Ransomware detection method and device, equipment, storage medium and product

Abstract

The invention provides a ransomware detection method and device, equipment, a storage medium and a product, and the method comprises the steps: screening all available event providers in a Windows system to obtain a risk event provider, and collecting event data provided by the risk event provider; wherein the risk event provider is an event provider related to the volume shadow copy deletion event; based on a preset volume shadow copy deletion behavior recognition template, screening from the event data to obtain a volume shadow copy deletion event, and obtaining a to-be-processed process corresponding to the volume shadow copy deletion event; performing process tracking and tracing on the to-be-processed process, and determining whether the to-be-processed process is a process related to ransomware or not; and if yes, stopping executing the to-be-processed process, otherwise, continuing executing the to-be-processed process. According to the scheme, the efficiency and accuracy of ransomware detection are improved, and therefore the safety and reliability of a computer system are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a ransomware detection method, device, equipment, storage medium and product. Background Art

[0002] Ransomware is a type of malicious software whose main purpose is to force victims to pay a ransom to restore access to data or systems by encrypting their data or locking their systems. The attack process is generally divided into the following five stages: propagation and distribution and device infection, communication with the Command and Control Server (C&C) to obtain instructions and exchange keys, data scanning and lateral movement, data destruction and leakage, and ransom. The proliferation of ransomware poses a security threat, and the necessity of designing computer equipment defense mechanisms is increasing day by day. Comprehensive attack method analysis and detection and protection research are needed as soon as possible to cope with the outbreak of ransomware attacks on various operating systems.

[0003] Similar to the defense against traditional malware, the best way to fight against ransomware is to detect and terminate its activities. There are currently some ransomware detection methods, among which ransomware encryption behavior detection is one of the most widely used methods, because encrypting user files is a common signature action of ransomware in the process of data destruction. In some exemplary technologies, encryption behavior detection is performed at different levels of the computer architecture, for example, encryption behavior detection is performed at the application layer, operating system layer, hardware layer, etc.

[0004] However, ransomware has evolved to more covert encryption behaviors, such as imitating normal program file input / output (I / O) operations, independently implementing encryption algorithms instead of using easily recognizable application programming interfaces (APIs) and libraries, etc., which makes it easy to bypass both direct and indirect detection implementation methods for ransomware encryption behavior detection. It is understandable that as attackers continue to design new strategies to evade detection, ransomware detection based on encryption behavior cannot ensure long-term effectiveness, resulting in poor efficiency and accuracy of ransomware detection. Summary of the invention

[0005] The present invention provides a ransomware detection method, device, equipment, storage medium and product, which are used to solve the defects of poor efficiency and accuracy of ransomware detection in the prior art, and improve the efficiency and accuracy of ransomware detection.

[0006] The present invention provides a ransomware detection method, comprising the following steps.

[0007] A risk event provider is obtained by screening from all available event providers in the Windows system, and event data provided by the risk event provider is collected; wherein the risk event provider is an event provider related to a volume shadow copy deletion event.

[0008] Based on a preset volume shadow copy deletion behavior identification template, a volume shadow copy deletion event is obtained by screening from the event data, and a to-be-processed process corresponding to the volume shadow copy deletion event is obtained.

[0009] The process to be processed is traced and traced to its source to determine whether the process to be processed is a process related to the ransomware; if so, the execution of the process to be processed is stopped; otherwise, the execution of the process to be processed is continued.

[0010] According to a ransomware detection method provided by the present invention, the Windows system includes an application layer, an operating system layer and a hardware layer; the step of screening and obtaining a risk event provider from all available event providers in the Windows system includes: screening an event provider that meets screening conditions from the event providers of the application layer, the operating system layer and the hardware layer as the risk event provider; wherein the screening conditions include: the event type in the event data provided by the event provider includes at least one of the following: volume shadow copy service interaction, new process startup or execution, file input and output, disk input and output; the frequency of event occurrence is greater than a first threshold; and the coverage of the event provider in the layer in which it is located meets the preset requirements.

[0011] According to a ransomware detection method provided by the present invention, after collecting the event data provided by the risk event provider, the method further includes: parsing and structuring the event data to obtain JavaScript object notation format event data; the JavaScript object notation format event data includes: a file header, attributes of the process to be processed, and attribute values.

[0012] According to a ransomware detection method provided by the present invention, the process tracing and tracing the process to be processed to determine whether the process to be processed is a process related to the ransomware includes the following steps.

[0013] Based on the attributes of the process to be processed, a cluster analysis is performed on the process to be processed to determine the process group corresponding to the process to be processed; wherein the attributes of the process to be processed include: a unique identification key value of the process, an identifier of the parent process, a unique identifier of the process, an executable file path of the process, a hash value of a memory-mapped file, and a security identifier of a user who starts the process.

[0014] For each process group, a data structure is created and initialized, the data structure including: an array, an original program mapping and a process source mapping; wherein the array is used to store the process tracking and tracing results corresponding to each pending process in the process group, and the process tracking and tracing results corresponding to the pending process include: the initiator corresponding to the pending process and whether the pending process is a process unrelated to the ransomware; the original program mapping is used to establish an association relationship between the source identifier of the pending process and the program information of the pending process; the process source mapping is used to establish an association relationship between the identifier of the pending process and the source information of the pending process.

[0015] Determining the source relationship of each of the to-be-processed processes in the process group according to the original program mapping and the process source mapping; According to the source relationship of the process to be processed, an initiator program corresponding to the process to be processed is determined.

[0016] Determine whether the initiator corresponding to the process to be processed is consistent with the initiator corresponding to the ransomware; if consistent, determine that the process to be processed is a process related to the ransomware; otherwise, determine that the process to be processed is a process unrelated to the ransomware.

[0017] The process tracing result corresponding to the process to be processed is stored in the array.

[0018] According to a ransomware detection method provided by the present invention, the collecting of event data provided by the risk event provider specifically includes: performing application programming interface interaction with the risk event provider to collect the event data provided by the risk event provider.

[0019] According to a ransomware detection method provided by the present invention, the volume shadow copy deletion behavior recognition template includes: a system native binary abuse recognition template, a scripting language object abuse recognition template, a component object model object interaction recognition template, and a direct device access recognition template.

[0020] The present invention also provides a ransomware detection device, comprising the following modules.

[0021] The event collection module is used to filter and obtain risk event providers from all available event providers in the Windows system, and collect event data provided by the risk event providers; wherein the risk event providers are event providers related to volume shadow copy deletion events.

[0022] The event screening module is used to screen and obtain the shadow copy deletion event from the event data based on a preset shadow copy deletion behavior identification template, and obtain the to-be-processed process corresponding to the shadow copy deletion event.

[0023] The tracing module is used to trace the process to be processed to determine whether the process to be processed is a process related to the ransomware; if so, stop executing the process to be processed; otherwise, continue executing the process to be processed.

[0024] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, any of the above-mentioned ransomware detection methods is implemented.

[0025] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the ransomware detection method as described in any one of the above is implemented.

[0026] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned ransomware detection methods.

[0027] The ransomware detection method, device, equipment, storage medium and product provided by the present invention monitor the copy deletion events that need to be executed during the ransomware attack process, and further analyze whether the process corresponding to the copy deletion event is a process related to the ransomware, and promptly stop the execution of the process related to the ransomware, so as to timely and effectively block the malicious behavior of the ransomware during the ransomware attack process, realize the real-time detection and attack interception of the ransomware, and prevent further damage to the user's computer system. Therefore, the scheme of the present invention improves the efficiency and accuracy of ransomware detection, thereby improving the security and reliability of the computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 It is a flow chart of the ransomware detection method provided by the present invention.

[0030] Figure 2 It is a structural schematic diagram of the ransomware detection device provided by the present invention.

[0031] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0034] The terms "first", "second", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise indicated. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, for example, they can be implemented in an order other than those given in the diagrams or descriptions of the embodiments of this application.

[0035] In addition, the terms "including" and "having" and any variations thereof are intended to cover but not exclude inclusion, for example, a product or device comprising a series of components is not necessarily limited to those components explicitly listed, but may include other components not explicitly listed or inherent to these products or devices. The term "module" as used in this application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or combination of hardware and / or software code that can perform the functions associated with the element.

[0036] Ransomware is a type of malicious software whose main purpose is to force victims to pay a ransom to restore access to data or systems by encrypting their data or locking their systems. The attack process is generally divided into the following five stages: propagation and distribution and device infection, communication with the command and control server (C&C) to obtain instructions and exchange keys, data scanning and lateral movement, data destruction and leakage, and ransom. The proliferation of ransomware poses a security threat, and the necessity of designing computer equipment defense mechanisms is increasing day by day. Comprehensive attack method analysis and detection and protection research are needed as soon as possible to cope with the outbreak of ransomware attacks on various operating systems.

[0037] Similar to traditional malware defense, the best way to fight ransomware is to detect and terminate its activities. There are several ransomware detection methods, among which ransomware encryption behavior detection is one of the most widely used methods, because encrypting user files is a common signature action of ransomware in the process of data destruction.

[0038] In the prior art, encryption behavior is detected at different levels of computer architecture, for example, encryption behavior is detected at the application layer, operating system layer, hardware layer, etc. In some exemplary technologies, at the application layer, natural language processing (NLP) technology is used to identify anomalies in ransomware process commands, thereby detecting the execution of malicious commands such as encrypted file behaviors. In some exemplary technologies, at the application layer, predefined rules are used to identify the ransomware encryption process by analyzing the file input / output (I / O) mode (because specific encryption operations such as encrypting a large number of files and changing file extensions will increase the entropy value of the file and show abnormal I / O frequency). In some exemplary technologies, at the operating system layer, by monitoring the use of the system encryption application programming interface (API), ransomware is detected and the infected files are assisted in decryption. In some exemplary technologies, at the operating system layer, the encryption process of ransomware is monitored by network traffic analysis. In some exemplary technologies, at the hardware layer, the hardware performance counter (HPC) in the performance monitoring unit of a modern processor is used to observe the microarchitecture event set to detect the presence of encryption ransomware. In some exemplary technologies, at the hardware layer, the impact of the encryption behavior of the ransomware on the storage device is captured by analyzing the log of the solid-state drive (SSD).

[0039] However, ransomware has evolved to more covert encryption behaviors, such as imitating normal program file input and output (I / O) operations, independently implementing encryption algorithms instead of using easily recognizable application programming interfaces (APIs) and libraries, etc., which makes it easy to bypass both direct and indirect detection implementation methods for ransomware encryption behavior detection. It is understandable that as attackers continue to design new strategies to evade detection, ransomware detection based on encryption behavior cannot ensure long-term effectiveness, resulting in poor efficiency and accuracy of ransomware detection.

[0040] In response to the above technical problems, the present invention proposes the following technical concept: In the ransomware attack process, deleting system copy data is a step that cannot be skipped or hidden. By monitoring the copy deletion events that need to be executed during the ransomware attack, and further analyzing whether the process corresponding to the copy deletion event is a ransomware-related process, the execution of the ransomware-related process is stopped in time, and the execution of the non-ransomware-related process is maintained, thereby effectively blocking the malicious behavior of the ransomware during the ransomware attack, that is, realizing real-time detection and attack interception of the ransomware, and effectively avoiding further damage to the user's computer system. Thereby achieving the technical effect of improving the efficiency and accuracy of ransomware detection, and then achieving the technical effect of improving the security and reliability of the computer system.

[0041] The following specific embodiments are used to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. Figure 1 The ransomware detection method of the present invention is described.

[0042] In practical applications, the execution subject of the ransomware detection method can be a ransomware detection device. There are many ways to implement the ransomware detection device, for example, it can be implemented through a computer program, such as application software, etc.; or, for example, a chip, etc. It can also be implemented as a medium storing relevant computer programs, such as a USB flash drive, a cloud disk, etc.; or, it can also be implemented through a physical device integrated or installed with relevant computer programs, such as a server, an intelligent device, etc.

[0043] Figure 1 is a flow chart of the ransomware detection method provided by the present invention, such as Figure 1 As shown, the method includes steps 101 to 106.

[0044] Step 101: Filter and obtain risk event providers from all available event providers in the Windows system, wherein the risk event providers are event providers related to the volume shadow copy deletion event.

[0045] Among them, an event provider refers to a component, service or application that generates or triggers an event. An event provider monitors or performs certain operations and generates event notifications when specific conditions or actions occur. In this embodiment, the event provider can be an event provider under the Event Tracing for Windows (ETW) framework, and for the convenience of description, it is briefly referred to as an ETW event provider below.

[0046] Specifically, ETW is a powerful tool in the Windows operating system that provides developers and system administrators with in-depth understanding of system behavior and performance. ETW is used to monitor and record detailed event information of the system, applications, and drivers. Through ETW, system problems can be effectively monitored and diagnosed, system performance can be optimized, and system security can be enhanced.

[0047] In actual applications, the Windows system includes multiple available event providers. By detecting all ETW event providers in the Windows system, event providers related to the volume shadow copy deletion event, namely, risk event providers, can be identified. It can be understood that screening and obtaining risk event providers from all available event providers in the Windows system can avoid excessive system load and data noise, while ensuring that necessary event data is not missed.

[0048] Specifically, there are two types of ETW event providers: manifest-based ETW event providers and trace logging-based ETW event providers. Manifest-based ETW event providers require an XML manifest file to declare the structure and properties of events, which allows events to be clearly defined and reused between multiple tools and applications. Trace logging-based ETW event providers do not require external manifest files, allowing events to be defined directly in the source code, simplifying deployment and maintenance. The present invention takes into account both types of ETW event providers.

[0049] The following takes Windows 11 22H2 system as an example to specifically explain step 101. Specifically, 15 risk event providers are screened from all 1121 ETW event providers in the Windows 11 22H2 system to generate ETW events in the user mode and kernel mode of the operating system. Specifically, Table 1 is the information of the risk event provider in user mode, and the information of the risk event provider in user mode includes: provider name and globally unique identifier. Table 2 is the information of the risk event provider in kernel mode, and the information of the risk event provider in kernel mode includes: provider name.

[0050] Table 1

[0051] Table 2

[0052] It should be noted that the above risk event providers and information of risk event providers are only examples and can be adjusted in practice according to the detection requirements of ransomware.

[0053] As an example, based on the above embodiments, in some possible implementations, the above Windows system includes an application layer, an operating system layer and a hardware layer; wherein the event providers of the application layer include user processes, the event providers of the operating system layer include file systems and drivers, and the event providers of the hardware layer include device controllers.

[0054] By way of example, the above step 101 specifically includes: screening event providers that meet the screening conditions from event providers at the application layer, operating system layer and hardware layer as risk event providers; wherein the screening conditions include: the event type in the event data provided by the event provider includes at least one of the following: volume shadow copy service interaction, new process startup or execution, file input and output, disk input and output; the frequency of event occurrence is greater than a first threshold; the coverage range of the event provider in the layer in which it is located meets the preset requirements.

[0055] Among them, Volume Shadow Copy Service Interaction (VSS) involves events related to system backup operations. New process startup or execution may indicate that ransomware is spreading or executing its malicious code. File input and output involving a large number of file operations, especially encryption or deletion operations, may be a sign of ransomware activity. Disk input and output may be related to ransomware encryption or destruction of data.

[0056] In actual applications, if the frequency of events is greater than the first threshold, it means that the event provider can provide more events. If the frequency of events exceeds the first threshold, it may indicate that malicious behavior is ongoing. The first threshold can be set according to actual ransomware detection requirements.

[0057] The coverage of the event provider in the layer meets the preset requirements, which means that the event provider needs to have sufficient coverage in the layer to ensure that it can capture ransomware-related events. This may include monitoring key system components, commonly used applications, or sensitive data areas.

[0058] In this implementation, by setting the above-mentioned screening conditions, risk event providers are screened out from event providers at the application layer, operating system layer, and hardware layer, thereby improving the accuracy and efficiency of ransomware detection.

[0059] In the prior art, since the implementation methods of file encryption behavior are distributed at different levels of the computer architecture, the existing detection schemes for ransomware encryption behavior are also hierarchically decentralized, making it difficult to unify the application layer, operating system layer, and hardware layer to achieve a common detection framework design, resulting in difficulty in expanding detection and defense design schemes between different systems.

[0060] In this implementation, risk event providers are screened from event providers at the application layer, operating system layer, and hardware layer. Through multi-level and multi-dimensional monitoring and analysis, an effective, flexible, and adaptable security solution is provided, which improves the comprehensiveness and reliability of ransomware detection.

[0061] Furthermore, after the risk event provider is determined, the event data provided by the risk event provider is collected.

[0062] Step 102: Collect event data provided by risk event providers.

[0063] Specifically, the event data is written to disk in the form of binary ETL files using Windows built-in tools and then processed.

[0064] In addition, in some possible implementations, the above step 102 specifically includes: Interact with risk event providers through application programming interfaces to collect event data provided by risk event providers.

[0065] It is understandable that by interacting with the risk event provider through an application programming interface (API), event data can be collected in real time, which is essential for timely detection and response to ransomware attacks. Further, by interacting with the risk event provider through an application programming interface (API), event data can be collected to ensure that only data related to the risk event is collected, thereby improving the accuracy of ransomware detection. Further, by interacting with the risk event provider through an application programming interface (API), event data can be collected more conveniently and save costs.

[0066] Further, based on the above embodiment, in some possible implementation manners, after the above step 102, the above method further includes: The event data is parsed and structured to obtain event data in JavaScript object notation format; the event data in JavaScript object notation format includes: a file header, attributes of the process to be processed, and attribute values.

[0067] For example, define the parse_event_to_json function, which is used to parse the collected event data and structure the event data into JavaScript Object Notation (JSON) format. The JSON format is easy to read and process, and is convenient for subsequent data analysis and event tracking.

[0068] In practice, the parse_event_to_json function receives parameters of type EVENT_RECORD and type krabs::schema. EVENT_RECORD is a data structure used in Windows API to represent ETW events. It contains detailed information about the event, such as event ID, thread ID, process ID, timestamp, event level, etc. krabs::schema is a class in the Krabs ETW library that is used to parse and access metadata of events. Krabs is a C++ library that provides high-level abstraction and easy-to-use interfaces for ETW events.

[0069] Specifically, the parse_event_to_json function extracts key information of the event, such as event type, attributes, and values, by analyzing the data in the EVENT_RECORD structure. Furthermore, using the information provided by krabs::schema, the function can correctly parse the complex structure of the event, including nested attributes and arrays. Furthermore, the parsed data is organized into a JSON object, where the key corresponds to the attribute of the event and the value corresponds to the data of the attribute. Specifically, the file header contains basic information of the event, such as activity ID, event flag, event name, timestamp, etc.

[0070] For example, an example of a single JavaScript object notation format event data is shown in Table 3.

[0071] Table 3

[0072] In this implementation, the event data is parsed and structured to obtain event data in JavaScript object notation format, which improves the readability, processability and standardization of the event data, facilitates subsequent analysis and processing, and improves the efficiency and accuracy of ransomware detection.

[0073] Step 103: Based on the preset volume shadow copy deletion behavior recognition template, filter and obtain the volume shadow copy deletion event from the event data, and obtain the to-be-processed process corresponding to the volume shadow copy deletion event.

[0074] Among them, the shadow copy deletion behavior identification template is used to filter out events related to system copy deletion from event data, that is, to obtain shadow copy deletion events. In practical applications, based on historical data, shadow copy deletion behaviors in different scenarios are studied. The research shows that although these shadow copy deletion behaviors have great differences in strategy (such as architectural level, components, method implementation, etc.), each deletion method can be classified as an attack mode according to its behavior request.

[0075] Specifically, the specific implementation methods of volume shadow copy deletion include: system native binary abuse, script language object abuse, component object model (COM) object interaction and direct device access. Further, based on these types, the present invention further summarizes four template rules for identifying volume shadow copy deletion behaviors to perform volume shadow copy deletion behavior identification, thereby focusing on suspicious processes related to ransomware, that is, processes to be processed.

[0076] Specifically, in one example, the shadow copy deletion behavior identification templates include: a system native binary abuse identification template, a scripting language object abuse identification template, a component object model object interaction identification template, and a direct device access identification template.

[0077] For example, for the system native binary abuse identification template, the task_name, trace_name header fields and the CommandLine, ImageFileName attribute fields can record obvious traces of command execution. However, the CommandLine attribute field involves the grammatical diversity of command parameters in the user process, and there may be confusion in the form of multiple parameter pairs. To deal with this situation, YARA rules can be defined to capture all deletion operations performed using system native binaries such as vssadmin.exe, wmicshadowcopy, wbadmin.exe, and bcdedit.exe.

[0078] For example, for the scripting language object abuse template, the activity_id, provider_name, trace_name header fields and the ClientMachine, ClientProcessId, GroupOperationId, Operation property fields can record information that forms a specific behavior pattern, for example, (Get-WmiObject, Delete), (Select-FromWin32ShadowCopy, Delete) and (Get-CimInstance, Remove-CimInstance).

[0079] For example, for the COM object interaction identification template, the provider_name, task_name, trace_name header fields and the SysCallAddress attribute field can record access to various system components. If a series of behavior patterns such as (CoInitialize, CreateVssBackupComponents, InitializeForBackup, StartSnapshotSet, Query, DeleteSnapshots, VssFreeSnapshotProperties, CoUninitialize) are detected, it indicates that there is a malicious COM object interaction with the intention of deleting the systemized copy and preventing the system from rolling back.

[0080] For example, the direct device access identification template is constructed (FSCTL_DISMOUNT_VOLU ME, IOCTL_VOLUME_OFFLINE, IOCTL_VOLSNAP_DELETE_ SNAPS- HOT) and (IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE, suspicious Value) is used to detect this type of system copy deletion technique.

[0081] Step 104: Tracing the process to be processed to determine whether the process to be processed is a process related to the ransomware.

[0082] Specifically, the process to be processed is traced and traced to determine whether the process to be processed is a process related to the ransomware. The goal is to determine whether the detected VSC deletion operation is performed by the ransomware or a benign program of the terminal user to avoid false positives.

[0083] As an example, in a possible implementation, the above step 104 includes: Based on the attributes of the process to be processed, cluster analysis is performed on the process to be processed to determine the process group corresponding to the process to be processed; wherein the attributes of the process to be processed include: a unique identification key value of the process, an identifier of the parent process, a unique identifier of the process, an executable file path of the process, a hash value of the memory-mapped file, and a security identifier of the user who starts the process; For each process group, a data structure is created and initialized, the data structure including: an array, an original program mapping, and a process source mapping; wherein the array is used to store the process tracing and tracing results corresponding to each pending process in the process group, and the process tracing and tracing results corresponding to the pending process include: the initiator corresponding to the pending process and whether the pending process is a process unrelated to the ransomware; the original program mapping is used to establish an association relationship between the source identifier of the pending process and the program information of the pending process; the process source mapping is used to establish an association relationship between the identifier of the pending process and the source information of the pending process; According to the original program mapping and process source mapping, the source relationship of each to-be-processed process in the process group is determined; Determine the initiator program corresponding to the process to be processed according to the source relationship of the process to be processed; Determine whether the initiator corresponding to the process to be processed is consistent with the initiator corresponding to the ransomware; if they are consistent, determine that the process to be processed is a process related to the ransomware; otherwise, determine that the process to be processed is a process unrelated to the ransomware; Store the process tracing results corresponding to the process to be processed into an array.

[0084] In reality, many seemingly unrelated processes may originate from the same program entity. Like other types of malware, ransomware uses camouflage strategies, such as self-replication, to conceal its existence and disperse malicious activities into submodules. Analyzing and clustering the actual interaction relationships between these ransomware-related processes can build all the behavioral data to accurately identify suspicious ransomware-related processes in the presence of camouflage strategies.

[0085] Specifically, based on the attributes of the processes to be processed, cluster analysis is performed on the processes to be processed to determine the process groups corresponding to the processes to be processed. Process clustering can be done based on the attributes such as "UniqueProcessKey", "ParentProcessID", "ProcessID", "ImageName", "ImageChecksum" and "UserSID", which are recorded in the event JSON object attribute fields described above. Among them, UserSID is a user security identifier, which is used to determine the user account that triggered the event.

[0086] In practical applications, the processes to be processed can be clustered based on the parent-child relationship between processes, path metrics, and hash values ​​of memory-mapped files to obtain the process groups corresponding to the processes to be processed. Specifically, "UniqueProcessKey", "ParentProcessID", and "ProcessID" refer to the IDs of the processes that execute the triggering deletion monitoring operation. Based on the parent-child relationship, the new processes generated by the program through fork(), execve(), or system() can be preliminarily determined. Further, considering the processes generated by re-executing the same ransomware binary file, the present invention solves this problem by introducing path metrics to compare the exact path of the binary file, i.e., "ImageName". Further, although the re-executed process can be identified by the same binary file path, even after self-deletion, the ransomware can still copy or rename its binary file and change the path for disguise. Therefore, the present invention further considers the hash value of the memory-mapped file, i.e., "ImageChecksum", to combat other camouflage techniques.

[0087] Furthermore, the process source confirmation is performed. Specifically, first, the array P for storing the final result, the original program map OMap, and the process source map PMap are initialized. Among them, the original program map OMap is used to associate each unique source identifier with the corresponding program information. The process source map PMap is used to associate the process identifier (Identity, ID) with its source information, which includes the source ID and the list of related events. Then, a source relationship is created for each process and the event information is updated. Check whether each process already has a source map. If there is no source map, check whether the process is a child process of a known process; if the process is a child process of a known process, it is classified as the source of the parent process; if the process is not a child process of a known process, a new source identifier is created for the process and its program information is recorded. The program information includes the program UserSID, program name, and image checksum. Further, all events are added to the list of related events corresponding to the source. Finally, after all data are aggregated, the initiator of each process is determined. By traversing each origin and calling the "get_final_originator" function to analyze all events associated with it, we can find out which events best represent the core behavior or attributes of the origin, determine the final initiator, and achieve process tracing.

[0088] Further, it is determined whether the initiator corresponding to the process to be processed is consistent with the initiator corresponding to the ransomware; if consistent, the process to be processed is determined to be a process related to the ransomware; otherwise, the process to be processed is determined to be a process unrelated to the ransomware.

[0089] It is understandable that confirming the parent-child relationship between processes and aggregating them can help identify the source processes of all ransomware and avoid underreporting. Through process clustering and source tracing, all ransomware-related processes can be tracked and terminated.

[0090] In this embodiment, by combining process attribute analysis, clustering and source tracing, a comprehensive and efficient ransomware identification and response mechanism is provided, which improves the accuracy and efficiency of ransomware detection and enhances the security and adaptability of the system.

[0091] Step 105: If the process to be processed is a process related to ransomware, then the execution of the process to be processed is stopped.

[0092] Step 106: If the process to be processed is not a process related to the ransomware, continue to execute the process to be processed.

[0093] In actual applications, in the ransomware attack process, deleting the system copy data backup files to prevent system rollback is a step that cannot be skipped or hidden. The ransomware must ensure that the data of the victim host is completely destroyed and cannot be restored by itself, that is, the accessibility and availability of the data are completely lost, so as to force the victim to pay the ransom. Moreover, there is currently no ransomware sample that can bypass the copy deletion step. That is, the system copy deletion behavior is a sign of the existence of ransomware, and it is almost impossible to hide.

[0094] In the ransomware detection method provided in this embodiment, a risk event provider is obtained by screening from all available event providers in the Windows system, and event data provided by the risk event provider is collected; wherein the risk event provider is an event provider related to the shadow copy deletion event; based on the preset shadow copy deletion behavior recognition template, the shadow copy deletion event is screened from the event data, and the pending process corresponding to the shadow copy deletion event is obtained; the pending process is traced and traced to determine whether the pending process is a process related to the ransomware; if so, the pending process is stopped, otherwise, the pending process is continued. The scheme of this implementation monitors the copy deletion event that needs to be executed during the ransomware attack process, and further analyzes whether the process corresponding to the copy deletion event is a process related to the ransomware, and stops the execution of the ransomware-related process in time, which can effectively block the malicious behavior of the ransomware in time during the ransomware attack process, realizes real-time detection and attack interception of the ransomware, and prevents further damage to the user's computer system. Therefore, the scheme of this embodiment improves the efficiency and accuracy of ransomware detection, thereby improving the security and reliability of the computer system.

[0095] In addition, based on the above embodiment, in some possible implementation modes, after the above step 102, the above method further includes: Store event data in a memory buffer; Write event data to log files and refresh them periodically; Before the above step 103, the above method further includes: Get event data from log files.

[0096] In this embodiment, storing event data in a memory buffer can reduce the frequency of direct writing to disk, thereby reducing the impact on system performance. Further, regularly writing event data in batches can reduce the number of disk I / O operations, which can improve system efficiency and disk life. Further, the refresh operation ensures that the event data is physically written to the disk, and even in the event of a system crash or power outage, the written data can be protected from loss, thereby ensuring the integrity of the data. Further, storing event data in a log file facilitates management and maintenance. Further, through batch processing of the memory buffer, the efficiency of data processing can be improved, especially when processing large amounts of data. In summary, storing event data in a memory buffer and then regularly writing and refreshing log files can effectively improve the efficiency and accuracy of ransomware detection, thereby improving the security and reliability of the computer system.

[0097] In addition, based on the above embodiment, in some possible implementation modes, after the above step 103, the above method further includes: Outputs warning signals about volume shadow copy deletion behavior.

[0098] In this implementation, based on a pre-set shadow copy deletion behavior identification template, shadow copy deletion events are screened out from event data, and after obtaining the pending process corresponding to the shadow copy deletion event, a shadow copy deletion behavior warning signal is output, which can prompt the user to pay attention to the shadow copy deletion behavior in a timely manner to perform real-time defense against ransomware attacks, thereby improving the security and reliability of the computer system.

[0099] The ransomware detection device provided by the present invention is described below. The ransomware detection device described below and the ransomware detection method described above can be referred to each other.

[0100] Figure 2 is a schematic diagram of the structure of the ransomware detection device provided by the present invention, such as Figure 2 As shown, the ransomware detection device includes: an event collection module 21, an event screening module 22 and a tracking and tracing module 23.

[0101] The event collection module 21 is used to filter and obtain risk event providers from all available event providers in the Windows system, and collect event data provided by the risk event providers; wherein the risk event providers are event providers related to the volume shadow copy deletion event.

[0102] In actual applications, the Windows system includes multiple available event providers. By detecting all ETW event providers in the Windows system, event providers related to the volume shadow copy deletion event, namely, risk event providers, can be identified. It can be understood that screening and obtaining risk event providers from all available event providers in the Windows system can avoid excessive system load and data noise, while ensuring that necessary event data is not missed.

[0103] Specifically, ETW event providers are divided into two types: manifest-based ETW event providers and TraceLogging-based ETW event providers. Manifest-based ETW event providers require an XML manifest file to declare the structure and properties of events, which allows events to be clearly defined and reused between multiple tools and applications. TraceLogging-based ETW event providers do not require external manifest files, allowing events to be defined directly in the source code, simplifying deployment and maintenance. The present invention takes into account both types of ETW event providers.

[0104] As an example, based on the above embodiments, in some possible implementations, the above Windows system includes an application layer, an operating system layer and a hardware layer; wherein the event providers of the application layer include user processes, the event providers of the operating system layer include file systems and drivers, and the event providers of the hardware layer include device controllers.

[0105] By way of example, when the above-mentioned event collection module 21 is used to filter and obtain risk event providers from all available event providers in the Windows system, it is specifically used to: filter event providers that meet the filtering conditions from the event providers of the application layer, the operating system layer and the hardware layer as risk event providers; wherein the filtering conditions include: the event type in the event data provided by the event provider includes at least one of the following: volume shadow copy service interaction, new process startup or execution, file input and output, disk input and output; the frequency of event occurrence is greater than a first threshold; the coverage range of the event provider in the layer in which it is located meets the preset requirements.

[0106] Among them, Volume Shadow Copy Service Interaction (VSS) involves events related to system backup operations. New process startup or execution may indicate that ransomware is spreading or executing its malicious code. File input and output involving a large number of file operations, especially encryption or deletion operations, may be a sign of ransomware activity. Disk input and output may be related to ransomware encryption or destruction of data.

[0107] In actual applications, if the frequency of events is greater than the first threshold, it means that the event provider can provide more events. If the frequency of events exceeds the first threshold, it may indicate that malicious behavior is ongoing. The first threshold can be set according to actual ransomware detection requirements.

[0108] The coverage of the event provider in the layer meets the preset requirements, which means that the event provider needs to have sufficient coverage in the layer to ensure that it can capture ransomware-related events. This may include monitoring key system components, commonly used applications, or sensitive data areas.

[0109] In this implementation, the event collection module 21 filters out risk event providers from event providers at the application layer, operating system layer, and hardware layer by setting the above-mentioned filtering conditions, thereby improving the accuracy and efficiency of ransomware detection.

[0110] In this embodiment, the event collection module 21 screens risk event providers from event providers at the application layer, operating system layer, and hardware layer, and provides an effective, flexible, and adaptable security solution through multi-level and multi-dimensional monitoring and analysis, thereby improving the comprehensiveness and reliability of ransomware detection.

[0111] Furthermore, after determining the risk event provider, the event collection module 21 collects the event data provided by the risk event provider.

[0112] Specifically, the event collection module 21 is used to collect event data provided by risk event providers, and is specifically used to: use Windows built-in tools to write the event data into a disk in the form of a binary ETL file, and then process it.

[0113] In addition, in some possible implementations, the event collection module 21 is used to collect event data provided by risk event providers, specifically for: Interact with risk event providers through application programming interfaces to collect event data provided by risk event providers.

[0114] It is understandable that by interacting with the risk event provider through an application programming interface (API), event data can be collected in real time, which is essential for timely detection and response to ransomware attacks. Further, by interacting with the risk event provider through an application programming interface (API), event data can be collected to ensure that only data related to the risk event is collected, thereby improving the accuracy of ransomware detection. Further, by interacting with the risk event provider through an application programming interface (API), event data can be collected more conveniently and save costs.

[0115] Furthermore, based on the above embodiments, in some possible implementations, the above device also includes: a structuring module; the structuring module is used to parse and structure the event data to obtain JavaScript object notation format event data; JavaScript object notation format event data includes: a file header, attributes of the process to be processed, and attribute values.

[0116] In this implementation, the event data is parsed and structured to obtain event data in JavaScript object notation format, which improves the readability, processability and standardization of the event data, facilitates subsequent analysis and processing, and improves the efficiency and accuracy of ransomware detection.

[0117] Combination Figure 2 The event screening module 22 is used to screen and obtain the shadow copy deletion event from the event data based on the preset shadow copy deletion behavior identification template, and obtain the to-be-processed process corresponding to the shadow copy deletion event.

[0118] Among them, the shadow copy deletion behavior identification template is used to filter out events related to system copy deletion from event data, that is, to obtain shadow copy deletion events. In practical applications, based on historical data, shadow copy deletion behaviors in different scenarios are studied. The research shows that although these shadow copy deletion behaviors have great differences in strategy (such as architectural level, components, method implementation, etc.), each deletion method can be classified as an attack mode according to its behavior request.

[0119] Specifically, the specific implementation methods of volume shadow copy deletion include: system native binary abuse, script language object abuse, component object model (COM) object interaction and direct device access. Further, based on these types, the present invention further summarizes four template rules for identifying volume shadow copy deletion behaviors to perform volume shadow copy deletion behavior identification, thereby focusing on suspicious processes related to ransomware, that is, processes to be processed.

[0120] Specifically, in one example, the shadow copy deletion behavior identification templates include: a system native binary abuse identification template, a scripting language object abuse identification template, a component object model object interaction identification template, and a direct device access identification template.

[0121] Combination Figure 2 The tracing module 23 is used to trace the process to be processed and determine whether the process to be processed is a process related to the ransomware; if the process to be processed is a process related to the ransomware, the execution of the process to be processed is stopped; if the process to be processed is not a process related to the ransomware, the execution of the process to be processed continues.

[0122] Specifically, the process to be processed is traced and traced to determine whether the process to be processed is a process related to the ransomware. The goal is to determine whether the detected VSC deletion operation is performed by the ransomware or a benign program of the terminal user to avoid false positives.

[0123] As an example, in a possible implementation, the tracking and tracing module 23 is used to track and trace the process to be processed, and when determining whether the process to be processed is a process related to ransomware, it is specifically used to: Based on the attributes of the process to be processed, cluster analysis is performed on the process to be processed to determine the process group corresponding to the process to be processed; wherein the attributes of the process to be processed include: a unique identification key value of the process, an identifier of the parent process, a unique identifier of the process, an executable file path of the process, a hash value of the memory-mapped file, and a security identifier of the user who starts the process; For each process group, a data structure is created and initialized, the data structure including: an array, an original program mapping, and a process source mapping; wherein the array is used to store the process tracing and tracing results corresponding to each pending process in the process group, and the process tracing and tracing results corresponding to the pending process include: the initiator corresponding to the pending process and whether the pending process is a process unrelated to the ransomware; the original program mapping is used to establish an association relationship between the source identifier of the pending process and the program information of the pending process; the process source mapping is used to establish an association relationship between the identifier of the pending process and the source information of the pending process; According to the original program mapping and process source mapping, the source relationship of each to-be-processed process in the process group is determined; Determine the initiator program corresponding to the process to be processed according to the source relationship of the process to be processed; Determine whether the initiator corresponding to the process to be processed is consistent with the initiator corresponding to the ransomware; if they are consistent, determine that the process to be processed is a process related to the ransomware; otherwise, determine that the process to be processed is a process unrelated to the ransomware; Store the process tracing results corresponding to the process to be processed into an array.

[0124] Specifically, based on the attributes of the processes to be processed, cluster analysis is performed on the processes to be processed to determine the process groups corresponding to the processes to be processed. Process clustering can be done based on the attributes such as "UniqueProcessKey", "ParentProcessID", "ProcessID", "ImageName", "ImageChecksum" and "UserSID", which are recorded in the event JSON object attribute fields described above. Among them, UserSID is a user security identifier, which is used to determine the user account that triggered the event.

[0125] In practical applications, the processes to be processed can be clustered based on the parent-child relationship between processes, path metrics, and hash values ​​of memory-mapped files to obtain the process groups corresponding to the processes to be processed. Specifically, "UniqueProcessKey", "ParentProcessID", and "ProcessID" refer to the IDs of the processes that execute the triggering deletion monitoring operation. Based on the parent-child relationship, the new processes generated by the program through fork(), execve(), or system() can be preliminarily determined. Further, considering the processes generated by re-executing the same ransomware binary file, the present invention solves this problem by introducing path metrics to compare the exact path of the binary file, i.e., "ImageName". Further, although the re-executed process can be identified by the same binary file path, even after self-deletion, the ransomware can still copy or rename its binary file and change the path for disguise. Therefore, the present invention further considers the hash value of the memory-mapped file, i.e., "ImageChecksum", to combat other camouflage techniques.

[0126] Furthermore, the process source confirmation is performed. Specifically, first, the array P for storing the final result, the original program map OMap, and the process source map PMap are initialized. Among them, the original program map OMap is used to associate each unique source identifier with the corresponding program information. The process source map PMap is used to associate the process identifier (Identity, ID) with its source information, which includes the source ID and the list of related events. Then, a source relationship is created for each process and the event information is updated. Check whether each process already has a source map. If there is no source map, check whether the process is a child process of a known process; if the process is a child process of a known process, it is classified as the source of the parent process; if the process is not a child process of a known process, a new source identifier is created for the process and its program information is recorded. The program information includes the program UserSID, program name, and image checksum. Further, all events are added to the list of related events corresponding to the source. Finally, after all data are aggregated, the initiator of each process is determined. By traversing each origin and calling the "get_final_originator" function to analyze all events associated with it, we can find out which events best represent the core behavior or attributes of the origin, determine the final initiator, and achieve process tracing.

[0127] Further, it is determined whether the initiator corresponding to the process to be processed is consistent with the initiator corresponding to the ransomware; if consistent, the process to be processed is determined to be a process related to the ransomware; otherwise, the process to be processed is determined to be a process unrelated to the ransomware.

[0128] It is understandable that confirming the parent-child relationship between processes and aggregating them can help identify the source processes of all ransomware and avoid underreporting. Through process clustering and source tracing, all ransomware-related processes can be tracked and terminated.

[0129] In this embodiment, by combining process attribute analysis, clustering and source tracing, a comprehensive and efficient ransomware identification and response mechanism is provided, which improves the accuracy and efficiency of ransomware detection and enhances the security and adaptability of the system.

[0130] In actual applications, in the ransomware attack process, deleting the system copy data backup files to prevent system rollback is a step that cannot be skipped or hidden. The ransomware must ensure that the data of the victim host is completely destroyed and cannot be restored by itself, that is, the accessibility and availability of the data are completely lost, so as to force the victim to pay the ransom. Moreover, there is currently no ransomware sample that can bypass the copy deletion step. That is, the system copy deletion behavior is a sign of the existence of ransomware, and it is almost impossible to hide.

[0131] The scheme of this implementation monitors the copy deletion events that need to be executed during the ransomware attack process, and further analyzes whether the process corresponding to the copy deletion event is a ransomware-related process, and promptly stops the execution of the ransomware-related process, which can effectively block the malicious behavior of the ransomware in a timely manner during the ransomware attack process, realizes real-time detection and attack interception of the ransomware, and prevents further damage to the user's computer system. Therefore, the scheme of this embodiment improves the efficiency and accuracy of ransomware detection, thereby improving the security and reliability of the computer system.

[0132] In addition, based on the above embodiments, in some possible implementations, the above device further includes: a cache module; A cache module is used to store event data in a memory buffer; periodically write event data to a log file and refresh it; The event screening module 22 is also used for: Get event data from log files.

[0133] In this embodiment, storing event data in a memory buffer can reduce the frequency of direct writing to disk, thereby reducing the impact on system performance. Further, regularly writing event data in batches can reduce the number of disk I / O operations, which can improve system efficiency and disk life. Further, the refresh operation ensures that the event data is physically written to the disk, and even in the event of a system crash or power outage, the written data can be protected from loss, thereby ensuring the integrity of the data. Further, storing event data in a log file facilitates management and maintenance. Further, through batch processing of the memory buffer, the efficiency of data processing can be improved, especially when processing large amounts of data. In summary, storing event data in a memory buffer and then regularly writing and refreshing log files can effectively improve the efficiency and accuracy of ransomware detection, thereby improving the security and reliability of the computer system.

[0134] In addition, based on the above embodiment, in some possible implementations, the above device further includes: The output module is used to output a warning signal of volume shadow copy deletion behavior.

[0135] In this implementation, based on a pre-set shadow copy deletion behavior identification template, shadow copy deletion events are screened out from event data, and after obtaining the pending process corresponding to the shadow copy deletion event, a shadow copy deletion behavior warning signal is output, which can prompt the user to pay attention to the shadow copy deletion behavior in a timely manner to perform real-time defense against ransomware attacks, thereby improving the security and reliability of the computer system.

[0136] In the ransomware detection device provided by this embodiment, the event collection module screens and obtains risk event providers from all available event providers in the Windows system, and collects event data provided by the risk event providers; wherein the risk event provider is an event provider related to the shadow copy deletion event; the event screening module screens and obtains the shadow copy deletion event from the event data based on the preset shadow copy deletion behavior recognition template, and obtains the pending process corresponding to the shadow copy deletion event; the tracing and tracing module performs process tracing and tracing on the pending process to determine whether the pending process is a process related to the ransomware; if so, the pending process is stopped, otherwise, the pending process is continued. The scheme of this implementation, by monitoring the copy deletion event that needs to be executed during the ransomware attack process, and further analyzing whether the process corresponding to the copy deletion event is a process related to the ransomware, the execution of the ransomware-related process is stopped in time, and the malicious behavior of the ransomware can be effectively blocked in time during the ransomware attack process, and the real-time detection and attack interception of the ransomware are realized, so as to prevent further damage to the user's computer system. Therefore, the scheme of this embodiment improves the efficiency and accuracy of ransomware detection, thereby improving the security and reliability of the computer system.

[0137] Figure 3 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the ransomware detection method, which includes: filtering and obtaining a risk event provider from all available event providers in the Windows system, and collecting event data provided by the risk event provider; wherein the risk event provider is an event provider related to the shadow copy deletion event; based on a preset shadow copy deletion behavior recognition template, filtering and obtaining the shadow copy deletion event from the event data, and obtaining the pending process corresponding to the shadow copy deletion event; tracing and tracing the pending process to determine whether the pending process is a process related to the ransomware; if so, stopping the execution of the pending process, otherwise, continuing the execution of the pending process.

[0138] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0139] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the ransomware detection method provided by the above methods, which includes: screening and obtaining risk event providers from all available event providers in the Windows system, and collecting event data provided by the risk event providers; wherein the risk event provider is an event provider related to a shadow copy deletion event; based on a preset shadow copy deletion behavior recognition template, screening and obtaining a shadow copy deletion event from the event data, and obtaining a pending process corresponding to the shadow copy deletion event; tracing and tracing the pending process to determine whether the pending process is a process related to the ransomware; if so, stopping the execution of the pending process, otherwise, continuing the execution of the pending process.

[0140] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the ransomware detection method provided by the above-mentioned methods, the method comprising: screening and obtaining risk event providers from all available event providers in a Windows system, and collecting event data provided by the risk event providers; wherein the risk event providers are event providers related to shadow copy deletion events; based on a preset shadow copy deletion behavior recognition template, screening and obtaining shadow copy deletion events from event data, and obtaining pending processes corresponding to the shadow copy deletion events; tracing and tracing the pending processes to determine whether the pending processes are processes related to ransomware; if so, stopping execution of the pending processes, otherwise, continuing execution of the pending processes.

[0141] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0142] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A ransomware detection method, characterized in that: include: Screening and obtaining a risk event provider from all available event providers in the Windows system, and collecting event data provided by the risk event provider; wherein the risk event provider is an event provider related to a volume shadow copy deletion event; Based on a preset volume shadow copy deletion behavior recognition template, filter and obtain a volume shadow copy deletion event from the event data, and obtain a to-be-processed process corresponding to the volume shadow copy deletion event; The process to be processed is traced and traced to its source to determine whether the process to be processed is a process related to the ransomware; if so, the execution of the process to be processed is stopped; otherwise, the execution of the process to be processed is continued.

2. The ransomware detection method according to claim 1, characterized in that: The Windows system includes an application layer, an operating system layer and a hardware layer; The risk event providers are obtained by screening all available event providers in the Windows system, including: Event providers that meet the screening conditions are screened from the event providers of the application layer, the operating system layer and the hardware layer as the risk event providers; wherein the screening conditions include: the event type in the event data provided by the event provider includes at least one of the following: volume shadow copy service interaction, new process startup or execution, file input and output, disk input and output; the frequency of event occurrence is greater than a first threshold; the coverage of the event provider in the layer it is in meets the preset requirements.

3. The ransomware detection method according to claim 1, characterized in that: After collecting the event data provided by the risk event provider, the method further includes: The event data is parsed and structured to obtain event data in JavaScript object notation format; the event data in JavaScript object notation format includes: a file header, attributes of the process to be processed, and attribute values.

4. The ransomware detection method according to claim 3, characterized in that: The tracing the process to be processed to determine whether the process to be processed is a process related to the ransomware includes: Based on the attributes of the process to be processed, cluster analysis is performed on the process to be processed to determine the process group corresponding to the process to be processed; wherein the attributes of the process to be processed include: a unique identification key value of the process, an identifier of a parent process, a unique identifier of the process, an executable file path of the process, a hash value of a memory-mapped file, and a security identifier of a user who starts the process; For each process group, a data structure is created and initialized, the data structure including: an array, an original program mapping, and a process source mapping; wherein the array is used to store the process tracing and tracing results corresponding to each pending process in the process group, and the process tracing and tracing results corresponding to the pending process include: the initiator corresponding to the pending process and whether the pending process is a process unrelated to the ransomware; the original program mapping is used to establish an association relationship between the source identifier of the pending process and the program information of the pending process; the process source mapping is used to establish an association relationship between the identifier of the pending process and the source information of the pending process; Determining the source relationship of each of the to-be-processed processes in the process group according to the original program mapping and the process source mapping; Determining, according to the source relationship of the process to be processed, an initiator corresponding to the process to be processed; Determine whether the initiator corresponding to the process to be processed is consistent with the initiator corresponding to the ransomware; if they are consistent, determine that the process to be processed is a process related to the ransomware; otherwise, determine that the process to be processed is a process unrelated to the ransomware; The process tracing result corresponding to the process to be processed is stored in the array.

5. The ransomware detection method according to any one of claims 1 to 4, characterized in that: The collecting of event data provided by the risk event provider specifically includes: Interact with the risk event provider via an application programming interface to collect event data provided by the risk event provider.

6. The ransomware detection method according to any one of claims 1 to 4, characterized in that: The volume shadow copy deletion behavior identification template includes: a system native binary abuse identification template, a script language object abuse identification template, a component object model object interaction identification template and a direct device access identification template.

7. A ransomware detection device, characterized in that: include: An event collection module, used for screening and obtaining risk event providers from all available event providers in the Windows system, and collecting event data provided by the risk event providers; wherein the risk event providers are event providers related to volume shadow copy deletion events; An event screening module, for screening and obtaining a volume shadow copy deletion event from the event data based on a preset volume shadow copy deletion behavior recognition template, and obtaining a to-be-processed process corresponding to the volume shadow copy deletion event; The tracing module is used to trace the process to be processed to determine whether the process to be processed is a process related to the ransomware; if so, stop executing the process to be processed; otherwise, continue executing the process to be processed.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the ransomware detection method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the ransomware detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the ransomware detection method according to any one of claims 1 to 6 is implemented.

Images