A double-layered ransomware defense method combining decoy file monitoring and token verification

Abstract

The present invention discloses a double-layer defense method for ransomware that combines bait file monitoring and token verification, and belongs to the field of network security. First, a double-layer defense mechanism for ransomware is constructed in which a user-mode module and a kernel-mode module work together. The user-mode module generates a whitelist of bait files and tokens, and transmits them to the kernel-mode module. Then, the bait file monitoring module determines whether the target file of the ransomware is a bait file. If it is a bait file, the bait file monitoring module directly blocks the malicious behavior and feeds back to the user-mode module. If the ransomware attempts to directly encrypt a real user file, the bait file monitoring module passes the operation request to the dynamic token verification module for in-depth verification, and feeds back the processing result to the user-mode module. Finally, the malicious process disposal module executes the termination and isolation strategy for the malicious process. The present invention comprehensively covers all types of ransomware behaviors, reduces the false alarm rate, and improves the real-time and effectiveness of defense.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically refers to a double-layer defense method for ransomware that combines bait file monitoring and token verification. Background Art

[0002] Ransomware attacks are becoming increasingly sophisticated. They leverage polymorphic techniques to dynamically change signatures, rendering traditional detection methods based on static signature matching ineffective and circumventing security systems. Furthermore, they employ highly efficient encryption algorithms to encrypt or destroy large numbers of files in a short period of time, making it difficult for users to protect their data even with backup and recovery mechanisms. Advanced ransomware further conceals its activities by disguising itself as legitimate processes or employing techniques such as code injection and privilege escalation, thereby bypassing traditional defenses. In particular, some advanced ransomware can exploit network vulnerabilities to achieve lateral movement, rapidly spreading from a single point of infection to the entire network.

[0003] The main defense methods against ransomware currently include single-layer defense mechanisms based on signature matching, behavior pattern analysis, backup and recovery, and decoy files:

[0004] (1) The signature matching method relies on a signature library generated by known ransomware samples. The system uses security software or scanning programs to match signatures in file operation requests to identify ransomware. This method is ineffective for ransomware with unknown variants or packed technologies. Moreover, as the size of the signature library increases, the detection efficiency decreases. At the same time, insufficient matching accuracy may lead to a high false alarm rate, which can easily affect the normal operation of the system.

[0005] (2) The method based on behavioral pattern analysis is to detect ransomware behavior by analyzing file operation patterns (such as frequent encryption and modification) and blocking the attack process. However, this method lacks fine-grained behavioral verification and is prone to false positives for normal operations. For ransomware disguised as legitimate processes or injected into legitimate processes through code, behavioral pattern analysis is difficult to effectively identify.

[0006] (3) The backup and recovery mechanism cannot prevent attacks, but can only reduce the risk of data loss. The recovery process may cause business interruption. Ransomware uses efficient encryption technology to quickly destroy data, and even with backups, it is difficult to restore in time, especially in high-intensity attacks.

[0007] (4) The single-layer defense method based on decoy files pre-deploys decoy files that simulate real user data in the file system to capture direct operations on the decoy files, such as reading, writing, and deleting. However, the defense capability is insufficient for advanced ransomware that bypasses the decoy files and directly encrypts real files. When the location of the decoy file generation and deployment is not precise enough and the monitoring granularity is coarse, normal processes may accidentally touch the decoy files, resulting in false alarms.

[0008] To address these issues, a comprehensive ransomware defense solution is urgently needed. It can detect and block malicious activity in the early stages of a ransomware attack, reducing the risk of data loss. It can also effectively identify advanced attack methods such as camouflaged processes and code injection, minimizing the impact of false positives on normal business operations. Summary of the Invention

[0009] In response to the shortcomings and deficiencies of existing technologies such as insufficient coverage of ransomware, weak anti-evasion capabilities, high false alarm rates, and poor real-time performance, the present invention proposes a two-layer ransomware defense method that combines bait file monitoring and token verification, achieving full process coverage from early ransomware attack capture to deep attack defense, providing a technical solution for ransomware defense that is efficient, accurate, has low false alarm rates, and has strong anti-evasion capabilities.

[0010] A two-layered ransomware defense method that combines decoy file monitoring and token verification. The specific steps are as follows:

[0011] Step 1: Build a two-layer ransomware defense mechanism that uses user-mode and kernel-mode modules to work together.

[0012] The user-mode module includes a bait file generation and deployment module, a token collection module, and a malicious process disposal module.

[0013] The kernel mode module includes a bait file monitoring module and a dynamic token verification module.

[0014] Step 2: The user-mode module generates a decoy file and a token whitelist, and transmits them to the kernel-mode module;

[0015] The bait file is: the bait file generation and deployment module in the user state module dynamically generates the bait file and deploys it to the key directory of the system (such as the user document directory); the bait file path list is sent to the bait file monitoring module in the kernel state through a trusted channel, so that it can monitor the operation of the ransomware process on the bait file in real time.

[0016] The token whitelist is: the token collection module runs the whitelist program in a trusted environment, extracts its legal behavior features (such as API call path, call stack, etc.), generates a token whitelist, and sends it to the dynamic token verification module in the kernel state.

[0017] Step 3: When the ransomware attempts to encrypt or destroy the target file through file operations, the bait file monitoring module determines whether the target file is a bait file. If so, execute step 4; otherwise, execute step 5;

[0018] The above process is specifically as follows:

[0019] First, the ransomware process initiates a file write or delete operation request in user mode, attempting to encrypt the target file.

[0020] Then, the kernel-mode decoy file monitoring module, based on the MiniFilter driver, intercepts all IRP requests for file write and delete operations in real time.

[0021] Finally, the bait file monitoring module determines whether the target file of the ransomware process is a bait file.

[0022] In step 4, the ransomware attempts to operate the bait file. The bait file monitoring module captures the file operation request, blocks the malicious behavior, and feeds back to the user mode module.

[0023] The decoy file monitoring module blocks the ransomware process by:

[0024] First, the current operation is blocked to prevent the ransomware from further encrypting or damaging files. Then, the triggering process is suspended and its detailed information, such as process ID and process path, is collected. Finally, the collected information is fed back to the user-mode module through a trusted channel.

[0025] In step five, the ransomware attempts to circumvent the decoy file and directly encrypt the real user files. At this time, the decoy file monitoring module passes the operation request to the dynamic token verification module for in-depth verification. By accurately identifying dynamic behavior characteristics, it promptly blocks abnormal operations and feeds back the processing results to the user state module.

[0026] The dynamic token verification module performs in-depth verification as follows:

[0027] First, the dynamic token verification module extracts the call context of the operation request (such as API call path, call stack, and call parameters) and generates a dynamic token based on the call context to describe the characteristics of the current operation behavior.

[0028] Then, the dynamic token verification module compares the dynamic token with the token whitelist and identifies abnormal operations based on the comparison results;

[0029] The comparison results are: if the comparison result is a successful match, it indicates that the operation request is legal and the request is allowed to pass; if the comparison result is a failed match, the current operation is blocked, the process is suspended, and the abnormal information is fed back to the user state module, and the encrypted file is restored at the same time.

[0030] Step 6: The malicious process handling module in the user mode module executes the termination and isolation strategy for the malicious process.

[0031] The processing process of the malicious process processing module is as follows:

[0032] First, receive feedback information: The user-mode module receives malicious process information fed back by the kernel mode, including key data such as process ID and process path.

[0033] Then, execute the disposal strategy, including:

[0034] Terminate malicious processes: Immediately shut down malicious processes to block subsequent attacks.

[0035] Network isolation: Disconnect the network connection of the host where the triggering process is located to prevent the lateral spread of ransomware.

[0036] Recording and Alerting: Generates detailed attack logs, including the triggering process's operation time, target file and path, and other information, and notifies administrators of relevant information in real time through an alert mechanism.

[0037] The advantages and beneficial effects of the present invention are:

[0038] (1) The present invention introduces a dynamic token verification mechanism. On the basis of capturing early attacks (such as bait file operations) by the bait file monitoring module, it further defends against bypass attacks, solves the problem of insufficient coverage of existing bait file methods, and comprehensively covers various behaviors of ransomware.

[0039] (2) The present invention generates a credential whitelist by extracting the dynamic behavioral characteristics of whitelist programs in a trusted environment, and combines it with the dynamic credential verification driver in the kernel state to accurately verify the legitimacy of file operations, thereby effectively defending against camouflage and code injection attacks and significantly improving the anti-circumvention capability.

[0040] (3) The present invention uses dynamic token generation and comparison technology, combined with file operation context information to perform fine-grained verification, and only monitors write and delete operations, avoiding the performance overhead caused by comprehensive monitoring, significantly reducing the false alarm rate, and reducing interference with the normal operation of the system, ensuring smooth operation in complex business scenarios.

[0041] (4) The present invention utilizes the kernel-mode MiniFilter driver to capture file operation requests in real time, and combines it with a two-layer defense mechanism (decoy file monitoring and dynamic token verification) to achieve rapid detection and blocking, effectively preventing ransomware from completing attacks before executing destructive operations. Compared with existing methods that rely on user-mode monitoring, the present invention significantly improves the real-time nature of defense, flexibly adapts to different business scenarios, and meets actual deployment requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of the double-layered ransomware defense architecture that combines decoy file monitoring and token verification.

[0043] Figure 2This is a schematic diagram of the defense process when the target of ransomware in Example 1 is a bait file;

[0044] Figure 3 This is a schematic diagram of the defense process when the target of ransomware in Example 2 is a real file. DETAILED DESCRIPTION

[0045] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0046] The present invention is based on a double-layer defense mechanism, in which the user-mode module and the kernel-mode module work together. The double-layer defense system architecture of ransomware is as follows: Figure 1 As shown, the implementation process of the technical solution of the present invention is divided into the workflow of the user state module, the workflow of the kernel state module, and the collaborative work of the user state and kernel state, which are as follows:

[0047] Step 1: Build a two-layer ransomware defense mechanism that uses user-mode and kernel-mode modules to work together.

[0048] The user-mode module includes a bait file generation and deployment module, a token collection module, and a malicious process disposal module.

[0049] The kernel mode module includes a bait file monitoring module and a dynamic token verification module.

[0050] Step 2: The user-mode module generates a decoy file and a token whitelist, and transmits them to the kernel-mode module;

[0051] The decoy file is: the decoy file generation and deployment module in the user mode module dynamically generates the decoy file and deploys it to the system's key directory (such as the user document directory); the decoy file path list is sent to the decoy file monitoring module in the kernel mode through a trusted channel, so that it can monitor the ransomware process's operation on the decoy file in real time. The specific process is as follows:

[0052]

[0053] The token whitelist is: the token collection module runs the whitelist program in a trusted environment, extracts its legal behavior features (such as API call path, call stack, etc.), generates a token whitelist, and sends it to the dynamic token verification module in the kernel state.

[0054] The specific process is:

[0055] Token generation:

[0056] The user-state token collection module collects the legal behavior characteristics of whitelisted programs (such as API call paths, call stacks, etc.) and generates tokens.

[0057]

[0058] Token whitelist maintenance and sending:

[0059] After generating the token whitelist, the user state module sends the token whitelist to the dynamic token verification module of the kernel layer.

[0060]

[0061] The user-mode module and the kernel-mode module communicate through the MiniFilter communication interface, and the MiniFilter framework uses FltSendMessage and FltReceiveMessage for message transmission.

[0062] Define a structure to pass process information and tokens:

[0063]

[0064]

[0065] Step 3: When the ransomware attempts to encrypt or destroy the target file through file operations, the bait file monitoring module determines whether the target file is a bait file. If so, execute step 4; otherwise, execute step 5;

[0066] The above process is specifically as follows:

[0067] First, the ransomware process initiates file write or delete operation requests in user mode, attempting to directly encrypt real user files.

[0068] Then, the kernel-mode decoy file monitoring module, based on the MiniFilter driver, intercepts all IRP requests for file write and delete operations in real time to avoid interfering with normal file access.

[0069] Finally, the bait file monitoring module determines whether the target file of the ransomware process is a bait file.

[0070] The specific logical steps are as follows:

[0071] Capture write and delete IRP requests from all processes; use the MiniFilter driver to intercept all file operations (such as write, delete, etc.) and check whether the target file of the IRP is a bait file.

[0072]

[0073]

[0074] In step 4, the ransomware attempts to operate the bait file. The bait file monitoring module captures the file operation request, blocks the malicious behavior, and feeds back to the user mode module.

[0075] The decoy file monitoring module blocks the ransomware process by:

[0076] First, the current operation is blocked to prevent the ransomware from further encrypting or damaging files. Then, the triggering process is suspended and its detailed information, such as process ID and process path, is collected. Finally, the collected information is fed back to the user-mode module through a trusted channel.

[0077] Process information extraction and transfer to user mode:

[0078] When the target file is determined to be a bait file, the process information (such as process ID, path, etc.) in the IRP packet is extracted and passed to the malicious process disposal module in the user state through the communication interface of MiniFilter.

[0079]

[0080]

[0081] In step five, the ransomware attempts to circumvent the decoy file and directly encrypt the real user files. At this time, the decoy file monitoring module passes the operation request to the dynamic token verification module for in-depth verification. By accurately identifying dynamic behavior characteristics, it promptly blocks abnormal operations and feeds back the processing results to the user state module.

[0082] The dynamic token verification module performs in-depth verification as follows:

[0083] First, the dynamic token verification module intercepts the ransomware's operations on real files, extracts the call context of the operation request (such as API call path, call stack, and call parameters), and generates a dynamic token based on the call context to describe the characteristics of the current operation behavior.

[0084] Then, the dynamic token verification module compares the dynamic token with the token whitelist and identifies abnormal operations based on the comparison results, effectively defending against masquerade attacks and code injection attacks;

[0085] The comparison results are: if the comparison result is a successful match, it indicates that the operation request is legal and the request is allowed to pass; if the comparison result is a failed match, the current operation is blocked, the process is suspended, and the abnormal information is fed back to the user state module, and the encrypted file is restored at the same time.

[0086] Recover encrypted files: The system uses memory snapshots and key extraction technology to recover encrypted files, minimizing data loss.

[0087] The dynamic token verification module generates tokens in real time and compares them with the whitelist to accurately identify malicious behavior, block advanced disguises, code injections and dynamic variant attacks, significantly reduce false alarm rates, and provide a highly reliable and user-friendly defense experience.

[0088] Context analysis and dynamic verification mechanisms significantly enhance the system's anti-circumvention capabilities and overcome the limitations of traditional feature-based detection methods.

[0089] Dynamic token verification module:

[0090] If the target file is not a decoy file, the dynamic token verification module is called to further verify the IRP request. The generation and comparison of the token will be implemented in the dynamic token verification module.

[0091]

[0092]

[0093] Token generation and verification:

[0094] At the kernel layer, the dynamic token verification module generates dynamic tokens by extracting the calling context of file operations and compares them with the whitelist.

[0095]

[0096] Step 6: The malicious process handling module in the user mode module executes the termination and isolation strategy for the malicious process.

[0097] The processing process of the malicious process processing module is as follows:

[0098] First, receive feedback information: The user-mode module receives malicious process information fed back by the kernel mode, including key data such as process ID and process path.

[0099] Then, execute the disposal strategy, including:

[0100] Terminate malicious processes: Immediately shut down malicious processes to block subsequent attacks.

[0101] Network isolation: Disconnect the network connection of the host where the triggering process is located to prevent the lateral spread of ransomware.

[0102] Recording and Alerting: Generates detailed attack logs, including the triggering process's operation time, target file and path, and other information, and notifies administrators of relevant information in real time through an alert mechanism.

[0103] The ransomware defense system of the present invention adopts a two-layer defense architecture. The bait file monitoring module and the dynamic token verification module are both independent and able to work together. The bait file monitoring module can run alone to quickly capture the initial attack behavior of ransomware, meet basic security requirements, and is suitable for system environments with limited resources. As an advanced security option, the dynamic token verification module further verifies the operation of non-bait files in depth, defends against bypass attacks, and ensures the system's full-process capabilities from initial detection to deep protection. It can be enabled for complex attack scenarios, provides higher security guarantees, and is suitable for sensitive data protection needs. At the same time, the two modules are seamlessly connected through the collaboration of user mode and kernel mode. The bait file monitoring module quickly detects early behavior and feeds back to the user mode module.

[0104] Furthermore, in the current technical solution, the present invention can implement both the decoy file monitoring module and the dynamic token verification module in kernel mode. To further optimize kernel mode complexity, some responsibilities can be adjusted to user mode:

[0105] The generation of dynamic tokens is completed in user mode, and the kernel mode is only responsible for verification operations.

[0106] The user-mode module maintains the dynamic update and optimization of the token whitelist to reduce the management overhead of the kernel mode.

[0107] This alternative solution simplifies kernel-mode module logic, reduces kernel-mode logic complexity, improves system stability and maintainability, and increases user-mode expansion flexibility, making it easier to adjust the token mechanism.

[0108] The dynamic token verification module can be replaced with a method based on behavioral pattern analysis, which performs dynamic detection by monitoring the write operation frequency, encryption behavior and other characteristics of the process. For example:

[0109] Analyze the writing and modification behavior of consecutive files.

[0110] Detect bulk encryption of specific file types.

[0111] It is more valuable to implement in some lightweight application scenarios, does not rely on the token mechanism, simplifies module design, and provides universal defense based on behavioral patterns.

[0112] File operation capture in kernel-mode modules can be implemented using Event Tracing for Windows (ETW), replacing the existing MiniFilter driver mechanism. ETW provides lightweight system event tracing capabilities for capturing file write and delete operations. ETW's implementation is simpler, reducing development complexity and offering a low-cost alternative for file operation monitoring.

[0113] Hardware-level file access control (such as a TPM module) is introduced during file operations to authenticate write operations. Dynamic token verification can be combined with hardware security mechanisms to achieve a higher level of security. This is suitable for scenarios with extremely high security requirements, such as enterprise-level storage devices or cloud servers, providing hardware-enhanced anti-circumvention capabilities and improving overall system security.

[0114] Example 1

[0115] The process of this embodiment is as follows Figure 2 The figure below illustrates the process from user mode to kernel mode when the ransomware attempts to encrypt a decoy file, as well as the interactions between the various modules. First, the kernel-mode decoy file monitoring module captures file operation requests, blocks malicious activity, and reports back to the user mode. The user-mode malicious process handling module then executes the termination and isolation policy for the malicious process.

[0116] Assume the system has successfully generated and deployed a decoy file to a critical directory. At this point, the ransomware attempts to encrypt or destroy the decoy file through file operations, triggering the defense mechanism. The entire process involves real-time monitoring of the decoy file and rapid disposal of the malicious process. The specific steps are as follows:

[0117] 1. Bait file monitoring:

[0118] Capture file operation requests (IRP requests):

[0119] The kernel-mode decoy file monitoring module is based on the MiniFilter driver and intercepts all IRP requests for file write and delete operations in real time.

[0120] Determine whether it is a bait file:

[0121] It is a decoy file (the scenario description assumes that the ransomware accesses the decoy file):

[0122] Block current operations to prevent ransomware from further encrypting or damaging files.

[0123] Suspend the triggering process and collect its detailed information (such as process ID, process path, etc.).

[0124] Feedback the collected information to the user-mode module through a trusted channel.

[0125] 2. Malicious process disposal:

[0126] Receive feedback:

[0127] The user-mode module receives kernel-mode feedback on malicious processes attempting to access decoy files, including key data such as process ID and process path.

[0128] ·Execute the disposal strategy:

[0129] Terminate malicious processes: Immediately shut down the process to block subsequent attacks.

[0130] Network isolation: Disconnect the network connection of the host where the triggering process is located to prevent the lateral spread of ransomware.

[0131] Logging and Alerting: Generates detailed attack logs, including the triggering process's operation time, target file, and path. The alert mechanism notifies administrators of relevant information in real time.

[0132] Example 2

[0133] The process of this embodiment is as follows Figure 3 The figure below illustrates the defense process when ransomware bypasses decoy files and directly encrypts real files. First, the decoy file monitoring module performs a preliminary check to determine whether the target file being accessed is a decoy file. Then, the kernel-mode dynamic token verification module extracts the real-time token and compares it against the whitelist.

[0134] Ransomware attempts to circumvent decoy files and directly encrypt real user files. Regardless of whether the target file a process accesses is a decoy file, all operation requests must first be initially evaluated by the decoy file monitoring module. The operation request is then passed to the dynamic token verification module for further verification. By accurately identifying dynamic behavior characteristics, it can promptly block abnormal operations.

[0135] The specific steps are as follows:

[0136] 1. Preliminary evaluation of the decoy file module:

[0137] Determine whether the target file is a bait file:

[0138] Non-bait documents:

[0139] The operation request is passed to the dynamic token verification module for further verification.

[0140] 2. Dynamic Token Generation and Verification:

[0141] Dynamic Token Generation:

[0142] The dynamic token verification module extracts the call context of the operation request (such as API call path, call stack, and call parameters) and generates a dynamic token based on the call context to describe the characteristics of the current operation behavior.

[0143] Compare the token whitelist:

[0144] Match successful: The operation is legal and the request is allowed to proceed.

[0145] Matching failure: Block the current operation, suspend the process, and feedback the exception information to the user mode module

[0146] 3. Disposal of malicious user-mode processes:

[0147] The user-mode malicious process handling module analyzes the process information fed back by the kernel mode and performs the following steps:

[0148] Terminate Process: Immediately close the malicious process.

[0149] Event logging: Record attack behavior logs and generate reports.

[0150] Early warning notification: Send notifications to system administrators to alert them to potential attack risks.

Claims

1. A double-layered ransomware defense method combining decoy file monitoring and token verification, characterized in that: The specific steps are as follows: Step 1: Build a two-layer ransomware defense mechanism that uses user-mode and kernel-mode modules to work together. The user-mode module includes a decoy file generation and deployment module, a token collection module, and a malicious process disposal module; The kernel mode module includes a decoy file monitoring module and a dynamic token verification module; Step 2: The user-mode module generates a decoy file and a token whitelist, and transmits them to the kernel-mode module; The bait file is: the bait file generation and deployment module in the user mode module dynamically generates the bait file and deploys it to the key directory of the system; the bait file path list is sent to the bait file monitoring module in the kernel mode through a trusted channel, so that the module can monitor the operation of the bait file by the ransomware process in real time; The token whitelist is: the token collection module runs a whitelist program in a trusted environment, extracts its legal behavior characteristics, generates a token whitelist, and sends it to the dynamic token verification module in the kernel state; Step 3: When the ransomware attempts to encrypt or destroy the target file through file operations, the bait file monitoring module determines whether the target file is a bait file. If so, step 4 is executed; Otherwise, go to step 5; Step 4: The ransomware attempts to operate the decoy file. The decoy file monitoring module captures the file operation request, blocks the malicious behavior, and feeds back to the user mode module. Step 5: The ransomware attempts to circumvent the decoy file and directly encrypt the real user files. At this point, the decoy file monitoring module passes the operation request to the dynamic token verification module for in-depth verification. By accurately identifying dynamic behavior characteristics, it promptly blocks abnormal operations and feeds back the processing results to the user state module. The dynamic token verification module performs in-depth verification as follows: First, the dynamic token verification module extracts the call context of the operation request and generates a dynamic token based on the call context to describe the characteristics of the current operation behavior; Then, the dynamic token verification module compares the dynamic token with the token whitelist and identifies abnormal operations based on the comparison results; The comparison results are as follows: if the comparison result is a match, it indicates that the operation request is legal and the request is allowed to pass; if the comparison result is a match failure, the current operation is blocked, the process is suspended, and the abnormal information is fed back to the user state module, and the encrypted file is restored at the same time; Step 6: The malicious process handling module in the user mode module executes the termination and isolation strategy for the malicious process.

2. A double-layered ransomware defense method combining bait file monitoring and token verification according to claim 1, characterized in that: The process by which the bait file monitoring module determines whether the target file of the ransomware is a bait file is as follows: First, the ransomware process initiates a file write or delete operation request in user mode, attempting to encrypt the target file; Then, the kernel-mode decoy file monitoring module, based on the MiniFilter driver, intercepts all IRP requests for file write and delete operations in real time. Finally, the bait file monitoring module determines whether the target file of the ransomware process is a bait file.

3. The double-layered ransomware defense method combining decoy file monitoring and token verification according to claim 1 is characterized in that: The decoy file monitoring module blocks the ransomware process from performing the following operations on the decoy file: First, the current operation is blocked to prevent the ransomware from further encrypting or damaging files. Then, the triggering process is suspended and its detailed information is collected. Finally, the collected information is fed back to the user-mode module through a trusted channel.

4. The double-layered ransomware defense method combining decoy file monitoring and token verification according to claim 1, characterized in that: The processing process of the malicious process processing module is as follows: First, receiving feedback information: the user-mode module receives malicious process information fed back by the kernel mode; Then, execute the disposal strategy, including: Terminate malicious processes: Immediately shut down malicious processes to block subsequent attacks; Network isolation: Disconnect the network connection of the host where the triggering process is located to prevent the lateral spread of ransomware; Logging and Alerting: Generates detailed attack logs, including the triggering process's operation time, target file, and path information, and notifies administrators of relevant information in real time through an alert mechanism.

Images