information, and after being disguised, the ransomware virus will send the running information of the customized ransomware virus when it is triggered.

[0011] Furthermore, the method further includes: when the multiple customized ransomware viruses launched into the user are unresponsive and the running time is in the rehearsal time, the ransomware virus of the ID is re-customized and launched into the user's machine again after changing the disguise.

[0012] Furthermore, the generating of the ransomware with multiple customized unique identification IDs specifically includes: generating a customized ransomware of the corresponding operating system type according to the operating system type of each user device.

[0013] Furthermore, a ransomware occurrence scenario simulation device that applies the above-mentioned method for simulating a ransomware occurrence scenario includes: a generation module, which is used for the command end to generate multiple ransomware viruses with customized unique identification IDs according to the number of users and a predefined rehearsal time; and a delivery module, which is used to deliver the multiple customized ransomware viruses to multiple user devices.

[0014] Furthermore, it also includes: a monitoring module, which is used to obtain the running information of each customized ransomware virus; and a judgment module, which is used to judge whether each customized ransomware virus is successfully run according to the running information.

[0015] Furthermore, the generation module is also used to assign a unique identification ID to each customized ransomware virus; the judgment module is specifically used to determine whether each customized ransomware virus is successfully run according to the ID and running information of each customized ransomware virus.

[0016] Furthermore, the generation module is also used to regenerate a second customized ransomware and launch it into the same user device as the first customized ransomware when a first customized ransomware among the multiple customized ransomware does not respond within a predetermined time.

[0017] Furthermore, the generation module is specifically used to generate a customized ransomware virus of the corresponding operating system type according to the operating system type of each user device to adapt to a variety of operating system environments.

[0018] The present invention provides an attack and defense drill method for ransomware, which has the following beneficial effects: ensuring the uniqueness of the drill scenario: the present invention mainly performs simulation drills on the occurrence scenario of the ransomware, and the entire process relies on a customized ransomware infection chain, and does not involve other security drills, thereby ensuring the uniqueness of the event; the adopted ransomware is completely customized, and all functions are controllable, thereby ensuring the safety of the drill; the ransomware is completely released into a real user environment, and the user environment is not generated by technologies such as a virtual environment, thereby further ensuring authenticity; the customized functions all simulate the "sniper-style" attack mode adopted by the real ransomware, thereby ensuring that each sample released by the user is independently generated. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The present invention is a flowchart of an attack and defense drill method against ransomware viruses. DETAILED DESCRIPTION

[0020] See also Figure 1 The present invention provides a technical solution: an attack and defense drill method for ransomware virus, the method comprising the following steps:

[0021] The invention comprises: the command end generates multiple customized ransomware viruses with unique identification IDs according to the number of users and the predefined rehearsal time, and locates the user device according to the ID identification to improve the security awareness of a certain independent user; the multiple customized ransomware viruses are put into multiple user devices, and also comprises: obtaining the running information of each customized ransomware virus; judging whether each customized ransomware virus is successfully run according to the running information, and after being disguised, the ransomware virus will send the running information of the customized ransomware virus when triggered, and also comprises: when multiple customized ransomware viruses put into the user are unresponsive and the running time is in the rehearsal time, the ransomware virus of the ID is re-customized, and the ransomware virus is re-put into the user machine after changing the disguise, and multiple customized ransomware viruses with unique identification IDs are generated, specifically comprising: generating a customized ransomware virus of the corresponding operating system type according to the operating system type of each user device, and a ransomware virus occurrence scenario simulation device of an application of a ransomware virus occurrence scenario simulation method, comprising: generating A module is used for the command end to generate multiple customized ransomware viruses with unique identification IDs according to the number of users and the predefined rehearsal time; a delivery module is used to deliver multiple customized ransomware viruses to multiple user devices, and also includes: a monitoring module for obtaining the running information of each customized ransomware virus; a judgment module is used to determine whether each customized ransomware virus is successfully running according to the running information, and a generation module is also used to assign a unique identification ID to each customized ransomware virus; the judgment module is specifically used to determine whether each customized ransomware virus is successfully running according to the ID and running information of each customized ransomware virus, and the generation module is also used to regenerate a second customized ransomware virus and deliver it to the same user device as the first customized ransomware virus when the first customized ransomware virus among the multiple customized ransomware viruses does not respond within a predetermined time, and the generation module is specifically used to generate a customized ransomware virus of the corresponding operating system type according to the operating system type of each user device to adapt to multiple operating system environments.

[0022] The embodiments of the present invention are given for the purpose of illustration and description, and are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. A method for simulating a ransomware virus occurrence scenario, characterized in that: include: The command end generates a plurality of customized ransomware viruses with unique identification IDs according to the number of users and a predefined rehearsal time; and delivers the plurality of customized ransomware viruses to a plurality of user devices.

2. A method for simulating a ransomware virus occurrence scenario as claimed in claim 1, characterized in that: Also includes: After the customized ransomware is run, it will send its own ID and user device identification to the command end. After receiving the information, the command end will display it according to the user who will run the virus.

3. A method for simulating a ransomware virus occurrence scenario as claimed in claim 2, characterized in that: Before obtaining the running information of each customized ransomware virus, it also includes: assigning a unique identification ID to each customized ransomware virus; judging whether each customized ransomware virus runs successfully according to the running information specifically includes: determining whether each customized ransomware virus runs successfully according to the ID and running information of each customized ransomware virus.

4. A method for simulating a ransomware virus occurrence scenario as claimed in claim 3, characterized in that: Also includes: When the multiple customized ransomware viruses launched into the user do not respond and the running time is in the rehearsal time, the ransomware virus of the ID is re-customized and launched into the user's machine again after changing the disguise.

5. A method for simulating a ransomware virus occurrence scenario as claimed in claim 4, characterized in that: The generating of the ransomware with multiple customized unique identification IDs specifically includes: generating a customized ransomware of the corresponding operating system type according to the operating system type of each user device to adapt to a variety of operating system environments.

6. A ransomware occurrence scenario simulation device using the ransomware occurrence scenario simulation method of claim 6, characterized in that: include: The generation module is used by the command end to generate multiple customized ransomware viruses with unique identification IDs according to the number of users and the predefined drill time; The delivery module is used to deliver the multiple customized ransomware viruses to multiple user devices.

7. The device for simulating a ransomware occurrence scenario according to claim 6, characterized in that: Also includes: Monitoring module, used to obtain the operation information of each customized ransomware virus; The judgment module is used to judge whether each customized ransomware virus is successfully executed according to the operation information.

8. The device for simulating a ransomware occurrence scenario according to claim 7, characterized in that: The generation module is further used to assign a unique identification ID to each customized ransomware virus; the judgment module is specifically used to determine whether each customized ransomware virus is successfully run according to the ID and running information of each customized ransomware virus.

9. The device for simulating a ransomware occurrence scenario according to claim 8, characterized in that: The generation module is further configured to regenerate a second customized ransomware and launch it into the same user device as the first customized ransomware when a first customized ransomware among the multiple customized ransomware does not respond within a predetermined time.

10. A ransomware virus occurrence scenario simulation device according to any one of claim 9, characterized in that: The generation module is specifically used to generate a customized ransomware virus of the corresponding operating system type according to the operating system type of each user device.

Images