Virus defense method and device, terminal equipment and storage medium

Abstract

The invention provides a virus defense method and device, terminal equipment and a storage medium, the method is applied to the technical field of computers, and the method comprises the following steps: when a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is a first request for the folder by the unknown process, determining that the folder traversal request is a first request for the folder; if yes, generating a virtual bait file traversal result according to the folder traversal request, and returning the virtual bait file traversal result to the unknown process; when a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, acquiring a predefined virus behavior rule; and if the file operation request is matched with the virus behavior rule, executing a preset virus defense strategy. According to the method, when various types of unknown processes try to access or operate the file, all constructed virtual bait files are traversed preferentially, and the virus detection and defense efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a virus defense method, apparatus, terminal device and storage medium in the field of computer technology. Background Art

[0002] In today's digital society, ransomware has become one of the most serious cybersecurity threats. These ransomware encrypts the victim's files and demands a ransom before decrypting the files, which seriously affects the data security of individuals and enterprises. There are some anti-virus software and security tools on the market that can be used to detect and block ransomware, but these solutions are often easily bypassed by new ransomware, resulting in the inability to detect and block virus attacks in a timely manner. Summary of the invention

[0003] The present application provides a virus defense method, apparatus, terminal device and storage medium, which can effectively defend against attacks by new ransomware viruses.

[0004] In a first aspect, a virus defense method is provided, the method comprising: when a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request; the virtual bait file traversal result is returned to the unknown process; when a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained; if the file operation request matches the virus behavior rule, a preset virus defense strategy is executed.

[0005] In combination with the first aspect, in some possible implementations, before generating the virtual bait file traversal result according to the folder traversal request, it also includes: obtaining file information of one or more predefined virtual bait files; loading the file information into the kernel space to create a data structure for the virtual bait file, the kernel space is a memory area used to support the operation of the operating system kernel, and the data structure is used to create a file control block representing the virtual bait file, and the file control block is used to process file operation requests for the virtual bait file.

[0006] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the virtual bait file traversal result is generated according to the folder traversal request, including: obtaining folder attribute information of the folder according to the folder traversal request; matching one or more virtual bait files from the data structure of the virtual bait file according to the folder attribute information; and generating a virtual bait file traversal result corresponding to the folder traversal request according to the one or more virtual bait files.

[0007] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, after obtaining the predefined virus behavior rules, it also includes: if the file operation request does not match the virus behavior rules, creating a file operation result corresponding to the file operation request according to the file control block of the virtual bait file, and returning the file operation result to the unknown process.

[0008] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, before creating the file operation result corresponding to the file operation request based on the file control block of the virtual bait file, it also includes: if the file control block of the virtual bait file does not exist, then creating the file control block of the virtual bait file according to the data structure of the virtual bait file.

[0009] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the determination of the folder traversal request as the first request of the unknown process for the folder includes: when a folder traversal request for a folder sent by an unknown process is detected, determining whether the file object of the folder is associated with an operation recording program for the unknown process; if not, determining the folder traversal request as the first request of the unknown process for the folder, creating an operation recording program for the unknown process, and associating the operation recording program with the file object of the folder.

[0010] In combination with the first aspect and the above implementations, in some possible implementations, the virus behavior rules include one or more of file writing, file modification, file deletion, file movement, and file encryption.

[0011] The above technical solution is adopted. When a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request, and the virtual bait file traversal result is returned to the unknown process; when a file operation request for a virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained; if the file operation request matches the virus behavior rule, the preset virus defense strategy is executed. Based on this solution, by generating and returning the traversal result of a virtual bait file when an unknown process traverses any folder for the first time, it is ensured that various types of unknown processes will give priority to traversing the constructed virtual bait files when trying to access or operate files, so that virtual bait files can be seen everywhere for unknown processes, and the probability of malicious behavior being detected is increased; by detecting the file operation request for the virtual bait file based on the virus behavior rules when the unknown process sends a file operation request for the virtual bait file, it can cope with attacks from known ransomware viruses, new variants and unknown ransomware viruses, and has a broad-spectrum defense capability and is more applicable; and, by executing the virus defense strategy only when the unknown process initiates a file operation request for the virtual bait file that matches the virus behavior rules, it can effectively reduce false alarms caused by compliant processes accessing files and reduce interference with normal user operations.

[0012] In a second aspect, a virus protection device is provided, the device comprising:

[0013] A result generating unit, configured to, when detecting a folder traversal request for a folder sent for the first time by an unknown process, generate a virtual bait file traversal result according to the folder traversal request if it is determined that the folder traversal request is the first request for the folder by the unknown process;

[0014] A result returning unit, used for returning the virtual bait file traversal result to the unknown process;

[0015] A rule acquisition unit, configured to acquire a predefined virus behavior rule when detecting a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result;

[0016] The virus defense unit is used to execute a preset virus defense strategy if the file operation request matches the virus behavior rule.

[0017] In a third aspect, a terminal device is provided, comprising: a memory for storing executable program code; and a processor for calling and running the executable program code from the memory, so that the terminal device executes the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0018] In a fourth aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0019] In a fifth aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a system architecture diagram of a virus defense method provided in an embodiment of the present application;

[0021] Figure 2 It is a flowchart of a virus defense method provided in an embodiment of the present application;

[0022] Figure 3 It is a flowchart of a virus defense method provided in an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of the structure of a virus protection device provided in an embodiment of the present application;

[0024] Figure 5 It is a structural diagram of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0026] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0027] In the face of the detection and defense issues of ransomware, the relevant technologies include virus signature detection methods and behavioral detection methods based on the deployment of bait files. Among them, the virus signature detection method mainly uses the key signatures or family genes extracted from known ransomware as virus detection standards. This method has the advantages of high detection efficiency, high detection accuracy and low false alarm rate for known ransomware, but its main disadvantages are: when the ransomware is confused or new variants appear, it is difficult to detect and defend in time, and there is a serious lag problem; and it is necessary to extract virus signatures for a large number of ransomware, which has a high maintenance cost.

[0028] The behavioral detection method based on the deployment of bait files mainly places a specifically named bait file at a specific location on the disk, so that the ransomware can preferentially traverse the specifically named bait file during the file traversal period, and issue an early warning when the ransomware modifies, deletes, moves, encrypts, and other operations on the bait file. This method has the advantage of being able to detect some specific types of ransomware with a broad spectrum, but its main disadvantages are:

[0029] (1) The real decoy files will occupy a certain amount of file system space;

[0030] (2) When a user manually operates a decoy file, or when compliance software performs related operations on the decoy file, it will cause certain false alarm interference.

[0031] (3) Bait files placed within the user's visible range can easily cause certain annoyance to the user, and the random placement of files may even cause user disgust.

[0032] (4) When the ransomware only encrypts files in a specific keyword directory, or directly traverses folders in a specific directory (such as the desktop directory, documents, data, etc.), if the bait file placed does not meet the specific keyword or specific directory requirements set by the ransomware, the detection method will fail. In other words, the behavioral detection method based on the deployment of bait files is only effective for full-disk encryption type ransomware.

[0033] In order to completely or partially solve the problems faced by the above-mentioned related technologies, the present application embodiment proposes a virus defense system. Figure 1 , Figure 1 : is a system architecture diagram of a virus defense method provided in an embodiment of the present application. Figure 1As shown, the embodiment of the present application proposes a virus defense system, which can be a terminal device such as a personal computer, a tablet computer, a server, a mobile phone, a handheld device, a vehicle-mounted device, a wearable device, a computing device, or other processing devices connected to a wireless modem; it can also be a module on the terminal device for implementing a virus defense method. In the embodiment of the present application, when the system detects a folder traversal request for a folder sent by an unknown process, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request, and the virtual bait file traversal result is returned to the unknown process; when the file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained, and when the file operation request matches the virus behavior rule, a preset virus defense strategy is executed.

[0034] Furthermore, before generating a virtual bait file traversal result according to a folder traversal request, the system can also obtain file information of one or more predefined virtual bait files; load the file information into the kernel space to create a data structure for the virtual bait file; wherein the kernel space is a memory area used to support the operation of the operating system kernel; the data structure is used to create a file control block representing the virtual bait file, and the file control block is used to process file operation requests for the virtual bait file.

[0035] Furthermore, when the system generates a virtual bait file traversal result based on a folder traversal request, it can also obtain folder attribute information of the folder based on the folder traversal request; match one or more virtual bait files from the data structure of the virtual bait file based on the folder attribute information; and generate a virtual bait file traversal result corresponding to the folder traversal request based on the one or more virtual bait files.

[0036] Furthermore, after obtaining the predefined virus behavior rules, the system can also determine whether there is a file control block for the virtual bait file when the file operation request does not match the virus behavior rules; when the virtual bait file has a file control block, create a file operation result corresponding to the file operation request based on the file control block; when the virtual bait file does not have a file control block, create a file control block for the virtual bait file based on the data structure of the virtual bait file, and create a file operation result corresponding to the file operation request based on the file control block; and return the file operation result to the unknown process.

[0037] Furthermore, when the system determines that a folder traversal request is the first request for a folder by an unknown process, the system can also determine whether the file object of the folder is associated with an operation recording program for the unknown process when a folder traversal request for a folder sent by an unknown process is detected; if not, the system determines that the folder traversal request is the first request for the folder by the unknown process, creates an operation recording program for the unknown process, and associates the operation recording program with the file object of the folder.

[0038] The virus defense system in the embodiment of the present application generates and returns a virtual bait file traversal result when an unknown process traverses any folder for the first time, thereby ensuring that various types of unknown processes will preferentially traverse the constructed virtual bait files when trying to access or operate files, thereby making the virtual bait files visible everywhere for unknown processes and increasing the probability of malicious behavior being detected; by detecting the file operation request for the virtual bait file based on the virus behavior rules when the unknown process sends a file operation request for the virtual bait file, the system can cope with attacks by known ransomware viruses, new variants, and unknown ransomware viruses, has a broad-spectrum defense capability, and is more applicable; and by executing the virus defense strategy only when the unknown process initiates a file operation request for the virtual bait file that matches the virus behavior rules, the system can effectively reduce false alarms caused by compliant processes accessing files and reduce interference with normal user operations.

[0039] based on Figure 1 The system architecture shown below will be combined with Figure 2-Figure 3 , the virus defense method provided in the embodiments of the present application is introduced in detail.

[0040] See also Figure 2 , which is a flowchart of a virus defense method provided in the present application embodiment. Figure 2 As shown, the method of the embodiment of the present application may include the following steps S101-S104.

[0041] S101, when a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request;

[0042] S102, returning the virtual bait file traversal result to the unknown process;

[0043] The method provided in the embodiment of the present application can be implemented by a computer program, which can be integrated into an application or run as an independent tool application. The method can be applied to terminal devices such as personal computers, mobile phones, and servers. The embodiment of the present application takes the method applied to a terminal device as an example.

[0044] In some embodiments, before an unknown process initiates a file operation request to a terminal device for the first time, especially before an unknown ransomware virus initiates a file operation request to a terminal device for the first time, the unknown process does not know the file information in each folder of the terminal device in advance. Therefore, an unknown process, such as a ransomware virus, usually sends a folder traversal request for the folders contained in the terminal device to the terminal device before initiating a related operation request for a specific folder or a specific file of the terminal device, so as to obtain the related file traversal results returned by the terminal device.

[0045] According to some embodiments, all file access requests are filtered based on the file filtering driver of the terminal device. When a folder traversal request for a folder sent by an unknown process is detected, it is determined whether the folder traversal request is the first request for the folder by the unknown process. Among them, the unknown process refers to a process with an unknown source, function or software, which may include but is not limited to an unknown virus process, a third-party software process, a new process after the system update, and a system abnormal process. The folder can be any folder in the terminal device.

[0046] In some embodiments, it is determined that the detected folder traversal request is the first folder traversal request sent by an unknown process. For example, when a folder traversal request for a folder sent by an unknown process is detected, it is determined whether the file object of the folder is associated with an operation recorder of the unknown process. Among them, the file object refers to the representation in memory of a file opened or created by a program. The operation recorder refers to a program used to record the file operation information of the process for the folder and the files contained therein. For example, when the terminal device uses a mainstream operating system such as Windows, Linux, macOS, etc., when a folder traversal request for a folder sent by an unknown process for the first time is detected, a context object for the folder can be created as an operation recorder for the folder. Afterwards, if the file object of the folder is not associated with an operation recorder for an unknown process, indicating that the unknown process has not previously made a file access request for the folder and the files contained therein, then the folder traversal request is determined to be the first request for the folder by the unknown process. At this time, an operation recorder for the unknown process is created, and the operation recorder is associated with the file object of the folder.

[0047] In some embodiments, determining whether a detected folder traversal request is the first folder traversal request sent by an unknown process may be, for example, by obtaining process identification information of the unknown process, matching the process identification information with system log records, and when no corresponding process identification information is matched, determining the folder traversal request sent by the unknown process as the first request for a folder by the unknown process.

[0048] In some embodiments, if it is determined that the folder traversal request is the first request of the unknown process for the folder, a virtual bait file traversal result is generated according to the folder traversal request, and the virtual bait file refers to a virtual file that is deliberately set in the system to deceive or lure potential attackers to interact. The virtual bait file traversal result may include but is not limited to the file name, file type, file size, modification date and file path of the virtual bait file. The generated virtual bait file traversal result is returned to the unknown process to induce the unknown process to believe that normal file information in the folder has been successfully obtained.

[0049] In some embodiments, a virtual bait file traversal result is generated according to a folder traversal request, for example, folder attribute information of the folder is obtained according to the folder traversal request, and the folder attribute information may include but is not limited to information such as folder name, folder path, folder size, number of files contained in the folder, number of subfolders contained in the folder, folder creation time, and folder type. One or more virtual bait files are matched from a pre-built virtual bait file set according to the obtained folder attribute information. A virtual bait file traversal result corresponding to the folder traversal request is generated according to the one or more virtual bait files.

[0050] In some embodiments, in order to prevent the virtual bait file from occupying the file system space and avoid the virtual bait file from being visible to the user and the normal process, the virtual bait file is loaded into the kernel space of the system in the form of a data structure, rather than being stored in the file system space in the form of a file. Specifically, before generating the virtual bait file traversal result according to the folder traversal request, the file information of one or more predefined virtual bait files can also be obtained, and the file information can include the file content and file attribute information of the virtual bait file. The file information is loaded into the kernel space to create a data structure of the virtual bait file. Among them, the kernel space is a memory area used to support the operation of the operating system kernel. The kernel space is a protected memory space that contains the core functions and services of the operating system. The kernel space is independent of the user space, has higher permissions and stricter protection mechanisms, and can prevent user programs from illegally accessing and destroying the core resources of the system. The kernel space has the authority to directly access and control hardware resources, including core processors, memory, disks, etc. The data structure of the virtual bait file is composed of file information such as the file content and file attribute information of one or more virtual bait files, and is used to create one or more file control blocks representing virtual bait files. The file control block is a set of data structures with a fixed format that represent and manage virtual bait files in the operating system and is used to process file operation requests for virtual bait files.

[0051] In some embodiments, a virtual bait file traversal result is generated according to a folder traversal request. For example, folder attribute information of the folder is obtained according to the folder traversal request, one or more virtual bait files are matched from a data structure of a pre-created virtual bait file according to the folder attribute information, and a virtual bait file traversal result corresponding to the folder traversal request is generated according to the one or more virtual bait files.

[0052] Afterwards, the generated virtual bait file traversal result is returned to the unknown process to induce the unknown process to believe that the normal file information in the folder has been successfully obtained.

[0053] S103, when detecting a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result, obtaining a predefined virus behavior rule;

[0054] In some embodiments, after receiving the returned virtual bait file traversal result, the unknown process generates a file operation request for the virtual bait file according to the virtual bait file traversal result, and sends the file operation request to the terminal device. The types of the file operation request may include but are not limited to file open operation, file read operation, file query operation, file opportunity lock (OpLock) operation, file write operation, file modification operation, file deletion operation, file move operation and file encryption operation.

[0055] According to some embodiments, when the terminal device detects a file operation request for a virtual bait file sent by the unknown process based on the result of the virtual bait file traversal, it obtains a predefined virus behavior rule. The virus behavior rule refers to a criterion for identifying the behavioral characteristics of potential viruses and malware based on the common behavioral characteristics of known viruses and malware. Virus behavior rules may include one or more of file writing, file modification, file deletion, file moving, and file encryption. For example, the virus behavior rules for identifying ransomware viruses can be defined as: folder traversal-file opening-file encryption, file reading-file modification-file encryption, file moving out-file encryption-file moving in and other behavioral characteristics.

[0056] S104: If the file operation request matches the virus behavior rule, a preset virus defense strategy is executed.

[0057] In some embodiments, if the file operation request for the virtual bait file sent by the unknown process matches the virus behavior rule, the unknown process is identified as a process with potential threats, and at this time, a preset virus defense strategy is executed. The virus defense strategy may include blocking the unknown process, generating corresponding warning information, etc.

[0058] In some embodiments, after obtaining the predefined virus behavior rules, it may also include: if the file operation request for the virtual bait file sent by the unknown process does not match the virus behavior rules, then creating a file operation result corresponding to the file operation request based on the file control block of the virtual bait file, and returning the file operation result to the unknown process to induce the unknown process to believe that the file operation result of the normal file (i.e., the virtual bait file) has been successfully obtained.

[0059] Optionally, if a file control block exists for the virtual bait file, it indicates that a corresponding file control block has been created for the virtual bait file. At this time, the file control block is directly referenced to create a file operation result corresponding to the file operation request, and the file operation result is returned to the unknown process.

[0060] Optionally, if the virtual bait file does not have a file control block, the data structure of the virtual bait file is obtained, and a file control block of the virtual bait file is created based on the data structure of the virtual bait file. A file operation result corresponding to the file operation request is created based on the file control block, and the file operation result is returned to the unknown process.

[0061] In some embodiments, the file operation request for the virtual bait file sent by the unknown process continues to be detected, and when the file operation request matches the predefined virus behavior rule, the preset virus defense strategy is executed. When all the file operation requests for the virtual bait file sent by the unknown process do not match the virus behavior rule, it indicates that all the file operations performed by the unknown process on the virtual bait file do not pose a threat; when the unknown process sends a folder traversal request for the folder again, the unknown process is identified as a normal process, and at this time, the normal file traversal result existing in the folder is returned to the unknown process according to the folder traversal request.

[0062] The embodiment of the present application, when a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request, and the virtual bait file traversal result is returned to the unknown process; when a file operation request for a virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained; if the file operation request matches the virus behavior rule, a preset virus defense strategy is executed. Based on the embodiment scheme of the present application, by generating and returning the traversal result of a virtual bait file when an unknown process traverses any folder for the first time, it is ensured that various types of unknown processes will give priority to traversing the constructed virtual bait files when trying to access or operate files, so that the virtual bait files can be seen everywhere for unknown processes, and the probability of malicious behavior being detected is increased; by detecting the file operation request for the virtual bait file based on the virus behavior rules when the unknown process sends the file operation request, it is possible to cope with attacks by known ransomware viruses, new variants and unknown ransomware viruses, etc., and has a broad-spectrum defense capability and is more applicable; and, by executing the virus defense strategy only when the unknown process initiates a file operation request for the virtual bait file that matches the virus behavior rules, it is possible to effectively reduce false alarms caused by compliant processes accessing files and reduce interference with normal user operations.

[0063] See also Figure 3 , which is a flowchart of a virus defense method provided in the present application embodiment. Figure 3 As shown, the method of the embodiment of the present application may include the following steps S201-S210.

[0064] S201, obtaining file information of one or more predefined virtual bait files;

[0065] In some embodiments, file information of one or more predefined virtual bait files is obtained, and the file information may include file content and file attribute information of the virtual bait file. The file attribute information may include, but is not limited to, information such as the folder to which the file belongs, the file type, the file size, the file creation time, the file last access time, the file modification time, and the file name list.

[0066] S202, loading the file information into the kernel space to create a data structure of a virtual bait file;

[0067] In some embodiments, the file information of the acquired virtual bait file is loaded into the kernel space to create a data structure of the virtual bait file. The kernel space is a memory area used to support the operation of the operating system kernel; the data structure is used to create a file control block representing the virtual bait file; the file control block is used to process file operation requests for the virtual bait file. Among them, the kernel space is a protected memory space that contains the core functions and services of the operating system. The kernel space is independent of the user space and has higher permissions and stricter protection mechanisms, which can prevent user programs from illegally accessing and destroying the core resources of the system. The kernel space has the authority to directly access and control hardware resources, including core processors, memory, disks, etc. The data structure of the virtual bait file consists of file information such as file content and file attribute information of one or more virtual bait files, and can be used to create one or more file control blocks representing virtual bait files. The file control block is a set of data structures with a fixed format in the operating system that represents and manages virtual bait files, and can be used to process file operation requests for virtual bait files.

[0068] The embodiment of the present application loads the virtual bait file into the kernel space of the system in the form of a data structure instead of storing it in the file system space in the form of a file, so that the virtual bait file does not occupy the file system space, avoids the virtual bait file being visible to users and normal processes, effectively reduces the troubles caused to users by a large number of bait files occupying file system space everywhere, and at the same time reduces the false alarm interference caused by user misoperation or other software accessing the bait file.

[0069] S203, when a folder traversal request for a folder sent by an unknown process is detected, determining whether a file object of the folder is associated with an operation recording program for the unknown process;

[0070] In some embodiments, when a folder traversal request for a folder sent by an unknown process is detected, it is determined whether the file object of the folder is associated with an operation recorder of the unknown process. Herein, a file object refers to a representation in memory of a file opened or created by a program. An operation recorder refers to a program used to record file operation information of a process for a folder and the files contained therein. For example, when a terminal device uses a mainstream operating system such as Windows, Linux, or macOS, a context object for the folder can be created as an operation recorder for the folder when a folder traversal request for a folder sent by an unknown process for the first time is detected.

[0071] S204: if not, determining the folder traversal request as the first request of the unknown process for the folder, creating an operation recording program for the unknown process, and associating the operation recording program with the file object of the folder;

[0072] In some embodiments, if the file object of the folder is not associated with an operation recording program for an unknown process, indicating that the unknown process has not previously made a file access request for the folder and the files contained therein, the folder traversal request is determined to be the first request for the folder by the unknown process. At this time, an operation recording program for the unknown process is created to record the file operation information of the unknown process on the folder and the files contained therein, and the operation recording program is associated with the file object of the folder.

[0073] S205, acquiring folder attribute information of the folder according to the folder traversal request;

[0074] In some embodiments, folder attribute information of the folder is obtained based on a folder traversal request. The folder attribute information may include one or more of the folder name, folder path, folder size, the number of files contained in the folder, the number of subfolders contained in the folder, folder creation time, and folder type.

[0075] S206, obtaining one or more virtual bait files by matching from the data structure of the virtual bait file according to the folder attribute information;

[0076] S207, generating a virtual bait file traversal result corresponding to the folder traversal request according to the one or more virtual bait files, and returning the virtual bait file traversal result to the unknown process;

[0077] In some embodiments, one or more virtual bait files are matched from a data structure of a pre-created virtual bait file according to the folder attribute information. For example, the data structure of the pre-created virtual bait file can be traversed according to the folder attribute information to obtain file attribute information in the data structure that matches the folder attribute information, and one or more virtual bait files are constructed according to the file attribute information. Afterwards, a virtual bait file traversal result corresponding to the folder traversal request is generated according to the one or more virtual bait files, and the virtual bait file traversal result is returned to the unknown process to induce the unknown process to believe that normal file information in the folder has been successfully obtained.

[0078] The embodiment scheme of the present application can quickly adjust the content and quantity of virtual bait files according to different needs and scenarios by dynamically constructing virtual bait files according to folder attribute information. In addition, virtual bait files are easy to make, and the operation of adding new virtual bait files is simple. By obtaining folder attribute information according to a folder traversal request, matching a virtual bait file from the data structure of the virtual bait file according to the folder attribute information, and generating and returning a virtual bait file traversal result corresponding to the folder traversal request according to the virtual bait file, the expected traversal result of the folder traversal request can be accurately simulated, and unknown processes can be deceived with high fidelity, making it difficult to distinguish between virtual bait files and real files. This high degree of deceptiveness effectively increases the difficulty of malicious viruses identifying and bypassing bait files.

[0079] S208, when detecting a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result, obtaining a predefined virus behavior rule;

[0080] For details, please refer to the description of step S103 in the above-mentioned embodiment of the specification, which will not be elaborated here.

[0081] The embodiment of the present application can perform refined behavior analysis on file operation requests of unknown processes through predefined virus behavior rules. The virus behavior rules not only take into account basic file operation types, such as reading, writing, moving, etc., but also include more complex behavior patterns, such as specific types of file encryption, batch renaming or deletion, etc. Through refined virus behavior analysis, potential malicious processes can be identified more accurately.

[0082] S209, if the file operation request does not match the virus behavior rule, creating a file operation result corresponding to the file operation request according to the file control block of the virtual bait file, and returning the file operation result to the unknown process;

[0083] In some embodiments, if the file operation request for the virtual bait file sent by the unknown process does not match the virus behavior rules, a file operation result corresponding to the file operation request is created based on the file control block of the virtual bait file, and the file operation result is returned to the unknown process to induce the unknown process to believe that the file operation result of the normal file (i.e., the virtual bait file) has been successfully obtained.

[0084] Optionally, if a file control block exists for the virtual bait file, it indicates that a corresponding file control block has been created for the virtual bait file. At this time, the file control block is directly referenced to create a file operation result corresponding to the file operation request, and the file operation result is returned to the unknown process.

[0085] Optionally, if the virtual bait file does not have a file control block, a file control block of the virtual bait file is created based on the data structure of the virtual bait file; a file operation result corresponding to the file operation request is created based on the file control block of the virtual bait file, and the file operation result is returned to the unknown process.

[0086] In some embodiments, the file operation requests for the virtual bait file sent by the unknown process continue to be detected. If all file operation requests for the virtual bait file sent by the unknown process do not match the virus behavior rules, it indicates that there is no threat to all file operations performed by the unknown process on the virtual bait file; when the unknown process sends a folder traversal request for the folder again, the unknown process is identified as a normal process. At this time, the normal file traversal results existing in the folder are returned to the unknown process according to the folder traversal request.

[0087] S210: If the file operation request matches the virus behavior rule, a preset virus defense strategy is executed.

[0088] In some embodiments, if the file operation request for the virtual bait file sent by the unknown process matches the virus behavior rule, the unknown process is identified as a process with potential threats, and at this time, a preset virus defense strategy is executed. The virus defense strategy may include blocking the unknown process, generating corresponding warning information, etc.

[0089] The embodiment of the present application can further confuse the unknown process by creating a file operation result corresponding to the file operation request and returning it to the unknown process when the file operation request of the unknown process does not match the virus behavior rule, so that the file operation result appears to be the result of a normal file operation to the unknown process; by executing a preset virus defense strategy when the file operation request of the unknown process matches the virus behavior rule, it is ensured that a quick response can be made when malicious behavior occurs, effectively preventing further damage by malicious processes such as ransomware viruses. By setting up the induced confusion mechanism and defense trigger mechanism, malicious processes can be effectively detected and defended without interfering with the normal process operation.

[0090] based on Figure 1 The system architecture will be combined with the attached Figure 4 , the virus protection device provided in the embodiment of the present application is introduced in detail. Figure 4 The virus protection device in the present application is used to execute Figure 2-Figure 3 For the convenience of explanation, only the part related to the embodiment of the present application is shown. For the specific technical details not disclosed, please refer to the present application. Figure 2-Figure 3 The embodiment shown.

[0091] See also Figure 4 , which shows a schematic diagram of the structure of a virus protection device provided by an exemplary embodiment of this specification. The virus protection device can be implemented as all or part of a device through software, hardware, or a combination of both. The device 1 at least includes a result generation unit 10, a result return unit 20, a rule acquisition unit 30, and an operation recording unit 40.

[0092] A result generating unit 10 is used for, when detecting a folder traversal request for a folder sent for the first time by an unknown process, generating a virtual bait file traversal result according to the folder traversal request if it is determined that the folder traversal request is the first request for the folder by the unknown process;

[0093] A result returning unit 20, used for returning the virtual bait file traversal result to the unknown process;

[0094] A rule acquisition unit 30, configured to acquire a predefined virus behavior rule when detecting a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result;

[0095] The virus defense unit 40 is configured to execute a preset virus defense strategy if the file operation request matches the virus behavior rule.

[0096] According to some embodiments, the virus behavior rules include one or more of file writing, file modification, file deletion, file movement, and file encryption.

[0097] According to some embodiments, the apparatus 1 may further include: a file definition unit 50 and a data loading unit 60, wherein before the result returning unit 20 is used to generate a virtual bait file traversal result according to the folder traversal request:

[0098] A file definition unit 50, used to obtain file information of one or more predefined virtual bait files;

[0099] The data loading unit 60 is used to load the file information into the kernel space to create a data structure for a virtual bait file. The kernel space is a memory area used to support the operation of the operating system kernel. The data structure is used to create a file control block representing the virtual bait file. The file control block is used to process file operation requests for the virtual bait file.

[0100] According to some embodiments, the result returning unit 20 may further include: an information obtaining subunit 201, a file matching subunit 202 and a result generating subunit 203, wherein the result returning unit 20 is used to generate a virtual bait file traversal result according to the folder traversal request:

[0101] The information acquisition subunit 201 is used to acquire the folder attribute information of the folder according to the folder traversal request;

[0102] The file matching subunit 202 is used to match and obtain one or more virtual bait files from the data structure of the virtual bait file according to the folder attribute information;

[0103] The result generating subunit 203 is used to generate a virtual bait file traversal result corresponding to the folder traversal request according to the one or more virtual bait files.

[0104] According to some embodiments, the apparatus 1 may further include: a result creation unit 70, wherein after the rule acquisition unit 30 is used to acquire the predefined virus behavior rule:

[0105] The result creation unit 70 is used to create a file operation result corresponding to the file operation request according to the file control block of the virtual bait file if the file operation request does not match the virus behavior rule, and return the file operation result to the unknown process.

[0106] According to some embodiments, the result creation unit 70 may further include: a control block creation subunit 701, wherein before the result creation unit 70 is used to create a file operation result corresponding to the file operation request according to the file control block of the virtual bait file:

[0107] The control block creation subunit 701 is used to create a file control block for the virtual bait file according to the data structure of the virtual bait file if the file control block does not exist for the virtual bait file.

[0108] According to some embodiments, the result generating unit 10 may further include: a program determining subunit 101 and a program creating subunit 102, wherein, in the result generating unit 10, when determining that the folder traversal request is the first request of the unknown process for the folder:

[0109] The program determination subunit 101 is used to determine whether a file object of the folder is associated with an operation recording program for the unknown process when a folder traversal request for the folder sent by the unknown process is detected;

[0110] The program creation subunit 102 is used to, if not, determine the folder traversal request as the first request of the unknown process for the folder, create an operation recording program for the unknown process, and associate the operation recording program with the file object of the folder.

[0111] The embodiment of the present application, when a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, generates a virtual bait file traversal result according to the folder traversal request, and returns the virtual bait file traversal result to the unknown process; when a file operation request for a virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained; if the file operation request matches the virus behavior rule, a preset virus defense strategy is executed. Based on this solution, by generating and returning the traversal result of a virtual bait file when an unknown process traverses any folder for the first time, it is ensured that various types of unknown processes will give priority to traversing the constructed virtual bait files when trying to access or operate files, so that virtual bait files can be seen everywhere for unknown processes, and the probability of malicious behavior being detected is increased; by detecting the file operation request for the virtual bait file based on the virus behavior rules when the unknown process sends a file operation request for the virtual bait file, it can cope with attacks from known ransomware viruses, new variants and unknown ransomware viruses, and has a broad-spectrum defense capability and is more applicable; and, by executing the virus defense strategy only when the unknown process initiates a file operation request for the virtual bait file that matches the virus behavior rules, it can effectively reduce false alarms caused by compliant processes accessing files and reduce interference with normal user operations.

[0112] See also Figure 5 , which is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application. Figure 5 As shown, the terminal device 500 includes a processor 501 and a memory 502. The processor 501 is electrically connected to the memory 502.

[0113] The processor 501 is the control center of the terminal device 500 and may include one or more processing cores. The processor 501 uses various interfaces and lines to connect the various parts of the entire terminal device, and executes various functions of the terminal device and processes data by running or calling the computer program stored in the memory 502, and calling the data stored in the memory 502, so as to control the terminal device as a whole. Optionally, the processor 501 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 501 can integrate one or a combination of CPU, graphics processing unit (GPU), modem, etc. Among them, the CPU mainly processes the operating system, user pages and applications, etc.; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 501, but may be implemented separately through a communication chip.

[0114] The memory 502 can be used to store software programs and modules, and the processor 501 executes various functional applications and virus defense by running the computer programs and modules stored in the memory 502. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, a computer program required for at least one function, etc.; the data storage area can store data created according to the use of the terminal device, etc.

[0115] In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory 502 may also include a memory controller to provide the processor 501 with access to the memory 502.

[0116] In this embodiment, the processor 501 in the terminal device 500 loads instructions corresponding to the processes of one or more computer programs into the memory 502 according to the following steps, and the processor 501 runs the computer program stored in the memory 502 to implement various functions, as follows:

[0117] When a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request;

[0118] Returning the virtual bait file traversal result to the unknown process;

[0119] When a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained;

[0120] If the file operation request matches the virus behavior rule, a preset virus defense strategy is executed.

[0121] Optionally, before executing the step of generating a virtual bait file traversal result according to the folder traversal request, the processor 501 may further execute:

[0122] Obtaining file information of one or more predefined virtual bait files;

[0123] The file information is loaded into the kernel space to create a data structure of a virtual bait file. The kernel space is a memory area used to support the operation of the operating system kernel. The data structure is used to create a file control block representing the virtual bait file. The file control block is used to process file operation requests for the virtual bait file.

[0124] Optionally, when the processor 501 generates a virtual bait file traversal result according to the folder traversal request, the processor 501 specifically performs:

[0125] Acquire folder attribute information of the folder according to the folder traversal request;

[0126] Matching and obtaining one or more virtual bait files from the data structure of the virtual bait file according to the folder attribute information;

[0127] A virtual bait file traversal result corresponding to the folder traversal request is generated according to the one or more virtual bait files.

[0128] Optionally, after obtaining the predefined virus behavior rules, the processor 501 may further execute:

[0129] If the file operation request does not match the virus behavior rule, a file operation result corresponding to the file operation request is created according to the file control block of the virtual bait file, and the file operation result is returned to the unknown process.

[0130] Optionally, before executing the process of creating a file operation result corresponding to the file operation request according to the file control block of the virtual bait file, the processor 501 may further execute:

[0131] If the virtual bait file does not have a file control block, a file control block of the virtual bait file is created according to the data structure of the virtual bait file.

[0132] Optionally, when determining that the folder traversal request is the first request of the unknown process for the folder, the processor 501 specifically performs:

[0133] When a folder traversal request for a folder sent by an unknown process is detected, determining whether a file object of the folder is associated with an operation recording program for the unknown process;

[0134] If not, the folder traversal request is determined to be the first request of the unknown process for the folder, an operation recording program for the unknown process is created, and the operation recording program is associated with the file object of the folder.

[0135] It should be understood that the device provided in the embodiment of the present application is used to execute the above-mentioned virus defense method, and thus can achieve the same effect as the above-mentioned implementation method.

[0136] In the case of an integrated unit, the device may include a processing module and a storage module. When the device is applied to a terminal device, the processing module may be used to control and manage the actions of the terminal device. The storage module may be used to support the terminal device in executing related program codes, etc.

[0137] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0138] In addition, the device provided in the embodiment of the present application can specifically be a chip, component or module, and the chip may include a connected processor and memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute a virus defense method provided in the above embodiment.

[0139] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program code is stored. When the computer program code is executed on a computer, the computer executes the above-mentioned related method steps to implement a virus defense method provided by the above-mentioned embodiment.

[0140] This embodiment also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement a virus defense method provided by the above embodiment.

[0141] Among them, the device, computer-readable storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0142] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0143] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0144] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A virus defense method, characterized in that: The method comprises: When a folder traversal request for a folder sent by an unknown process is detected, if it is determined that the folder traversal request is the first request for the folder by the unknown process, a virtual bait file traversal result is generated according to the folder traversal request; Returning the virtual bait file traversal result to the unknown process; When a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result is detected, a predefined virus behavior rule is obtained; If the file operation request matches the virus behavior rule, a preset virus defense strategy is executed.

2. The method according to claim 1, characterized in that Before generating the virtual bait file traversal result according to the folder traversal request, the method further includes: Obtaining file information of one or more predefined virtual bait files; The file information is loaded into the kernel space to create a data structure of a virtual bait file. The kernel space is a memory area used to support the operation of the operating system kernel. The data structure is used to create a file control block representing the virtual bait file. The file control block is used to process file operation requests for the virtual bait file.

3. The method according to claim 2, characterized in that The generating of the virtual bait file traversal result according to the folder traversal request includes: Acquire folder attribute information of the folder according to the folder traversal request; Matching and obtaining one or more virtual bait files from the data structure of the virtual bait file according to the folder attribute information; A virtual bait file traversal result corresponding to the folder traversal request is generated according to the one or more virtual bait files.

4. The method according to claim 1, characterized in that: After obtaining the predefined virus behavior rules, the method further includes: If the file operation request does not match the virus behavior rule, a file operation result corresponding to the file operation request is created according to the file control block of the virtual bait file, and the file operation result is returned to the unknown process.

5. The method according to claim 4, characterized in that Before creating a file operation result corresponding to the file operation request according to the file control block of the virtual bait file, the method further includes: If the virtual bait file does not have a file control block, a file control block of the virtual bait file is created according to the data structure of the virtual bait file.

6. The method according to claim 1, characterized in that Determining that the folder traversal request is the first request of the unknown process for the folder includes: When a folder traversal request for a folder sent by an unknown process is detected, determining whether a file object of the folder is associated with an operation recording program for the unknown process; If not, the folder traversal request is determined to be the first request of the unknown process for the folder, an operation recording program for the unknown process is created, and the operation recording program is associated with the file object of the folder.

7. The method according to claim 1, characterized in that The virus behavior rules include one or more of file writing, file modification, file deletion, file movement and file encryption.

8. A virus protection device, characterized in that: The device comprises: A result generating unit, configured to, when detecting a folder traversal request for a folder sent for the first time by an unknown process, generate a virtual bait file traversal result according to the folder traversal request if it is determined that the folder traversal request is the first request for the folder by the unknown process; A result returning unit, used for returning the virtual bait file traversal result to the unknown process; A rule acquisition unit, configured to acquire a predefined virus behavior rule when detecting a file operation request for the virtual bait file sent by the unknown process based on the virtual bait file traversal result; The virus defense unit is used to execute a preset virus defense strategy if the file operation request matches the virus behavior rule.

9. A terminal device, characterized in that: The terminal device comprises: at least one processor, and a memory connected to the at least one processor in communication; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the virus defense method according to any one of claims 1 to 7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the virus protection method according to any one of claims 1 to 7 are implemented.

Images