Ransomware recognition countering method and device, equipment and storage medium

Abstract

The invention provides a ransomware identification countering method and device, equipment and a storage medium. The method comprises the following steps: configuring a monitoring honeypot for inducing ransomware attack according to network infrastructure; detecting and analyzing the attack behavior of the blackmail virus captured by the monitoring honeypot, and intercepting threat behavior data of the blackmail virus; and triggering a reversion mechanism of the ransomware virus according to the threat behavior data of the ransomware virus. According to the method, the blackmail virus attack is actively attracted by monitoring the honeypot, so that the viruses are captured and analyzed, active defense is realized, and prevention of novel blackmail viruses is enhanced. By deeply monitoring attack behaviors, acquiring attack details and features and being capable of being linked with other security systems, the network security protection effect is improved, and meanwhile, the problem of limitation of a firewall when the firewall deals with internal network vulnerability attacks is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device and storage medium for identifying and countering ransomware. Background Art

[0002] With the rapid advancement of network technology, ransomware has become an extremely severe challenge facing the field of network security. According to the "Global Cybersecurity Outlook 2022" report released by the World Economic Forum, ransomware attacks top the list of network threat concerns and have become a network security issue of widespread concern worldwide. These viruses encrypt user files or systems and force users to pay high ransoms to restore data access rights, causing serious economic and operational losses to businesses and individuals. Traditional antivirus software can usually only remove viruses after they invade, but it is difficult to effectively prevent ransomware attacks.

[0003] In order to cope with this growing security threat, current network security technology solutions include traditional antivirus software, firewalls and other passive defense systems. These systems are usually deployed at the external boundary of the network or the internal subnet boundary, and are designed to detect and block known attack patterns. For example, traditional antivirus software removes viruses by scanning files and systems and identifying known virus signatures. However, this approach has limited effect on new ransomware viruses because these viruses often mutate to evade detection by antivirus software.

[0004] In addition, firewalls are mainly used to manage network traffic and prevent unauthorized access. However, it is often difficult to effectively defend against attacks in internal networks, especially those that exploit vulnerabilities. In order to make up for the shortcomings of traditional defense systems, some advanced network security technologies have emerged. For example, intrusion detection systems (IDS) and intrusion prevention systems (IPS) can monitor network traffic in real time and detect and block suspicious activities in a timely manner. In addition, behavioral analysis technology is also widely used in the field of network security, which can detect potential threats in advance by analyzing abnormal patterns of system and network behavior.

[0005] Although these technologies have improved the level of network security protection to a certain extent, they still face many challenges in the face of increasingly complex network environments and evolving ransomware. Therefore, the field of network security urgently needs to continue to innovate and develop more intelligent and efficient defense technologies to cope with the escalating network security threats. Summary of the invention

[0006] In view of the above problems, an embodiment of the present invention provides a method and device for identifying and countering ransomware to solve the technical problems existing in the background technology.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, the present invention provides a method for identifying and countering ransomware, the method comprising:

[0009] Monitoring honeypots that induce ransomware attacks based on network infrastructure configuration;

[0010] Detect and analyze the attack behavior of the ransomware virus captured by the monitoring honeypot, and intercept the threat behavior data of the ransomware virus;

[0011] Trigger the ransomware countermeasure mechanism based on the ransomware threat behavior data.

[0012] In one embodiment, the monitoring honeypot configured according to the network infrastructure to induce a ransomware attack includes:

[0013] Select the appropriate operating system to perform simulation tasks based on the characteristics of the network infrastructure;

[0014] Perform simulation operations on the network infrastructure according to the selected operating system to build a simulated network infrastructure;

[0015] Based on the simulated network infrastructure, the vulnerabilities of the corresponding ransomware attack methods are configured to generate a monitoring honeypot.

[0016] In one embodiment, the ransomware virus attack means include at least one of the following: RDP password blasting, IPCS password blasting, Windows RCE and watering hole attack.

[0017] In one embodiment, the detecting and analyzing the attack behavior of the ransomware captured by the monitoring honeypot and intercepting the threat behavior data of the ransomware includes:

[0018] Obtain the ransomware captured in the monitoring honeypot;

[0019] Based on the workflow, feature monitoring, feature matching and behavior recognition of the captured ransomware, the working mechanism and attack method of the ransomware are obtained;

[0020] Integrate the working mechanism and attack mode of ransomware to obtain threat behavior data.

[0021] In one embodiment, the anti-ransomware mechanism triggered according to the threat behavior data of the ransomware includes:

[0022] Determine the propagation type and attack behavior of the ransomware based on the threat behavior data of the ransomware;

[0023] The ransomware countermeasure mechanism is triggered according to the ransomware's propagation type and attack behavior.

[0024] In one embodiment, the propagation type of the ransomware virus includes at least one of the following: a vulnerability exploitation propagation type, a password blasting propagation type, a phishing email propagation type, a botnet propagation type, and a Linux platform propagation type.

[0025] In one embodiment, it further includes:

[0026] Share the threat behavior data of captured ransomware with third parties.

[0027] In a second aspect, the present invention provides a device for identifying and countering ransomware, the device comprising:

[0028] Lure module: a monitoring honeypot used to induce ransomware attacks based on network infrastructure configuration;

[0029] Capture module: used to detect and analyze the attack behavior of the ransomware virus captured by the monitoring honeypot, and intercept the threat behavior data of the ransomware virus;

[0030] Countermeasure module: used to trigger the countermeasure mechanism of ransomware according to the threat behavior data of ransomware.

[0031] In one embodiment, the luring module is specifically used for:

[0032] Select the appropriate operating system to perform simulation tasks based on the characteristics of the network infrastructure;

[0033] Perform simulation operations on the network infrastructure according to the selected operating system to build a simulated network infrastructure;

[0034] Based on the simulated network infrastructure, the vulnerabilities of the corresponding ransomware attack methods are configured to generate a monitoring honeypot.

[0035] In one embodiment, the ransomware attack method in the luring module includes at least one of the following: RDP password blasting, IPCS password blasting, Windows RCE and watering hole attack.

[0036] In one embodiment, the capture module is specifically used for:

[0037] Obtain the ransomware captured in the monitoring honeypot;

[0038] Based on the workflow, feature monitoring, feature matching and behavior recognition of the captured ransomware, the working mechanism and attack method of the ransomware are obtained;

[0039] Integrate the working mechanism and attack mode of ransomware to obtain threat behavior data.

[0040] In one embodiment, the countermeasure module is specifically used for:

[0041] Determine the propagation type and attack behavior of the ransomware based on the threat behavior data of the ransomware;

[0042] The ransomware countermeasure mechanism is triggered according to the ransomware's propagation type and attack behavior.

[0043] In one embodiment, the propagation type of the ransomware virus in the countermeasure module includes at least one of the following: vulnerability exploitation propagation type, password blasting propagation type, phishing email propagation type, botnet propagation type and Linux platform propagation type.

[0044] In one embodiment, a sharing module is also included:

[0045] The sharing module is used to share the captured threat behavior data of the ransomware virus with a third party.

[0046] In a third aspect, the present invention provides an electronic device, comprising: a processor and a memory;

[0047] The memory is used to store computer programs;

[0048] The processor is used to execute a method for identifying and countering a ransomware virus provided in any one of the first aspects by calling the computer program.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a program, and when the program is executed by a processor, the program is used to implement a method for identifying and countering a ransomware virus provided in any one of the first aspects.

[0050] The effective effect of the present invention is: the present invention actively induces the ransomware to launch an attack by simulating a monitoring honeypot of a real system and file environment. In this way, before the ransomware attacks the real system, it can be captured and analyzed, thereby achieving active defense and enhancing the ability to prevent new ransomware. This solves the technical difficulties of traditional antivirus software in effectively preventing new ransomware attacks. By deeply monitoring and analyzing attack behaviors, more attack details and features can be captured. By providing a highly simulated common environment for ransomware, ransomware attacks can be induced in a targeted manner. In addition, it can also be linked with other security protection systems to achieve joint defense and comprehensively improve the network security protection effect. At the same time, it solves the limitations faced by firewalls when dealing with internal network vulnerability attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The figure is a schematic diagram of a method for identifying and countering ransomware in one embodiment of the present invention;

[0052] Figure 2 The figure is a schematic diagram of the structure of a ransomware virus identification and countermeasure device according to an embodiment of the present invention;

[0053] Figure 3 FIG. 1 is a schematic structural diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention clearer and more understandable, the present invention is further described below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0055] Based on the shortcomings of the prior art, the present invention provides a specific implementation method of a method for identifying and countering ransomware, such as Figure 1 As shown, the method specifically includes:

[0056] S110: Monitoring honeypot that induces ransomware attacks based on network infrastructure configuration.

[0057] Network infrastructure includes but is not limited to mail systems, domain control servers, operation and maintenance management systems, and control systems. Monitoring honeypots are simulations of network infrastructure configured on virtualized resources through the virtualization support layer. The virtualization support layer is mainly responsible for the management of virtualized resources, including computing resources, storage resources, network resources, container resources, and template resources, and provides support services for the construction of detection honeypots based on the virtualization resource call interface.

[0058] In the process of monitoring honeypot configuration, it is necessary to configure and maintain it through the business function layer, including honeypot sweetness setting, honeypot device configuration and status monitoring, image creation, trapping device configuration and status monitoring, and configuration of built-in typical high-simulation scenarios. Through configuration, the state of the honeypot can be better defined to make it more deceptive. At the same time, the collection of intruder detection threat and substantive threat data can monitor the intruder's attack behavior in real time and comprehensively, and provide source data support for tracing the intruder's location, means, tools, and auxiliary perception of intrusion intentions.

[0059] Monitoring honeypots can actively lure ransomware to launch attacks, so that they can be captured and analyzed before the ransomware attacks the real system, thereby achieving active defense and enhancing the ability to prevent new ransomware.

[0060] The specific generation method of the monitoring honeypot is as follows:

[0061] First, select a suitable operating system to perform simulation tasks based on the characteristics of the network infrastructure;

[0062] Then, the network infrastructure is simulated according to the selected operating system to build a simulated network infrastructure;

[0063] Finally, based on the simulated network infrastructure, the vulnerabilities of the corresponding ransomware attack methods are configured to generate a monitoring honeypot.

[0064] The ransomware attack methods include at least one of the following: RDP password blasting, IPCS password blasting, Windows RCE and watering hole attack.

[0065] Remote Desktop Protocol (RDP) password cracking is when an attacker tries a large number of different username and password combinations in an attempt to find the correct credentials to log into the Remote Desktop Service. This attack method usually uses automated tools that can quickly try multiple combinations to increase the success rate of cracking. RDP password cracking is very harmful. Once an attacker successfully logs in, they can completely control the target computer, obtain sensitive data, install malware, and even further launch attacks on the internal network.

[0066] IPCS password cracking is to use automated tools to generate a large number of password combinations and try to log in to IPCS (Internet Process Connection Share) to guess and crack its password. IPCS is a mechanism used in Windows systems to remotely manage shared resources. Attackers can exploit this vulnerability to gain control of the system. By constantly trying various password combinations, attackers can gradually narrow down the range of possible passwords and eventually find the correct password.

[0067] Windows RCE refers to a remote code execution vulnerability in the Windows operating system that allows attackers to execute arbitrary code on a remote computer and gain control of the system. Since Windows is widely used in personal computers and corporate servers, the discovery and exploitation of this vulnerability may pose a serious security threat to users and enterprises. Attackers can exploit Windows RCE vulnerabilities in a variety of ways, such as sending malicious links or attachments through phishing emails to trick users into clicking or downloading, thereby triggering the vulnerability. In addition, attackers can also use vulnerability scanning tools to actively search for vulnerable systems on the network. Once found, they can remotely execute code.

[0068] A watering hole attack refers to implanting malicious code or exploiting known vulnerabilities in the target system or network, so that when users access or use certain specific resources, the system will automatically download and execute the malicious code. This attack method usually takes advantage of users' trust in certain seemingly normal or legitimate resources to induce users to trigger malicious behavior unknowingly. Typical scenarios of watering hole attacks include but are not limited to: attackers implant malicious code on legitimate websites, and when users visit these websites, the malicious code will be automatically downloaded and executed; or attackers use emails, social media and other channels to send information with malicious links. After users click on these links, the system will automatically download and execute the malicious code.

[0069] Next, the power plant control system, mail system, domain control server and operation and maintenance management system are described in detail.

[0070] Power plant control system: Build a highly interactive honeypot monitoring system based on the EternalBlue ransomware. The system simulates the power plant control system and runs on the WinXP operating system. It has built-in EternalBlue vulnerabilities, designed to attract attackers to exploit these vulnerabilities to implant ransomware.

[0071] Mail system: The ransomware monitoring honeypot for the mail system is also a highly interactive system. It simulates the login page of the mail system and runs on the Server 2008 operating system. The system is embedded with EternalBlue and WebLogic remote code execution (RCE) vulnerabilities, the purpose of which is to induce attackers to try to steal email accounts to send phishing emails, or use these vulnerabilities to implant ransomware.

[0072] Domain controller server: The ransomware monitoring honeypot system based on the domain controller is also highly interactive. It simulates the domain controller server and uses the Server2008 operating system. The system has built-in EternalBlue vulnerabilities, which are designed to lure attackers to exploit these vulnerabilities and implant ransomware.

[0073] Operation and maintenance management system: Build a ransomware monitoring honeypot system based on Tomcat. The system is also highly interactive and runs on the CentOS 7.9 operating system. It simulates the operation and maintenance management system and has a built-in Tomcat remote code execution vulnerability, the purpose of which is to induce attackers to exploit the vulnerability to implant ransomware.

[0074] S120: Detect and analyze the attack behavior of the ransomware captured by the monitoring honeypot, and intercept the threat behavior data of the ransomware.

[0075] By conducting detailed detection and analysis of the ransomware captured by the monitoring honeypot, we can gain in-depth insights into the specific details of its attack behavior. We can intercept the threat behavior data of the ransomware in order to further analyze its attack mode and characteristics. This helps identify the key behavioral characteristics of the ransomware and provides strong support for developing effective defense measures.

[0076] Obtain the ransomware captured in the monitoring honeypot;

[0077] Based on the workflow, feature monitoring, feature matching and behavior recognition of the captured ransomware, the working mechanism and attack method of the ransomware are obtained;

[0078] Integrate the working mechanism and attack mode of ransomware to obtain threat behavior data.

[0079] The workflow of ransomware refers to the basic workflow of ransomware, including the infection phase (file encryption), negotiation phase (communication with the victim) and escape phase (attacker evacuation). Clarifying these processes will help with subsequent targeted monitoring and countermeasures.

[0080] Feature monitoring includes static feature analysis and dynamic behavior monitoring. Static feature analysis refers to extracting static features such as metadata and string constants of ransomware for building feature libraries. Dynamic behavior monitoring refers to observing and recording the specific behavior of ransomware after infection in a controlled environment, such as accessing external networks, creating specific files, etc., as dynamic behavior features.

[0081] Signature matching refers to the use of signature technology to compare the extracted features with known ransomware samples to quickly identify newly discovered ransomware; using a sandbox environment or other analysis tools to analyze the behavior patterns of suspicious files in real time and match them with known ransomware behaviors.

[0082] Behavior recognition refers to analyzing the behavioral characteristics of ransomware based on machine learning and natural language processing technology to establish a behavioral model. It also detects and identifies abnormal behaviors that match the behavior patterns of ransomware by continuously monitoring network traffic and system logs.

[0083] The working mechanism of ransomware refers to the encryption, screen locking and other operations performed by the ransomware in the computer system.

[0084] The attack method of ransomware refers to the propagation method and infection strategy of ransomware.

[0085] S130: Triggering a countermeasure mechanism for the ransomware according to the threat behavior data of the ransomware.

[0086] According to the threat behavior data of ransomware, the corresponding countermeasure mechanism can be triggered to respond to and defend against ransomware attacks. Specifically, when the ransomware attempts to damage by encrypting files, tampering with system settings, or spreading malicious code, these threat behaviors will be detected immediately. Once these behaviors are detected, pre-set countermeasures will be automatically launched, which can effectively curb the spread and destructive behavior of the ransomware before it causes serious damage.

[0087] Determine the propagation type and attack behavior of the ransomware based on the threat behavior data of the ransomware;

[0088] The ransomware countermeasure mechanism is triggered according to the ransomware's propagation type and attack behavior.

[0089] The propagation types of ransomware include at least one of the following: vulnerability exploitation propagation type, password blasting propagation type, phishing email propagation type, botnet propagation type and Linux platform propagation type.

[0090] The following uses vulnerability exploit propagation type, password brute force propagation type, phishing email propagation type, botnet propagation type and Linux platform propagation type as examples to illustrate.

[0091] Vulnerability exploitation and spreading of ransomware:

[0092] Ransomware monitoring honeypot based on EternalBlue: It uses WinXP operating system, simulates power plant control system, and has built-in EternalBlue vulnerability. When an attacker successfully logs in through RDP, the source tracing countermeasure is triggered, and it has built-in RDP protocol-level source tracing countermeasure mechanism.

[0093] Password blasting and spreading ransomware:

[0094] Ransomware monitoring honeypot based on weak RDP password: It uses Win10 operating system to simulate personal office computers and sets the system administrator's password to a weak password, inducing attackers to implant ransomware through RDP password blasting. When the attacker successfully logs in through RDP, the source tracing countermeasure is triggered, and it has a built-in RDP protocol-level source tracing countermeasure mechanism.

[0095] Phishing emails spread ransomware:

[0096] Ransomware monitoring honeypot based on the email system: A download link for a source-tracing countermeasure bait disguised as an email client is added to the login page. When an attacker downloads and executes the bait, source-tracing countermeasure is triggered. At the same time, an RDP protocol-level source-tracing countermeasure mechanism is built in. When an attacker successfully logs in through RDP and runs the application on the desktop again, source-tracing countermeasure is triggered.

[0097] Botnet-spreading ransomware:

[0098] Domain control-based ransomware monitoring honeypot: Built-in botnet monitoring engine, which can monitor botnets such as Necurs, Mirai, Gafgyt, Zeus, etc. When an attacker successfully logs in through RDP, the source tracing countermeasure is triggered, and it has a built-in RDP protocol-level source tracing countermeasure mechanism.

[0099] Linux platform ransomware:

[0100] Tomcat-based ransomware monitoring honeypot: A tracing and countermeasure bait download link disguised as a system manual is added to the login page. When the attacker downloads and opens the bait, the tracing and countermeasure is triggered.

[0101] S140: Share the captured ransomware threat behavior data with a third party.

[0102] Through the syslog service, threat behavior data can be shared with third-party security protection systems to promote the implementation of joint defense mechanisms. In addition, the captured threat data can be visualized and displayed, covering overall threat analysis, intrusion / detection threat analysis, ransomware analysis, and monitoring of honeypot operation status. By displaying threat data, samples, intelligence, bait scenarios, detection rules, and IP addresses, various analysis results can intuitively reveal the current network security status, simplify users' daily security operation and maintenance tasks, and provide strong support for security decision-making.

[0103] In this embodiment, a monitoring honeypot that simulates a real system and file environment is used to actively induce the ransomware to launch an attack. In this way, before the ransomware attacks the real system, it can be captured and analyzed, thereby achieving active defense and enhancing the ability to prevent new ransomware. This solves the technical difficulties of traditional antivirus software in effectively preventing new ransomware attacks. By deeply monitoring and analyzing attack behaviors, more attack details and features can be captured. By providing a highly simulated common ransomware environment, ransomware attacks can be induced in a targeted manner. In addition, it can also be linked with other security protection systems to achieve joint defense and comprehensively improve network security protection effects. At the same time, it solves the limitations faced by firewalls in responding to internal network vulnerability attacks.

[0104] Based on the same inventive concept, the embodiments of the present application also provide a ransomware virus identification and countermeasure device, which can be used to implement a ransomware virus identification and countermeasure method described in the above embodiments, such as the following embodiments. Since the principle of solving the problem by a ransomware virus identification and countermeasure device is similar to that of a ransomware virus identification and countermeasure method, the implementation of a ransomware virus identification and countermeasure device can refer to the implementation of a ransomware virus identification and countermeasure method, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0105] like Figure 2 As shown, the present invention provides a device for identifying and countering ransomware viruses. Figure 2 The device comprises:

[0106] Lure module 210: a monitoring honeypot for inducing a ransomware attack according to a network infrastructure configuration;

[0107] Capture module 220: used to detect and analyze the attack behavior of the ransomware captured by the monitoring honeypot, and intercept the threat behavior data of the ransomware;

[0108] Countermeasure module 230: used to trigger a countermeasure mechanism for the ransomware according to the threat behavior data of the ransomware.

[0109] In one embodiment of the present invention, the inducement module 210 is specifically used for:

[0110] Select the appropriate operating system to perform simulation tasks based on the characteristics of the network infrastructure;

[0111] Perform simulation operations on the network infrastructure according to the selected operating system to build a simulated network infrastructure;

[0112] Based on the simulated network infrastructure, the vulnerabilities of the corresponding ransomware attack methods are configured to generate a monitoring honeypot.

[0113] In one embodiment of the present invention, the ransomware virus attack means in the luring module 210 includes at least one of the following: RDP password blasting, IPCS password blasting, Windows RCE and watering hole attack.

[0114] In one embodiment of the present invention, the capture module 220 is specifically used for:

[0115] Obtain the ransomware captured in the monitoring honeypot;

[0116] Based on the workflow, feature monitoring, feature matching and behavior recognition of the captured ransomware, the working mechanism and attack method of the ransomware are obtained;

[0117] Integrate the working mechanism and attack mode of ransomware to obtain threat behavior data.

[0118] In one embodiment of the present invention, the countermeasure module 230 is specifically used for:

[0119] Determine the propagation type and attack behavior of the ransomware based on the threat behavior data of the ransomware;

[0120] The ransomware countermeasure mechanism is triggered according to the ransomware's propagation type and attack behavior.

[0121] In one embodiment of the present invention, the propagation type of the ransomware virus in the countermeasure module 230 includes at least one of the following: vulnerability exploitation propagation type, password brute force propagation type, phishing email propagation type, botnet propagation type and Linux platform propagation type.

[0122] In one embodiment of the present invention, a sharing module 240 is further included:

[0123] The sharing module 240 is used to share the captured threat behavior data of the ransomware virus with a third party.

[0124] The embodiments of the present application also provide a specific implementation of an electronic device that can implement all the steps in the method in the above embodiments, see Figure 3 , the electronic device 300 specifically includes the following contents:

[0125] Processor 310, memory 320, communication unit 330 and bus 340;

[0126] The processor 310 , the memory 320 , and the communication unit 330 communicate with each other via the bus 340 ; the communication unit 330 is used to implement information transmission between server-side devices and terminal devices and other related devices.

[0127] The processor 310 is used to call the computer program in the memory 320. When the processor executes the computer program, all steps in the method for identifying and countering ransomware in the above embodiment are implemented.

[0128] Those skilled in the art should understand that the memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory is used to store programs, and the processor executes the programs after receiving the execution instruction. Furthermore, the software programs and modules in the above-mentioned memory may also include an operating system, which may include various software components and / or drivers for managing system tasks (such as memory management, storage device control, power management, etc.), and may communicate with various hardware or software components to provide an operating environment for other software components.

[0129] The processor may be an integrated circuit chip having the ability to process signals. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0130] The present application also provides a computer-readable storage medium, which includes a program. When the program is executed by a processor, it is used to execute a method for identifying and countering ransomware provided by any of the aforementioned method embodiments.

[0131] Those skilled in the art should understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes, and the specific media type is not limited in this application.

[0132] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for identifying and countering ransomware, characterized in that: The method comprises: Monitoring honeypots that induce ransomware attacks based on network infrastructure configuration; Detect and analyze the attack behavior of the ransomware virus captured by the monitoring honeypot, and intercept the threat behavior data of the ransomware virus; Trigger the ransomware countermeasure mechanism based on the ransomware threat behavior data.

2. A method for identifying and countering ransomware according to claim 1, characterized in that: The monitoring honeypots for inducing ransomware attacks according to the network infrastructure configuration include: Select the appropriate operating system to perform simulation tasks based on the characteristics of the network infrastructure; Perform simulation operations on the network infrastructure according to the selected operating system to build a simulated network infrastructure; Based on the simulated network infrastructure, the vulnerabilities of the corresponding ransomware attack methods are configured to generate a monitoring honeypot.

3. A method for identifying and countering ransomware according to claim 2, characterized in that: The ransomware attack method includes at least one of the following: RDP password blasting, IPCS password blasting, Windows RCE and watering hole attack.

4. A method for identifying and countering ransomware according to claim 1, characterized in that: The detecting and analyzing the attack behavior of the ransomware captured by the monitoring honeypot and intercepting the threat behavior data of the ransomware include: Obtain the ransomware captured in the monitoring honeypot; Based on the workflow, feature monitoring, feature matching and behavior recognition of the captured ransomware, the working mechanism and attack method of the ransomware are obtained; Integrate the working mechanism and attack mode of ransomware to obtain threat behavior data.

5. A method for identifying and countering ransomware according to claim 1, characterized in that: The countermeasure mechanism for triggering the ransomware according to the threat behavior data of the ransomware includes: Determine the propagation type and attack behavior of the ransomware based on the threat behavior data of the ransomware; The ransomware countermeasure mechanism is triggered according to the ransomware's propagation type and attack behavior.

6. A method for identifying and countering ransomware according to claim 5, characterized in that: The propagation type of the ransomware virus includes at least one of the following: vulnerability exploitation propagation type, password blasting propagation type, phishing email propagation type, botnet propagation type and Linux platform propagation type.

7. A method for identifying and countering ransomware according to claim 1, characterized in that: Also includes: Share the threat behavior data of captured ransomware with third parties.

8. A ransomware virus identification and countermeasure device, characterized in that: The device comprises: Lure module: a monitoring honeypot used to induce ransomware attacks based on network infrastructure configuration; Capture module: used to detect and analyze the attack behavior of the ransomware virus captured by the monitoring honeypot, and intercept the threat behavior data of the ransomware virus; Countermeasure module: used to trigger the countermeasure mechanism of ransomware according to the threat behavior data of ransomware.

9. An electronic device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 7 by calling the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a program, and when the program is executed by a processor, the program is used to implement the method according to any one of claims 1 to 7.

Images