Process detection method and device and storage medium

Abstract

The invention discloses a process detection method and device and a storage medium, the method is applied to the field of network security, and the method comprises the following steps: when a file operation request of a to-be-identified process for a target file in a disk of a target terminal is detected, identifying whether the to-be-identified process belongs to a trusted process according to a trusted process set; under the condition that the to-be-identified process does not belong to the trusted process, creating a copy file of the target file in a virtual mirror image space of the target terminal, and detecting whether the to-be-identified process belongs to a non-ransomware process or not according to a file operation executed by the to-be-identified process on the copy file; and under the condition that the to-be-identified process belongs to the non-ransomware process, adding the to-be-identified process into the trusted process set as a trusted process. Through the method and the device, the problem that the non-ransomware process cannot be accurately identified in the related technology is solved, so that the file stored in the disk of the terminal is more effectively protected.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a process detection method, device and storage medium. Background Art

[0002] At present, with the rapid popularization of mobile terminals, terminal devices such as mobile phones and tablet computers have become an indispensable part of our daily lives. The file systems and data security of terminal devices are facing unprecedented challenges.

[0003] The operating system of the terminal device itself has security vulnerabilities. Although mainstream operating systems such as Android and iOS are constantly improving in terms of security, they may still be subject to zero-day attacks, that is, attacks that exploit vulnerabilities that have not yet been disclosed and fixed, thereby bypassing existing security measures and encrypting or modifying user files. In addition, the use environment of mobile devices is more complex and changeable. For example, Wi-Fi and Bluetooth connections in public places may become channels for attackers to exploit. In such an environment, the files stored by users on the device are more vulnerable to threats from untrusted processes, including but not limited to unauthorized access, data tampering, data leakage, etc.

[0004] Therefore, how to identify non-ransomware processes to protect files stored on the terminal's disk and prevent them from being modified by untrusted processes is a technical problem that urgently needs to be solved. Summary of the invention

[0005] The main purpose of this application is to provide a process detection method, device and storage medium to solve the problem of how to accurately identify non-ransomware processes when a terminal faces the risk of file encryption ransomware in the related art.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a process detection method is provided, which is applied to a protection system, and the protection system is deployed in at least one terminal. The method includes: in the case of detecting a file operation request of a process to be identified for a target file in a disk of a target terminal, identifying whether the process to be identified belongs to a trusted process based on a set of trusted processes, wherein the target terminal is any terminal of the at least one terminal; in the case that the process to be identified does not belong to a trusted process, creating a copy file of the target file in a virtual mirror space of the target terminal, and detecting whether the process to be identified belongs to a non-ransomware process based on the file operation performed by the process to be identified on the copy file; in the case that the process to be identified belongs to a non-ransomware process, adding the process to be identified as a trusted process to the set of trusted processes.

[0007] Further, based on the file operation performed by the process to be identified on the copy file, detecting whether the process to be identified is a non-ransom process includes: when the copy file after the first file operation indicated by the file operation request is executed is in an abnormal state, determining that the process to be identified is a ransom process; or, calculating the entropy value difference before and after the copy file is executed by the first file operation, and when the entropy value difference is less than a first preset value, determining that the process to be identified is a non-ransom process; or, when it is detected that the process to be identified has not executed a third file operation within a preset time period, and the at least one terminal has not determined that the process to be identified is a ransom process, determining that the process to be identified is a non-ransom process, wherein the third file operation includes at least one of the following: a preset infiltration operation, delivering a ransom letter, and deleting a copy; or, identifying whether the process to be identified is a non-ransom process based on the characteristic information of the first file operation.

[0008] Further, identifying whether the process to be identified is a non-ransom process based on the characteristic information of the first file operation includes: determining the number of files processed by the first file operation, and determining that the process to be identified is a non-ransom process when the number of files is less than a second preset value; or determining the number of file modifications of the first file operation, and determining that the process to be identified is a non-ransom process when the number of file modifications is less than a third preset value; or determining that the process to be identified is a non-ransom process when the target file to which the copy file processed by the first file operation belongs is located in the specified file path of the target terminal; or determining that the process to be identified is a non-ransom process when the first file operation is a deletion operation or a rename operation within a preset time length.

[0009] Furthermore, before identifying whether the process to be identified belongs to a trusted process based on the trusted process set, the method also includes: for each terminal among the at least one terminal, receiving the trusted process set sent by the target device through the terminal, wherein the target device is used to receive the first process set sent by each terminal, summarize the trusted process set, and send the trusted process set to each terminal among the at least one terminal; or, for each terminal among the at least one terminal, broadcasting the first process set of the terminal to other terminals among the at least one terminal through the terminal, and updating the first process set of the terminal according to the first process set received by the terminal to obtain the trusted process set.

[0010] Furthermore, before identifying whether the process to be identified belongs to a trusted process based on the trusted process set, the method also includes: for each terminal of the at least one terminal, performing the following operations: obtaining event information of at least one first process of the terminal, wherein the at least one first process is a process that performs a second file operation on a first file that needs to be protected in the terminal, and the event information includes at least one of the following: the file name, file path, and process path of the first file; in the case that the first file does not cause a ransomware event, determining the trusted process based on the event information of the at least one first process, and obtaining the first process set of each terminal, wherein the first process sets of different terminals are used to aggregate to obtain the trusted process set.

[0011] Furthermore, the method also includes: for each of the at least one terminal, determining at least one third process in the virtual mirror area of ​​the terminal; when the at least one third process of the terminal includes any trusted process in the trusted process set, synchronizing the second file processed by the trusted process in the virtual mirror space of the terminal to the disk of the terminal, and deleting the second file in the virtual mirror area space.

[0012] Furthermore, after detecting whether the process to be identified is a non-ransomware process, the method further includes: if the process to be identified is a ransomware process, deleting the copy file and using the target file as the latest version of the file.

[0013] Furthermore, before creating a copy file of the target file in the virtual mirror space of the target terminal, it includes: determining the storage space and storage type of the terminal for each of the at least one terminal; defining a first structure, wherein the first structure is used to implement operations of a preset operating system on files in the mirror file system; defining a second structure, wherein the second structure is used to implement operations of a preset type of file system on files in the mirror file system; and constructing the virtual mirror space of each terminal based on the storage space, the storage type, the first structure, and the second structure, wherein the virtual mirror space communicates with the protection system through a preset interface.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a process detection device is provided, which is communicatively connected to at least one terminal, and the device includes: an identification unit, which is used to identify whether the process to be identified belongs to a trusted process based on a trusted process set when a file operation request of the process to be identified to a target file in a disk of a target terminal is detected, wherein the target terminal is any terminal among the at least one terminal; a creation unit, which is used to create a copy file of the target file in the virtual mirror space of the target terminal when the process to be identified does not belong to a trusted process, and detect whether the process to be identified belongs to a non-ransomware process based on the file operation performed by the process to be identified on the copy file; a first processing unit, which is used to add the process to be identified as a trusted process to the trusted process set when the process to be identified belongs to a non-ransomware process.

[0015] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements any one of the process detection methods described above, and which, when executed by a processor, implements the steps of the process detection method described in each embodiment of the present application.

[0016] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, any one of the above-mentioned process detection methods is implemented.

[0017] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the process detection methods described above.

[0018] The technical solution provided by the embodiment of the present application greatly shortens the time for confirming and responding to potential ransomware attacks by detecting file operation requests of the process to be identified in the terminal for the target file in real time, and quickly identifies the credibility of these processes according to the trusted process set, thereby reducing the risk of data being encrypted by ransomware. Then, for the process to be identified that does not belong to the trusted process set, a copy file of the target file is created in the virtual mirror space, which can isolate the potentially dangerous operations initiated by the unknown process without affecting the normal disk files, effectively protect the user's key data from direct attacks by ransomware, and avoid unnecessary data loss. At the same time, by detecting whether the process to be identified is a non-ransomware process based on the file operation performed by the process to be identified on the copy file, and if the process to be identified is a non-ransomware process, the process to be identified is added to the trusted process set as a trusted process, thereby quickly and accurately identifying whether the unknown process is a non-ransomware process, thereby more effectively protecting the files stored in the terminal's disk and further reducing the risk of terminal disk files being ransomed. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flow chart of a process detection method provided according to Embodiment 1 of the present application;

[0021] Figure 2 It is a functional module structure of an optional protection system provided according to the first embodiment of the present application;

[0022] Figure 3 This is an optional file processing process provided according to Embodiment 1 of the present application;

[0023] Figure 4 is a schematic diagram of a process detection device provided according to Embodiment 2 of the present application;

[0024] Figure 5 It is a schematic diagram of a file processing electronic device provided according to Embodiment 5 of the present application. DETAILED DESCRIPTION

[0025] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0026] It should be noted that the user information (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of relevant countries and regions, necessary confidentiality measures are taken, and public order and good morals are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0027] It should be noted that this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] The present application is described below in conjunction with preferred implementation steps. Figure 1 is a flowchart of a process detection method provided in Embodiment 1 of the present application, the method is applied to a protection system, and the protection system is deployed in at least one terminal, such as Figure 1As shown, the method comprises the following steps:

[0032] Step S101, when a file operation request of a process to be identified to a target file in a disk of a target terminal is detected, identifying whether the process to be identified belongs to a trusted process according to a trusted process set, wherein the target terminal is any terminal of at least one terminal.

[0033] The execution subject of the process detection method provided in the first embodiment of the present application is a protection system. The protection system is deployed on the target terminal, and the target terminal can be any computer system that needs to be protected, such as a personal computer (PC), a server, a mobile device, etc. Through the above-mentioned process detection method, the protection system can monitor file operations in real time without significantly affecting the system performance, intelligently analyze the credibility of unknown processes, and quickly restore encrypted files to the most recent modification state of the trusted process when necessary, effectively resisting the threat of ransomware. The execution subject is not limited to a single terminal, but can connect multiple terminals through a network to build a protection network that shares a set of trusted processes. Each terminal can independently run the protection system, and at the same time share trusted process information with other terminals through a data synchronization mechanism, thereby improving the protection efficiency and response speed of the entire network and reducing the protection burden of a single terminal.

[0034] In the first embodiment, an unknown process can be referred to as a process to be identified. When an operation request (such as read, write, delete or rename request, etc.) is initiated on a specific file (i.e., the target file mentioned above) in a target terminal (which can be any terminal on which the protection system of the present application has been deployed, including a PC, server or mobile device), the protection system will immediately start the detection mechanism. The first step of this detection mechanism is to check whether the "process to be identified" has been identified as a trusted process, that is, whether it exists in the trusted process set maintained by the protection system.

[0035] The trusted process set is a list of all known safe process information. The trusted process set is initially constructed based on the monitoring of file modification events when the protection system is first deployed, and is continuously updated in subsequent operations based on the shared information of other terminals and the detection results of non-ransomware processes. It is shared by all terminals that have deployed the protection system of this application, allowing all terminals to quickly identify and synchronize the information of trusted processes, improving the security and efficiency of the entire system.

[0036] Step S102, when the process to be identified is not a trusted process, a copy file of the target file is created in the virtual mirror space of the target terminal, and based on the file operation performed by the process to be identified on the copy file, it is detected whether the process to be identified is a non-ransomware process.

[0037] In the first embodiment of the present invention, when the protection system detects that the process to be identified attempts to operate the target file on the disk of the target terminal, but the process to be identified is not in the "trusted process set" maintained by the protection system, that is, the protection system believes that the security of the process to be identified has not been confirmed, it will take a protection measure, that is, create a copy file of the target file in the virtual mirror space of the target terminal to prevent potential ransomware or other malware from causing irreversible damage to the files on the disk.

[0038] For example, the virtual image space is an isolated space built on the virtual file system (VFS) technology, which is invisible to general applications and users. This space is used to store copies of files operated by unknown or potentially untrusted processes, ensuring that even if these processes have bad intentions, such as encrypting or deleting files, they can only be performed in the virtual image space without affecting the original files on the terminal disk.

[0039] In an optional embodiment, when the process to be identified attempts to perform an operation (such as writing, deleting, or renaming, etc.) indicated by a file operation request on a target file on the disk of the target terminal, the protection system will immediately intervene and will not allow this operation to act directly on the file on the disk, but will intercept this operation through the interface of the virtual file system (VFS). The protection system will check whether a copy has been created for this target file in the virtual mirror space. If not, the system will immediately create a copy file of the target file and copy the current state of the target file on the disk to this copy file. The operation action indicated by the file operation request of the process to be identified for the target file is redirected to the copy file that has been created in the virtual mirror space, rather than directly operating the target file on the terminal disk. This means that no matter what operation the process to be identified attempts to perform, these operations will only occur on the copy file in the virtual mirror space, and will not change the target file on the disk.

[0040] This redirection operation includes not only writing files, but also all types of modification operations such as deleting and renaming files. Even if the process to be identified attempts to delete or rename the target file, these operations will be performed on the copy file, thus protecting the integrity and security of the original file.

[0041] Then, after the redirection operation is completed, the protection system will continuously monitor and analyze the file operation behavior performed by the process to be identified on the copy file to determine whether it has the characteristics of a non-ransomware process. Non-ransomware processes refer to normal applications or user operations that do not perform ransomware behavior. For example, by counting the number of files processed by the process to be identified, or by continuously monitoring the behavior of the process to be identified within a preset time period, it is determined whether the process to be identified is a non-ransomware process. If the process to be identified is confirmed to be a non-ransomware process, the system will update the status of the process to a trusted process and allow it to directly operate files on the disk instead of through copy files in the virtual mirror space. In addition, the protection system will also synchronously update the trusted process set of other terminals, thereby avoiding the need for each terminal to repeatedly detect and confirm the process, thereby improving the protection efficiency and response speed of the entire business system.

[0042] Through the above mechanism, when an unknown process attempts to modify a file, immediate protection can be provided to ensure that the original file is not encrypted or modified, thereby effectively resisting attacks from malware such as ransomware. At the same time, this method also allows the protection system to continuously analyze the unknown process until it is determined whether it is a non-ransomware process, thereby ensuring file security while avoiding excessive restrictions on normal business processes. At the same time, by detecting and analyzing the ransomware process of the file processing process (i.e. the above-mentioned process to be identified), the file can be protected from encryption by ransomware while ensuring that normal business processes and user experience are not affected.

[0043] Step S103: When the process to be identified is a non-ransomware process, the process to be identified is added to the trusted process set as a trusted process.

[0044] In some embodiments, the above method may also include: when the process to be identified is a non-ransomware process, synchronizing the copy files processed by the process to be identified in the virtual mirror space of the target terminal to the disk of the terminal, and deleting the copy files in the virtual mirror space.

[0045] In an optional embodiment, the modification behavior of the process to be identified on the copy files in the virtual mirror area space can be continuously monitored and analyzed, and the behavioral characteristics of the process to be identified can be identified through the set algorithm and logical judgment to determine whether they meet the definition of non-ransomware behavior. Once it is determined that the process to be identified is a non-ransomware process, that is, it is a safe and non-malicious process, the protection system will add it to the trusted process set based on the process information of the process to be identified (such as process path, PID, etc.) to form an updated trusted process set. The updated trusted process set not only includes the trusted processes determined when the system is first deployed, but also dynamically adds processes that are confirmed to be safe through behavioral detection. This step is crucial to building and maintaining a comprehensive and real-time updated trusted process set.

[0046] After adding the process to be identified as a trusted process to the trusted process set, the trusted process set is updated. The updated trusted process set will be sent to each terminal in the network through the network propagation mechanism. After receiving the set, the terminal will compare and merge it with the locally maintained trusted process set to ensure that the local set contains the latest trusted process information in the network. This information sharing and updating mechanism improves the accuracy and response speed of terminal identification of trusted processes and enhances the ransomware protection capabilities of the entire network.

[0047] In this embodiment, when a process to be identified is confirmed as a non-ransomware process, the protection system will synchronize the copy files processed by the process in the virtual mirror space to the terminal's disk and restore the latest modification status of the file. This process ensures that changes to the non-ransomware process will not be lost, while freeing up storage resources occupied in the virtual mirror space to maintain efficient operation of the system. The deletion of the copy files also ensures the rational use of disk space and avoids the accumulation of a large number of useless copy files.

[0048] In an optional embodiment, if the process to be identified is determined to be a ransomware process, the protection system will immediately delete all the copy files processed by the process in the virtual image space. This is because the ransomware process may have encrypted or destroyed the copy files, and there is no point in retaining these files, but they may take up valuable storage space. After deleting the copy files, the system can ensure that the terminal's disk files are not affected, and the user's files can be restored to the state last modified by the trusted process, effectively preventing the damage of ransomware.

[0049] Through the above mechanism, this application can intelligently identify and process unknown processes, dynamically update the set of trusted processes, and maintain the high performance and stability of the system while ensuring file security, providing enterprise users with a comprehensive and accurate ransomware protection and file recovery solution.

[0050] In summary, by real-time detection of file operation requests for target files by the processes to be identified in the terminal and quickly identifying the trustworthiness of these processes based on the trusted process set, the time for confirming and responding to potential ransomware attacks is greatly shortened, thereby reducing the risk of data being encrypted by ransomware. Then, for the processes to be identified that do not belong to the trusted process set, a copy of the target file is created in the virtual mirror space, which can isolate the potential dangerous operations initiated by the unknown process without affecting the normal disk files, effectively protecting the user's key data from direct attacks by ransomware and avoiding unnecessary data loss. At the same time, by detecting whether the process to be identified is a non-ransomware process based on the file operations performed on the copy file by the process to be identified, and if the process to be identified is a non-ransomware process, the process to be identified is added to the trusted process set as a trusted process, thereby quickly and accurately identifying whether the unknown process is a non-ransomware process, further reducing the risk of terminal disk files being ransomed.

[0051] Optionally, in the process detection method provided in the first embodiment of the present application, based on the file operation performed by the process to be identified on the copy file, detecting whether the process to be identified is a non-ransom process includes: when the copy file after the first file operation indicated by the file operation request is executed is in an abnormal state, determining that the process to be identified is a ransomware process; or, calculating the entropy value difference before and after the copy file is executed with the first file operation, and when the entropy value difference is less than a first preset value, determining that the process to be identified is a non-ransomware process; or, when it is detected that the process to be identified has not executed a third file operation within a preset time period, and at least one terminal has not determined that the process to be identified is a ransomware process, determining that the process to be identified is a non-ransomware process, wherein the third file operation includes at least one of the following: a preset infiltration operation, delivering a ransom letter, and deleting a copy; or, identifying whether the process to be identified is a non-ransomware process based on the characteristic information of the first file operation.

[0052] In an optional embodiment, after the copy file in the virtual mirror space is subjected to the first file operation (such as modification, encryption) by the process to be identified, if its content or state exhibits characteristics that are significantly different from normal operation, the system will regard this state as an abnormal state. For example, if the content of the copy file is irreversibly encrypted, or the file structure is severely damaged so that it cannot be read normally or recognized by other applications, it is determined that the process to be identified that performs the first file operation has malicious behavior characteristics and is most likely a ransomware virus. In this case, the process to be identified will be marked as a ransomware process, and the system will immediately take measures to terminate its operation and delete all copy files operated by the process in the virtual mirror space to ensure that the ransomware virus does not cause any damage to the original files on the disk.

[0053] In an optional embodiment, when the copy file after the execution of the first file operation indicated by the file operation request is in a normal state, it is determined that the process to be identified is a non-ransomware process.

[0054] In an optional embodiment, the entropy value is an indicator that measures the randomness and complexity of data in a file. The entropy value of a file will usually increase significantly after it is encrypted, so this feature can be used to determine whether the process to be identified is a non-ransomware process. The protection system will calculate the difference in entropy values ​​of the copy file before and after the first file operation (such as modification) is performed. If this entropy value difference is less than the preset first threshold, it means that the content of the file has not changed significantly, and no encryption or destructive modification has occurred. Therefore, it can be preliminarily determined that the process to be identified that performs the first file operation is a non-ransomware process. Once the process is determined to be a non-ransomware process, the protection system will add it to the trusted process set and allow it to modify files directly on the terminal disk, and no longer operate through the virtual mirror space.

[0055] When the entropy value difference between the entropy value obtained after the first file operation is executed on the copy file and the entropy value obtained before the first file operation is executed on the copy file is greater than or equal to a first preset value, it is determined that the process to be identified is a ransomware process.

[0056] In an optional embodiment, the protection system can also observe the behavior pattern of the process to be identified over a period of time to determine whether it is a non-ransom process. If within a preset period of time (for example, 24 hours), the process to be identified does not perform any of the following third file operations: executing preset malicious infiltration operations (such as attempting to connect to a malicious server, downloading malicious files, etc.), delivering ransom letters (such as creating a ransomware prompt file or displaying a ransomware interface), deleting copy files (this usually means that the process is trying to hide its operation traces), and on all terminals, the process is not marked as a ransomware process, then it can be confirmed that the process is a non-ransomware process. This judgment based on behavioral patterns provides additional protection to ensure that only processes that have been fully tested and verified can be added to the trusted process set.

[0057] In an optional embodiment, the protection system can also identify whether the process to be identified is a non-ransomware process based on the characteristic information of the first file operation. The characteristic information may include but is not limited to the file operation type (read, write, delete, etc.), operation frequency, operation time mode, operation file type and location, etc. For example, if the process to be identified performs multiple write operations on the same file within a preset time period, but does not perform other operations such as deletion or renaming, and the changes in the file content conform to the normal operation mode, this may indicate that the process is a non-ransomware process.

[0058] Through the comprehensive application of the above mechanisms, this application can accurately analyze the behavior of the process to be identified and accurately determine whether it is a ransomware process or a non-ransomware process, thereby effectively building and maintaining a trusted process set and improving the accuracy and efficiency of ransomware protection. This method not only avoids excessive restrictions on normal business processes, but also responds to unknown threats in real time, providing comprehensive data security protection for end users.

[0059] Optionally, in the process detection method provided in Example 1 of the present application, identifying whether the process to be identified is a non-ransom process based on characteristic information of the first file operation includes: determining the number of files processed by the first file operation, and determining that the process to be identified is a non-ransom process when the number of files is less than a second preset value; or determining the number of file modifications of the first file operation, and determining that the process to be identified is a non-ransom process when the number of file modifications is less than a third preset value; or determining that the process to be identified is a non-ransom process when the target file to which the copy file processed by the first file operation belongs is located in a specified file path of the target terminal; or determining that the process to be identified is a non-ransom process when the first file operation is a deletion operation or a rename operation within a preset time length.

[0060] In an optional embodiment, the protection system counts the number of files processed by the process to be identified in the virtual image space through the first file operation (such as writing, encryption). If this number is less than a second preset value (for example, 200, 50, etc., which is not specifically limited in this embodiment), that is, fewer files are modified, this may indicate that the behavior pattern of the process to be identified is different from a typical ransomware attack. Ransomware usually encrypts multiple files extensively and quickly, while normal applications or user operations often target only a few specific files. Therefore, if the number of files is small, the system can preliminarily determine that the process to be identified is a non-ransomware process, thereby increasing its trust in it.

[0061] In an optional embodiment, the protection system also tracks the number of times the process to be identified modifies the same file. If the number of modifications to a file is less than a third preset value, this may mean that the process's operation on the file is a normal edit or update, rather than repeated attempts to encrypt. In order to ensure successful file encryption, ransomware may make multiple encryption attempts on the same file, and normal modification behavior usually does not involve such frequent modifications. Therefore, the limit on the number of modifications is another important feature for determining whether an unknown process is a non-ransomware process.

[0062] In an optional embodiment, the protection system checks whether the files processed by the process to be identified through the first file operation are all located under the same file path. Typically, ransomware attacks a wide range of areas, and they attempt to encrypt files stored in different directories. However, normal application or user operations are often limited to specific working directories or folders. Therefore, if the system finds that the file operations of the process to be identified are limited to files under the same path, this may indicate that the behavior pattern of the process is different from that of the ransomware, and it can be determined that it is a non-ransomware process.

[0063] In an optional embodiment, the protection system analyzes the first file operation type performed by the process to be identified within a preset time period. If within this period, the first file operation is mainly a deletion operation or a rename operation, rather than a write or other operation that may cause the file content to change, the process to be identified can be judged as a non-ransomware process. After encrypting a file, the ransomware usually modifies the file content immediately without performing a deletion or rename action. Normal application or user operations may include deletion or renaming of files, but this does not result in encryption or irreversible modification of the file content.

[0064] Through the above judgment method, the present application provides an intelligent and efficient method to identify whether an unknown process is a non-ransomware process, thereby dynamically updating the trusted process set to ensure that only safe processes can directly modify files on the disk, effectively preventing ransomware attacks while maintaining the normal operation of the system and the security of user data.

[0065] Optionally, in the process detection method provided in Example 1 of the present application, before identifying whether the process to be identified belongs to a trusted process based on the trusted process set, the above method also includes: for each terminal in at least one terminal, perform the following operations: obtain event information of at least one first process of the terminal, wherein the at least one first process is a process that performs a second file operation on a first file that needs to be protected in the terminal, and the event information includes at least one of the following: the file name, file path, and process path of the first file; when the first file does not cause a ransomware event, determine the trusted process based on the event information of at least one first process to obtain a first process set for each terminal; the first process sets of different terminals are used to aggregate to obtain a trusted process set.

[0066] Here, the first file of the terminal is any file that needs to be protected. For example, the first file may be a file of the terminal with a preset file suffix or a preset file path.

[0067] In the first embodiment of the present invention, in order to identify the files that need to be protected, a file screening rule can be preset. Usually, this rule is based on the file suffix (for example, ".doc", ".pdf", etc.) or the file storage path (such as C:\Users\Documents\). The protection system will continue to monitor the files identified by these preset rules, i.e., the "first files", to prevent them from being attacked by unauthorized modifications or ransomware. When the protection system detects that a process (i.e., the first process mentioned above) attempts to perform a second file operation on the first file mentioned above (such as opening, modifying, deleting, etc.), the event information of the second file operation will be recorded. The event information includes at least the file name, file path, and the process path that performs the operation. This information is very important for subsequent analysis and judgment of whether the process is trustworthy.

[0068] Then, the protection system determines the trusted process based on the event information, for example, based on the process's source, behavior pattern, whether it is marked as safe by other security software, etc. For each terminal, the protection system determines which processes can be considered trusted processes based on the collected event information, forming the first process set for each terminal.

[0069] Since the trusted process set is shared among multiple terminals, each terminal will collect and maintain its own first process set. Next, a first process set merging operation is performed to combine the first process sets of all terminals, and finally form a trusted process set within the protection network, thereby improving the entire network's ability to identify and respond to unknown or potentially malicious processes.

[0070] Through the above steps, a dynamic trusted process set based on actual file operations can be built. This set can not only be updated in real time according to file modification events on the terminal, but also be shared between terminals within the network to ensure that each terminal can make security decisions based on the latest data. This method greatly improves the protection against ransomware and other malware, while reducing misjudgments and resource waste, providing a more intelligent and efficient solution for file protection.

[0071] Optionally, in the process detection method provided in the first embodiment of the present application, the above method may also include: for each terminal in at least one terminal, receiving a trusted process set sent by a target device through the terminal, wherein the target device is used to receive a first process set sent by each terminal, aggregating to obtain a trusted process set, and sending the trusted process set to each terminal in at least one terminal; or, for each terminal in at least one terminal, broadcasting the first process set of the terminal to other terminals in at least one terminal through the terminal, and updating the first process set of the terminal based on the first process set received by the terminal to obtain a trusted process set.

[0072] Here, the target device may be another device independent of the at least one terminal (eg, a central device respectively connected to the at least one terminal), or may be a terminal selected as a master node among the at least one terminal.

[0073] In an optional embodiment, each terminal continuously monitors and collects process information of executing file operations on the terminal, so as to determine the trusted process to form a first process set. These first process sets will be sent to the target device in the network. The target device is responsible for receiving and summarizing the first process sets from each terminal, and constructing a more comprehensive and trusted trusted process set through algorithms such as merging, deduplication, and cross-validation to ensure the accuracy of the trusted process set and avoid the mixing of malicious processes. The target device is responsible for sending the constructed set back to each terminal. After each terminal receives the trusted process set, it will merge and update it with the first process set of the terminal to form a local trusted process set of the terminal. For example, if a process shared with other terminals in the network is found in the local trusted process set of the terminal, but it has not been identified as a trusted process before, the terminal will mark these processes as trusted, which means that their operations will no longer be redirected to the virtual mirror space, but will be performed directly on the disk.

[0074] In another optional embodiment, each terminal can actively broadcast its first process set to other terminals. This means that when a terminal finds that a process is safe, it will immediately inform all other terminals in the network of this information without waiting for the target device to summarize and distribute it. After each terminal receives the first process set broadcast by other terminals, it will automatically merge and update it with the local first process set of the terminal. This process may include operations such as deduplication, adding newly identified trusted processes, and removing processes that have been marked as malicious. In this way, the trusted process set can be quickly updated, and the security protection capabilities of the terminal can be instantly improved, which not only improves the system's robustness to network interruptions or server failures, but also speeds up the construction and update speed of the trusted process set. It should be noted that if the trusted process set received by a terminal marks process A as an unknown process, and the local first process set of the terminal marks process A as a trusted process, then process A can be regarded as a trusted process as a result. Because of the delay in broadcast transmission and process identification, other terminals have not yet been able to identify process A as a trusted process. Therefore, when different identification results about a process are received, the identification result of the process can be determined based on whether the process has a trusted process mark. That is, if the process is identified as a trusted process by any terminal, other terminals can use the process being a trusted process as the final identification result.

[0075] Through the above two mechanisms, this application can realize real-time sharing and updating of trusted process information, promote security protection collaboration of terminals within the network, effectively improve the ability to respond quickly to unknown threats, reduce the risk of attacks by malware such as ransomware, and ensure system stability and security in a multi-terminal environment.

[0076] Optionally, in the process detection method provided in Example 1 of the present application, the above method also includes: for each terminal in at least one terminal, when at least one third process of the terminal includes any trusted process in the trusted process set, synchronizing the second file processed by the trusted process in the virtual mirror space of the terminal to the disk of the terminal, and deleting the second file in the virtual mirror space.

[0077] In an optional embodiment, on each terminal where the protection system is deployed, the protection system periodically checks the third processes in the virtual image space to determine whether they have been identified as elements in the trusted process set. The trusted process set is a dynamically updated list that contains all process information that is known or confirmed as a trusted process through behavioral analysis. If it is detected that at least one third process has now been determined as a trusted process in the trusted process set, this means that the process has been confirmed as a safe and trustworthy process by other terminals in the system or network.

[0078] Then, without manual intervention, the protection system will automatically synchronize all the file copies (i.e., the second file) processed by the third process in the virtual mirror space to the terminal's disk. This step ensures that changes to the trusted process can be reflected in the real file system in a timely manner, avoiding data loss or delay. At the same time, after the file synchronization is completed, the protection system will delete the second file copy in the virtual mirror space, free up storage space, maintain the efficient operation of the virtual mirror space, and avoid waste of resources.

[0079] The above mechanism can not only effectively protect the terminal from ransomware attacks, but also ensure that normal business processes and user experience are not affected. It achieves precise protection of files in the terminal through intelligent analysis and dynamic update of trusted process sets, while reducing the storage pressure of virtual image space and improving the stability and efficiency of the entire system. This approach has significant advantages in protecting the security of individual users and corporate data, especially in the current environment where ransomware attacks are becoming increasingly frequent and complex.

[0080] Optionally, in the process detection method provided in the first embodiment of the present application, after creating a copy file of the target file in the virtual mirror space of the target terminal, the above method also includes: when the process to be identified is a ransomware process, deleting the copy file and using the target file as the latest version of the file.

[0081] In the first embodiment of the present invention, if it is determined that the process to be identified is a ransomware process, the protection system will immediately delete all the copy files operated by the ransomware process in the untrusted virtual image space. These copy files are created by the system during the redirection of file operations, and are used to isolate the direct modification of the actual disk files by the process to be identified to prevent the data from being permanently encrypted or destroyed. By deleting the copy files, the protection system ensures that the activities of the ransomware process in the virtual image space will not leave any encrypted or damaged data, thereby preventing the ransomware from actually damaging the data.

[0082] Then, after detecting the ransomware process, the protection system will restore the target file (i.e., the disk file that the ransomware process originally attempted to modify) to the latest version of the file, that is, the version that is not affected by the ransomware process. Since all file operations performed by the ransomware process are redirected to the copy file, the target file on the disk is not actually modified. At this point, the protection system can directly mark the target file (i.e., the state last modified by the trusted process) as the latest version of the file, without the need to restore from the backup, because no real data loss or encryption event occurs.

[0083] Specifically, after discovering the ransomware process, the protection system will shut down the forwarding of file operations to the ransomware process to ensure that it can no longer operate any files. The protection system will no longer update or retain any file copies related to the ransomware process, but will directly use the target file on the original disk (i.e., the file last modified by the trusted process) as the latest version for continued use by applications and users. In the present invention, once a process is confirmed to be a ransomware process, any subsequent file operations initiated by the process will be directly blocked to prevent further attacks and data damage.

[0084] Through the above mechanism, the encryption behavior of ransomware can be effectively blocked to protect the user's files and data security. At the same time, because the protection system can quickly identify and process the ransomware process, users can quickly return to the normal working environment, avoiding a long data recovery process and business interruption, ensuring data continuity and business stability, and reducing potential losses and recovery costs caused by ransomware attacks.

[0085] Optionally, in the process detection method provided in the first embodiment of the present application, before creating a copy file of the target file in the virtual mirror space of the target terminal, it includes: determining the storage space and storage type of the terminal for each terminal in at least one terminal; defining a first structure, wherein the first structure is used to implement the operation of a preset operating system on files in the mirror file system; defining a second structure, wherein the second structure is used to implement the operation of a preset type of file system on files in the mirror file system; constructing a virtual mirror space for each terminal based on the storage space, storage type, the first structure and the second structure, wherein the virtual mirror space communicates with the protection system through a preset interface.

[0086] In an optional embodiment, the protection system first needs to understand the storage space size and storage type of each terminal. The storage space size determines how much space the virtual mirror space can occupy to store copies of files operated by unknown processes. The storage type includes the type of file system that may be used on the terminal, such as FAT32, NTFS, ext4, APFS, etc., which will affect the design and implementation of the virtual mirror space. Information about storage space and type is crucial to ensuring the efficient operation and compatibility of the virtual mirror space, because different types of file systems may require different processing methods and interfaces.

[0087] Then, in order to achieve compatibility and interaction between the virtual mirror space and the terminal operating system and file system, the protection system needs to define two key structures: the first structure is used to implement the preset operating system's operations on files in the mirror file system, which involves the encapsulation of the file operation interface at the operating system level, for example, the fsync, mount, unmount and other parameters in the file_system_operations method to ensure that the operating system can correctly communicate with the virtual mirror space and perform file operations; the second structure is used to implement the operations of a specific type of file system on files in the mirror file system, which involves the encapsulation of specific behaviors and operations of different file system types, for example, the file operation table (file_operations), which contains parameters such as read, write, open, release, etc., so that the virtual mirror space can simulate these file operation behaviors and be compatible with various file system types to ensure the correctness and consistency of file operations.

[0088] Finally, according to the storage space size and type of the terminal, determine the size and performance requirements of the virtual image space to ensure that it is large enough to accommodate the file copies operated by the unknown process, but will not occupy too many terminal resources to affect performance. Implement the first structure and the second structure to ensure that the virtual image space can interact with the preset operating system and file system type through these structures, including file reading, writing, modification, deletion and other operations. Design the architecture and data management strategy of the virtual image space, such as the copy-on-write mechanism, to minimize resource consumption while maintaining data integrity and security. Ensure that the virtual image space communicates with the protection system through the preset interface, which means that the virtual image space can only receive instructions sent by the protection system, such as redirecting file operations to the virtual image space, avoiding other potentially dangerous processes from adjusting or modifying the virtual image space, improving the data security of enterprise users, and being able to report the file operation status and results to the protection system to support subsequent non-ransomware process detection and file recovery operations.

[0089] The communication mechanism between the virtual image space and the protection system is the key to ensuring the overall performance and security of the system. The design of the preset interface should take into account efficiency, security, and compatibility to ensure that all necessary communications can be carried out quickly and securely between the virtual image space and the protection system. For example, when an unknown process operates on a file, the protection system needs to be able to immediately redirect the operation to the virtual image space, and after the virtual image space has processed the operation, it should also be able to promptly notify the protection system to facilitate subsequent analysis and processing of the unknown process.

[0090] Through the above steps, a highly customized virtual image space compatible with the operating system and file system can be built for each terminal, ensuring immediate protection when an unknown process attempts to modify the file. At the same time, through efficient communication with the protection system, it supports intelligent detection of non-ransomware processes and rapid recovery of files, thereby maintaining system performance and user experience while ensuring data security, reflecting the innovation and practicality of this application in the field of ransomware protection.

[0091] Optionally, in the first embodiment, the functional module structure of the protection system in the present solution can be as follows: Figure 2 shown. Figure 2It includes a file modification monitoring module, an untrusted virtual image module, and a non-ransom process precision detection module. The file modification monitoring module is responsible for monitoring file modification events within the protected scope, including file write, rename, and delete operations. The file modification monitoring module collects process information that performs modification operations, and determines trusted processes and untrusted processes in unknown processes that perform file operations. The untrusted virtual image module is a virtual file space that is invisible to the operating system by default and supports real-time updates. It is used to store copies of files when files are modified by untrusted processes to ensure that the original files on the terminal disk are not affected. The non-ransom process detection module is responsible for continuously detecting and analyzing the modification behavior of untrusted processes on files, and judging whether the process belongs to a ransom process or a non-ransom process through a variety of operation behavior characteristics. If a non-ransom process is detected, the module will provide information to make the untrusted process a trusted process and synchronize the relevant image files to the disk.

[0092] Optionally, in the first embodiment, a file processing flow may be as follows: Figure 3 As shown in the figure. Trusted process A (known safe process) initiates a request for file 1. Since process A belongs to the known trusted process set, the request can directly access and operate file 1 on the terminal disk through the regular path of the file system without additional detection or redirection. Unknown process B (a process that has not yet been identified as trusted or untrusted by the protection system) initiates a request for file 2. In order to prevent potential ransomware attacks, the system uses the Copy-on-Write (COW) mechanism to copy the current state of file 2 to the virtual mirror space. In this way, even if process B is a malicious process, its operation can only affect the copy of the file in the virtual mirror without causing damage to the original file on the disk. Subsequently, unknown process B is redirected to the virtual mirror space, and all subsequent operations on file 2 are performed in the isolated virtual mirror space. During the operation of unknown process B, trusted process A may need to access file 2. Since the copy of file 2 is in the virtual mirror, in order to ensure the consistency and security of the file, A's request is also redirected to the virtual mirror space. This means that before unknown process B is finally judged, all access and modification to file 2 will be performed in this isolated environment. When unknown process B operates file 2, the non-ransomware process detection module (such as Figure 2The non-ransomware process detection module in the system continuously monitors B's file operation behavior. The detection logic may include but is not limited to the number of file modifications, the frequency of modifications, the change in file entropy before and after the modification, whether suspicious system commands are executed, etc. These indicators are used to determine whether the unknown process B has the characteristics of non-ransomware behavior, that is, whether it can be identified as a safe and non-malicious process. If the behavior of the unknown process B is determined to be non-ransomware behavior during the detection cycle, that is, B's modification conforms to the normal file operation mode, it will be identified as a non-ransomware process and eventually converted to a trusted process B. This conversion process is accompanied by synchronizing the files related to B in the virtual image space back to the disk to ensure that the modified content is not lost. At the same time, the copies related to B in the virtual image space are cleaned up to release the occupied resources and keep the system running efficiently.

[0093] Through the above steps, the process detection method of the present application can effectively distinguish between trusted processes and unknown or potentially malicious processes, protect files on the terminal from encryption and destruction by ransomware, and ensure that normal operating processes will not be subject to unnecessary interference or performance loss. This method not only improves the protection level of file security, but also optimizes the use of system resources by the security mechanism, achieving a balance between security and efficiency.

[0094] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0095] Embodiment 2

[0096] The second embodiment of the present application also provides a process detection device. It should be noted that the process detection device of the second embodiment of the present application can be used to execute the process detection method provided in the first embodiment of the present application. The process detection device provided in the second embodiment of the present application is introduced below.

[0097] Figure 4 is a schematic diagram of a process detection device according to Embodiment 2 of the present application, the device is communicatively connected to at least one terminal. Figure 4 As shown, the device includes: an identification unit 401, a detection unit 402 and a first processing unit 403.

[0098] Specifically, the identification unit 401 is used to identify whether the process to be identified belongs to a trusted process based on the trusted process set when a file operation request of the process to be identified to a target file in the disk of the target terminal is detected, wherein the target terminal is any terminal of at least one terminal.

[0099] The detection unit 402 is used to create a copy file of the target file in the virtual mirror space of the target terminal when the process to be identified is not a trusted process, and detect whether the process to be identified is a non-ransomware process based on the file operation performed by the process to be identified on the copy file.

[0100] The first processing unit 403 is configured to add the process to be identified as a trusted process to the trusted process set when the process to be identified is a non-ransomware process.

[0101] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned detection unit 402 includes: a first determination subunit, used to determine that the process to be identified belongs to a ransomware process when the copy file after the first file operation indicated by the file operation request is executed is in an abnormal state; or, a second determination subunit, used to calculate the entropy value difference before and after the copy file is executed with the first file operation, and when the entropy value difference is less than a first preset value, determine that the process to be identified belongs to a non-ransomware process; or, a third determination subunit, used to determine that the process to be identified belongs to a non-ransomware process when it is detected that the process to be identified has not executed a third file operation within a preset time period and at least one terminal has not determined that the process to be identified belongs to a ransomware process, wherein the third file operation includes at least one of the following: a preset infiltration operation, delivering a ransom letter, and deleting a copy; or, an identification subunit, used to identify whether the process to be identified belongs to a non-ransomware process based on the characteristic information of the first file operation.

[0102] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned identification subunit includes: a first determination module, used to determine the number of files processed by the first file operation, and when the number of files is less than a second preset value, determine that the process to be identified belongs to a non-ransom process; or, a second determination module, used to determine the number of file modifications of the first file operation, and when the number of file modifications is less than a third preset value, determine that the process to be identified belongs to a non-ransom process; or, a third determination module, used to determine that the process to be identified belongs to a non-ransom process when the target file to which the copy file processed by the first file operation belongs is located in a specified file path of the target terminal; or, a fourth determination module, used to determine that the process to be identified belongs to a non-ransom process when the first file operation is a deletion operation or a rename operation within a preset time length.

[0103] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned device also includes: an acquisition unit, the acquisition unit is used to: for each terminal in at least one terminal, perform the following operations: obtain event information of at least one first process of the terminal, wherein the at least one first process is a process that performs a second file operation on a first file that needs to be protected in the terminal, and the event information includes at least one of the following: the file name, file path, and process path of the first file; when the first file does not cause a ransomware event, determine a trusted process based on the event information of at least one first process, and obtain a first process set for each terminal, and the first process sets of different terminals are used to aggregate to obtain a trusted process set.

[0104] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned device also includes: a transmission unit, used to: for each terminal in at least one terminal, receive the trusted process set sent by the target device through the terminal, wherein the target device is used to receive the first process set sent by each terminal, summarize to obtain the trusted process set, and send the trusted process set to each terminal in at least one terminal; or, for each terminal in at least one terminal, broadcast the first process set of the terminal to other terminals in at least one terminal through the terminal, and update the first process set of the terminal according to the first process set received by the terminal to obtain the trusted process set.

[0105] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned first processing unit 403 is also used to: for each terminal in at least one terminal, when at least one third process of the terminal includes any trusted process in the trusted process set, synchronize the second file processed by the trusted process to the disk of the terminal, and delete the second file in the virtual mirror space.

[0106] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned device also includes: a second processing unit, which is used to delete the copy file and use the target file as the latest version of the file after detecting whether the process to be identified is a non-ransomware process if the process to be identified is a ransomware process.

[0107] Optionally, in the process detection device provided in Example 2 of the present application, the above-mentioned device includes: a fourth determination unit, used to determine the storage space and storage type of the terminal for each terminal in at least one terminal before creating a copy file of the target file in the virtual mirror space of the target terminal; a first definition unit, used to define a first structure, wherein the first structure is used to implement the operation of a preset operating system on files in the mirror file system; a second definition unit, used to define a second structure, wherein the second structure is used to implement the operation of a preset type of file system on files in the mirror file system; a construction unit, used to construct a virtual mirror space for each terminal based on the storage space, storage type, the first structure and the second structure, wherein the virtual mirror space communicates with the protection system through a preset interface.

[0108] The process detection device includes a processor and a memory. The above-mentioned identification unit 401, detection unit 402 and first processing unit 403 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0109] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the system performance of the terminal facing the risk of file ransomware can be improved by adjusting the kernel parameters.

[0110] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0111] Embodiment 3 of the present application provides a computer-readable storage medium on which a program is stored, and when the program is executed by a processor, a process detection method is implemented.

[0112] Embodiment 4 of the present application provides a processor, which is used to run a program, wherein when the program is running, the steps of the process detection method provided in any of the above embodiments are executed.

[0113] like Figure 5As shown, embodiment 5 of the present application provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: when a file operation request of a process to be identified to a target file in a disk of a target terminal is detected, whether the process to be identified belongs to a trusted process is identified based on a set of trusted processes, wherein the target terminal is any terminal of at least one terminal; when the process to be identified does not belong to a trusted process, a copy file of the target file is created in a virtual mirror space of the target terminal, and based on the file operation performed by the process to be identified on the copy file, whether the process to be identified belongs to a non-ransomware process is detected; when the process to be identified belongs to a non-ransomware process, the process to be identified is added to the set of trusted processes as a trusted process.

[0114] When the processor executes the program, the following steps are also implemented: based on the file operation performed by the process to be identified on the copy file, detecting whether the process to be identified is a non-ransom process, including: when the copy file after the first file operation indicated by the file operation request is executed is in an abnormal state, determining that the process to be identified is a ransom process; or, calculating the entropy value difference before and after the copy file is executed with the first file operation, and when the entropy value difference is less than a first preset value, determining that the process to be identified is a non-ransom process; or, when it is detected that the process to be identified has not executed a third file operation within a preset time period, and at least one terminal has not determined that the process to be identified is a ransom process, determining that the process to be identified is a non-ransom process, wherein the third file operation includes at least one of the following: a preset infiltration operation, delivering a ransom letter, and deleting a copy; or, identifying whether the process to be identified is a non-ransom process based on the characteristic information of the first file operation.

[0115] When the processor executes the program, the following steps are also implemented: determining the number of files processed by the first file operation, and determining that the process to be identified is a non-ransom process when the number of files is less than a second preset value; or determining the number of file modifications of the first file operation, and determining that the process to be identified is a non-ransom process when the number of file modifications is less than a third preset value; or determining that the process to be identified is a non-ransom process when the target file to which the copy file processed by the first file operation belongs is located in a specified file path of the target terminal; or determining that the process to be identified is a non-ransom process when the first file operation is a deletion operation or a rename operation within a preset time length.

[0116] When the processor executes the program, the following steps are also implemented: before identifying whether the process to be identified belongs to a trusted process based on the trusted process set, the above method also includes: for each terminal in at least one terminal, the following operations are performed: event information of at least one first process of the terminal is obtained, wherein at least one first process is a process that performs a second file operation on a first file that needs to be protected in the terminal, and the event information includes at least one of the following: the file name, file path, and process path of the first file; when the first file does not cause a ransomware event, the trusted process is determined based on the event information of at least one first process, and a first process set for each terminal is obtained, and the first process sets of different terminals are used to aggregate to obtain a trusted process set.

[0117] When the processor executes the program, the following steps are also implemented: the first process set of each terminal in at least one terminal is combined to obtain a trusted process set, including: for each terminal in at least one terminal, the trusted process set sent by the target device is received through the terminal, wherein the target device is used to receive the first process set sent by each terminal, summarize to obtain a trusted process set, and send the trusted process set to each terminal in at least one terminal; or, for each terminal in at least one terminal, the first process set of the terminal is broadcasted to other terminals in at least one terminal through the terminal, and the first process set of the terminal is updated according to the first process set received by the terminal to obtain a trusted process set.

[0118] When the processor executes the program, the following steps are also implemented: for each terminal in at least one terminal, when at least one third process of the terminal includes any trusted process in the trusted process set, the second file processed by the trusted process in the virtual mirror space of the terminal is synchronized to the disk of the terminal, and the second file in the virtual mirror space is deleted.

[0119] When the processor executes the program, the following steps are also implemented: after detecting whether the process to be identified is a non-ransomware process, the above method also includes: if the process to be identified is a ransomware process, deleting the copy file and using the target file as the latest version of the file.

[0120] When the processor executes the program, the following steps are also implemented: before creating a copy file of the target file in the virtual mirror space of the target terminal, it includes: for each terminal in at least one terminal, determining the storage space and storage type of the terminal; defining a first structure, wherein the first structure is used to implement the operation of a preset operating system on files in the mirror file system; defining a second structure, wherein the second structure is used to implement the operation of a preset type of file system on files in the mirror file system; constructing a virtual mirror space for each terminal based on the storage space, storage type, the first structure and the second structure, wherein the virtual mirror space communicates with the protection system through a preset interface.

[0121] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0122] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: in the case of detecting a file operation request of a process to be identified for a target file in a disk of a target terminal, identifying whether the process to be identified belongs to a trusted process based on a set of trusted processes, wherein the target terminal is any terminal of at least one terminal; in the case that the process to be identified does not belong to a trusted process, creating a copy file of the target file in a virtual mirror space of the target terminal, and detecting whether the process to be identified belongs to a non-ransomware process based on the file operation performed by the process to be identified on the copy file; in the case that the process to be identified belongs to a non-ransomware process, adding the process to be identified as a trusted process to the set of trusted processes.

[0123] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: detecting whether the process to be identified is a non-ransom process based on the file operation performed by the process to be identified on the copy file, including: when the copy file after the first file operation indicated by the file operation request is executed is in an abnormal state, determining that the process to be identified is a ransom process; or, calculating the entropy value difference before and after the copy file is executed with the first file operation, and when the entropy value difference is less than a first preset value, determining that the process to be identified is a non-ransom process; or, when it is detected that the process to be identified has not executed a third file operation within a preset time period, and at least one terminal has not determined that the process to be identified is a ransom process, determining that the process to be identified is a non-ransom process, wherein the third file operation includes at least one of the following: a preset infiltration operation, delivering a ransom letter, and deleting a copy; or, identifying whether the process to be identified is a non-ransom process based on the characteristic information of the first file operation.

[0124] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: determining the number of files processed by the first file operation, and when the number of files is less than a second preset value, determining that the process to be identified is a non-ransom process; or determining the number of file modifications of the first file operation, and when the number of file modifications is less than a third preset value, determining that the process to be identified is a non-ransom process; or, when the target file to which the copy file processed by the first file operation belongs is located in the specified file path of the target terminal, determining that the process to be identified is a non-ransom process; or, when the first file operation within a preset time period is a deletion operation or a rename operation, determining that the process to be identified is a non-ransom process.

[0125] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: before identifying whether the process to be identified belongs to a trusted process based on a trusted process set, the above method also includes: for each terminal in at least one terminal, perform the following operations: obtain event information of at least one first process of the terminal, wherein at least one first process is a process that performs a second file operation on a first file that needs to be protected in the terminal, and the event information includes at least one of the following: the file name, file path, and process path of the first file; when the first file does not cause a ransomware event, determine the trusted process based on the event information of at least one first process, and obtain a first process set for each terminal, and the first process sets of different terminals are used to aggregate to obtain a trusted process set.

[0126] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: combining the first process set of each terminal in at least one terminal to obtain a trusted process set, including: for each terminal in at least one terminal, receiving the trusted process set sent by a target device through the terminal, wherein the target device is used to receive the first process set sent by each terminal, summarizing to obtain a trusted process set, and sending the trusted process set to each terminal in at least one terminal; or, for each terminal in at least one terminal, broadcasting the first process set of the terminal to other terminals in at least one terminal through the terminal, and updating the first process set of the terminal according to the first process set received by the terminal to obtain a trusted process set.

[0127] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: for each terminal in at least one terminal, when at least one third process of the terminal includes any trusted process in a trusted process set, synchronizing a second file processed by the trusted process in a virtual mirror space of the terminal to a disk of the terminal, and deleting the second file in the virtual mirror space.

[0128] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: after detecting whether the process to be identified is a non-ransomware process, the above method also includes: if the process to be identified is a ransomware process, deleting the copy file and using the target file as the latest version of the file.

[0129] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: before creating a copy file of a target file in a virtual mirror space of a target terminal, it includes: for each terminal in at least one terminal, determining the storage space and storage type of the terminal; defining a first structure, wherein the first structure is used to implement operations of a preset operating system on files in a mirror file system; defining a second structure, wherein the second structure is used to implement operations of a preset type of file system on files in a mirror file system; constructing a virtual mirror space for each terminal based on the storage space, the storage type, the first structure, and the second structure, wherein the virtual mirror space communicates with the protection system through a preset interface.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0135] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0136] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0139] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A process detection method, characterized in that: The method is applied to a protection system, and the protection system is deployed in at least one terminal. The method includes: In the case of detecting a file operation request of a process to be identified for a target file in a disk of a target terminal, identifying whether the process to be identified belongs to a trusted process according to a trusted process set, wherein the target terminal is any terminal of the at least one terminal; In the case that the process to be identified is not a trusted process, creating a copy file of the target file in the virtual mirror space of the target terminal, and detecting whether the process to be identified is a non-ransomware process according to the file operation performed by the process to be identified on the copy file; In the case that the process to be identified is a non-ransomware process, the process to be identified is added to the trusted process set as a trusted process.

2. The method according to claim 1, characterized in that: Detecting whether the process to be identified is a non-ransomware process according to the file operation performed by the process to be identified on the copy file includes: When the copy file after the first file operation indicated by the file operation request is executed is in an abnormal state, determining that the process to be identified is a blackmail process; or Calculating the entropy value difference between the copy file and the copy file before and after the first file operation is performed, and determining that the process to be identified is a non-ransomware process when the entropy value difference is less than a first preset value; or When it is detected that the process to be identified does not perform a third file operation within a preset time period, and the at least one terminal does not determine that the process to be identified is a ransomware process, it is determined that the process to be identified is a non-ransomware process, wherein the third file operation includes at least one of the following: a preset penetration operation, delivering a ransom letter, and deleting a copy; or, Identify whether the process to be identified is a non-ransomware process based on the feature information of the first file operation.

3. The method according to claim 2, characterized in that Identifying whether the process to be identified is a non-ransomware process according to the characteristic information of the first file operation includes: determining the number of files processed by the first file operation, and determining that the process to be identified is a non-ransomware process when the number of files is less than a second preset value; or determining the number of file modifications of the first file operation, and determining that the process to be identified is a non-ransomware process when the number of file modifications is less than a third preset value; or In a case where the target file to which the copy file processed by the first file operation belongs is located in a specified file path of the target terminal, determining that the process to be identified is a non-ransomware process; or When the first file operation is a deletion operation or a rename operation within a preset time period, it is determined that the process to be identified is a non-ransomware process.

4. The method according to claim 1, characterized in that: The method further comprises: For each terminal in the at least one terminal, receiving the trusted process set sent by the target device through the terminal, wherein the target device is used to receive the first process set sent by each terminal, summarize to obtain the trusted process set, and send the trusted process set to each terminal in the at least one terminal; or, For each terminal in the at least one terminal, the first process set of the terminal is broadcasted to other terminals in the at least one terminal through the terminal, and the first process set of the terminal is updated according to the first process set received by the terminal to obtain the trusted process set.

5. The method according to claim 1, characterized in that: Before identifying whether the process to be identified belongs to a trusted process according to the trusted process set, the method further includes: For each terminal of the at least one terminal, perform the following operations: Acquire event information of at least one first process of the terminal, wherein the at least one first process is a process that performs a second file operation on a first file that needs to be protected in the terminal, and the event information includes at least one of the following: a file name, a file path, and a process path of the first file; In the case that no ransomware event occurs for the first file, a trusted process is determined based on the event information of the at least one first process to obtain a first process set for each terminal, wherein the first process sets of different terminals are used to aggregate to obtain the trusted process set.

6. The method according to claim 1, characterized in that The method further comprises: For each terminal among the at least one terminal, when at least one third process of the terminal includes any trusted process in the trusted process set, the second file processed by the trusted process in the virtual mirror space of the terminal is synchronized to the disk of the terminal, and the second file in the virtual mirror space is deleted.

7. The method according to claim 1, characterized in that After detecting whether the process to be identified is a non-ransomware process, the method further includes: In the case that the process to be identified is a blackmail process, the copy file is deleted, and the target file is used as the latest version of the file.

8. The method according to claim 1, characterized in that Before creating a copy file of the target file in the virtual mirror space of the target terminal, the method includes: For each terminal of the at least one terminal, determining a storage space and a storage type of the terminal; A first structure is defined, wherein the first structure is used to implement an operation of a preset operating system on a file in a mirror file system; A second structure is defined, wherein the second structure is used to implement an operation of a file system of a preset type on a file in a mirror file system; The virtual mirror space of each terminal is constructed according to the storage space, the storage type, the first structure and the second structure, wherein the virtual mirror space communicates with the protection system through a preset interface.

9. A process detection device, characterized in that: The device is communicatively connected to at least one terminal, and the device includes: an identification unit, configured to identify whether the process to be identified belongs to a trusted process according to a set of trusted processes when a file operation request of the process to be identified to a target file in a disk of a target terminal is detected, wherein the target terminal is any terminal of the at least one terminal; a detection unit, configured to, if the process to be identified is not a trusted process, create a copy file of the target file in the virtual mirror space of the target terminal, and detect whether the process to be identified is a non-ransomware process according to a file operation performed by the process to be identified on the copy file; The first processing unit is used to add the process to be identified as a trusted process to the trusted process set when the process to be identified is a non-ransomware process.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, the process detection method described in any one of claims 1 to 8 is implemented.

Images