A multi-layer ransomware protection system and method based on dynamic trust

Abstract

This invention discloses a dynamic, trusted, multi-layered ransomware protection system and method, belonging to the field of ransomware defense technology. The system includes a process verification module and a suspicious process monitoring module. When a process calls a system function to obtain a file list, the system intercepts this operation using code instrumentation and determines the process type through the process verification module. If the process is not included in the blacklist or whitelist, it is identified as a suspicious process, and a list of files containing decoy files is returned to it. The suspicious process monitoring module monitors the process's traversal of the file list containing decoy files in real time. If the process accesses a decoy file, it is marked as a malicious process and added to the blacklist; otherwise, the system intercepts its system calls related to file access using code instrumentation and adopts different protection strategies based on the value level of the files. This invention reduces the false positive rate of normal processes, achieving accurate detection and defense against ransomware.

Description

Technical Field

[0001] This invention belongs to the field of ransomware defense technology, specifically referring to a dynamic, trusted, multi-layered ransomware protection system and method. Background Technology

[0002] With the development of digital technology, data plays an increasingly important role for companies and organizations. Ransomware, as a type of malware, primarily infiltrates users' computers or network devices, encrypts or restricts access to users' data files, and then demands a ransom in exchange for decryption or restoration of access. This type of malware spreads through various means, including email attachments, malicious website links, and online advertisements, with email attachments or links being the most common method. Once a user's device is infected, ransomware quickly encrypts or locks important files, rendering the user inaccessible or causing data loss, resulting in serious economic losses and data security risks.

[0003] Ransomware has become a major challenge in the field of cybersecurity. Attackers are constantly developing new types of ransomware using various techniques, and its spread and attack range are continuously expanding. Faced with this increasingly serious threat, traditional defense measures are proving inadequate. Therefore, it is necessary to continuously research and innovate more efficient and intelligent protection technologies to cope with the diversified attack methods of ransomware and effectively protect users' data security and privacy from infringement.

[0004] Existing technical solutions detect and defend against ransomware by embedding decoy files into the user's file system. These decoy files are typically designed as high-value fake files to lure ransomware into accessing them. Once a process accesses the decoy file, the system can identify it as malicious and take appropriate defensive measures. While the specific implementation methods of this technology vary, its core design goals focus on two main aspects: first, generating highly realistic decoy files to enhance their appeal to attackers and ensure that ransomware actively identifies and accesses these files; second, deploying the decoy files in key locations where ransomware is more likely to access them, thereby improving the accuracy and timeliness of detection. Through these designs, existing technologies can effectively identify and intercept malicious behavior before ransomware damages real files, providing a certain level of protection for data security.

[0005] Existing deception-based protection strategies based on decoy files have the following two main drawbacks in practical applications:

[0006] (1) When there are a large number of decoy files, legitimate users or normal processes may accidentally access the decoy files, which may lead the system to misjudge them as malicious behavior and thus affect the operation of normal business.

[0007] (2) When the number of decoy files is small, the ransomware may have already traversed and encrypted a large number of user files before accessing the decoy files, which makes the protection mechanism unable to detect and block malicious behavior in time, thus reducing the defense effect.

[0008] These shortcomings limit the practicality and reliability of existing technologies, and a more efficient and accurate solution is urgently needed to overcome these deficiencies. Summary of the Invention

[0009] To address the issues of poor detection and defense effectiveness and low efficiency in existing ransomware technologies, this invention proposes a dynamic, trusted, multi-layered ransomware protection system and method. This system monitors suspicious processes in real time and introduces a file protection mechanism, thereby improving the accuracy and efficiency of ransomware defense while protecting file security.

[0010] A multi-layered ransomware protection method based on dynamic trust includes the following steps:

[0011] Step 1: Set up the initial whitelist and blacklist;

[0012] The whitelist is manually added by the trusted administrator at the beginning, while the blacklist is initially empty and is dynamically added during subsequent detection processes.

[0013] Step two: When a process calls a system function to obtain a file list, the system intercepts the operation through code instrumentation and determines the type of the process through a process verification function.

[0014] The core of the process verification function is to inject hook functions into the system call path through code instrumentation technology to intercept critical operations. The specific judgment logic is as follows: obtain the unique identifier of the process through the process fingerprint generation algorithm, and combine it with the software digital signature to compare with the blacklist and whitelist for verification.

[0015] Processes are divided into the following three types:

[0016] 1. Legitimate Process: If a process exists in the whitelist, it is considered a legitimate process. The system will allow the process to proceed and call the original system function to return the actual list of files.

[0017] 2. Malicious Processes: If a process exists in the blacklist, it is identified as a malicious process. The system will immediately terminate the process to prevent further damage.

[0018] 3. Suspicious Processes: If a process is neither in the whitelist nor the blacklist, it is considered an unknown suspicious process. The system will fabricate a list of files containing decoy files and return it to the process to lure it into accessing those files. The fake decoy file information is generated based on the current directory context, achieving a highly realistic and deceptive effect.

[0019] By using code instrumentation techniques, decoy file information is generated and inserted when the system returns a file list. However, these decoy files are fake and do not actually exist.

[0020] Step 3: If the process is a suspicious process, the system will monitor and respond to it in real time through the suspicious process monitoring module;

[0021] Suspicious processes traverse the list of files containing bait files. The suspicious process monitoring module monitors in real time whether the files it accesses are bait files. If so, the system will immediately terminate the process, mark it as a malicious process, and add it to the blacklist to prevent its subsequent operations. Otherwise, if a suspicious process accesses a user file, the system will intercept its system calls related to file access through code instrumentation technology and take different protection strategies according to the value level of the file.

[0022] The value level of a file is defined by the user, including high-value files and medium-to-low-value files;

[0023] Different protection strategies are adopted for documents of different value levels, including:

[0024] For high-value files, the system will call a legitimate silent process to preempt the file handle, directly preventing suspicious processes from encrypting or modifying the files, thus ensuring the absolute security of high-value files.

[0025] For low- to medium-value files, the system uses a dynamic delay mechanism to limit the access speed of suspicious processes. This artificially introduces operational delays, postpones their encryption behavior, and gives the system more time for behavioral analysis and response, enhancing the timeliness of the defense. If a suspicious process accesses the bait file during the delay period, the system immediately terminates the process and adds it to the blacklist.

[0026] The system that implements the above-mentioned multi-layered ransomware protection method includes a process verification module and a suspicious process monitoring module.

[0027] The beneficial effects of this invention are as follows:

[0028] (1) Reduce the false positive rate: Through the whitelist mechanism, the system can accurately distinguish between legitimate processes and suspicious processes, and avoid legitimate users or normal processes being mistakenly judged as malicious behavior due to accidental access to bait files, which significantly improves the availability of the system and the user experience.

[0029] (2) Improve defense timeliness: Introduce a delay mechanism to delay the encryption behavior of suspicious processes when they access important files, giving the system more time to detect and block malicious processes, effectively reducing the possibility of ransomware encrypting a large number of user files before accessing the bait files.

[0030] (3) Accurate detection of malicious behavior: Through the list of decoy files and fictitious files, the system can dynamically and proactively induce suspicious processes to access the decoy files, thereby achieving accurate detection and defense and enhancing the intelligent response capability against ransomware. Attached Figure Description

[0031] Figure 1 This is a flowchart of the overall technical solution of the dynamic and trusted multi-layer ransomware protection method of the present invention;

[0032] Figure 2 This is a flowchart of Embodiment 1 of the present invention;

[0033] Figure 3 This is a flowchart of Embodiment 2 of the present invention. Detailed Implementation

[0034] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0035] The key technology of this invention lies in intercepting file operating system calls through code instrumentation and inserting a custom process verification function, combined with a blacklist / whitelist mechanism for process classification and management. Existing technologies typically rely solely on decoy files for detection, lacking dynamic process classification and precise management. This invention, through whitelists and blacklists, accurately distinguishes between legitimate and suspicious processes, and uses code instrumentation to return a list of fake files containing decoy files to suspicious processes, preventing legitimate processes from being misjudged due to accidental access to decoy files, significantly reducing the false positive rate.

[0036] Furthermore, using existing technologies, ransomware may encrypt a large number of user files before accessing the decoy files, leading to untimely defense. This invention, however, implements an access delay mechanism and a file handle preemption mechanism through code instrumentation. After a suspicious process obtains the fake file list, it artificially introduces an operation delay or directly preempts the file handles of important files when the process begins accessing them, thus delaying its encryption behavior and giving the system more time to observe and detect suspicious processes, thereby improving the timeliness and effectiveness of defense.

[0037] The present invention solves the problems existing in the prior art through the following technical means:

[0038] (1) By using code instrumentation, when a suspicious process triggers a system call related to file access, the system takes over the code flow and runs custom code. The system adopts different handling strategies according to the type of process (legitimate process, suspicious process, or malicious process): it returns a list of real files to legitimate processes; it returns a list of fictitious files containing decoy files to suspicious processes and monitors and responds to their behavior in real time; and it immediately terminates the operation of malicious processes.

[0039] (2) When monitoring suspicious processes, code instrumentation is used to introduce a delayed access mechanism and a file handle preemption mechanism when the process accesses user files in order to delay the time and protect the user files.

[0040] (3) When generating a list of fictitious files, the list of fake files containing realistic and highly valuable decoy files is generated by collecting directory context information, and the suspicious processes are actively induced to access the decoy files first.

[0041] Specifically, such as Figure 1 As shown, the implementation process of the dynamic trusted multi-layer ransomware protection method of the present invention is as follows:

[0042] (1) System call interception and process verification

[0043] When a process calls a system function to retrieve a file list, the system intercepts this operation using code instrumentation and inserts a custom process verification function. This function determines the process based on data from a whitelist and a blacklist, classifying them into three types:

[0044] Legitimate Process: If a process exists in the whitelist, it is considered a legitimate process. The system will allow the process to proceed and call the original system function to return the actual list of files.

[0045] Malicious Process: If a process exists in the blacklist, it is identified as a malicious process. The system will immediately terminate the process to prevent further damage.

[0046] Suspicious Processes: If a process is neither in the whitelist nor the blacklist, it is considered an unknown suspicious process. The system will fabricate a list of files containing decoy files and return it to the process to lure it into accessing those files. The fake decoy file information is generated based on the current directory context, achieving a highly realistic and deceptive effect.

[0047] (2) Monitoring and response to suspicious processes

[0048] For processes deemed suspicious, the system will monitor them in real time:

[0049] 1. Accessing the decoy file: If a suspicious process accesses the decoy file, the system will immediately terminate the process, mark it as a malicious process, and add it to the blacklist to prevent its subsequent operations;

[0050] 2. Accessing User Files: If a suspicious process accesses a user file, the system will intercept the system calls related to file access using code instrumentation technology and adopt different protection strategies based on the value level of the file. High-value files are defined by the user; users can set specific files or directories as high-value files according to their needs, and the system will provide special protection for these files based on the user-defined criteria.

[0051] For high-value files, the system will call a legitimate silent process to preempt the file handle, directly preventing suspicious processes from encrypting or modifying the files, thus ensuring the absolute security of high-value files.

[0052] For low- to medium-value files, the system uses a dynamic delay mechanism to limit the access speed of suspicious processes. This artificially introduces operational delays, postpones their encryption behavior, and gives the system more time for behavioral analysis and response, enhancing the timeliness of the defense. If a suspicious process accesses the bait file during the delay period, the system immediately terminates the process and adds it to the blacklist.

[0053] The purpose of adding a delay is to increase the probability of a suspicious process accessing the bait file. It's never 100% guaranteed that a suspicious process will access the bait file, and this method is more secure and reliable than having no delay. Furthermore, most ransomware uses a sequential scanning method to scan and encrypt user files; with a certain delay, in most cases the ransomware will find the bait file—it's just a matter of time.

[0054] If an operation is performed on a non-bait file during the delay period, the suspicious process will be unable to access and encrypt the non-bait file due to the limitations of the delay mechanism.

[0055] (3) Blacklist and whitelist management

[0056] In this solution, the whitelist is manually added by the administrator, and all applications on it have undergone rigorous review, representing high security and trustworthiness. The main purpose of setting up the whitelist is to minimize interference with legitimate business processes and ensure that normal business operations are not affected. Applications in the blacklist, on the other hand, are dynamically added after being identified as malware during the detection process. Initially, the blacklist is empty. Its function is to directly block the same malicious process when it reappears, thereby reducing detection overhead and improving system efficiency.

[0057] Through the above technical solution, this invention achieves accurate and timely detection and response to malicious behaviors such as ransomware through a layered protection mechanism, while significantly reducing the false positive rate. The system ensures user file security while minimizing the impact on normal processes, improving system security and availability, and providing reliable protection for data security.

[0058] Example 1

[0059] like Figure 2 As shown, suppose a ransomware process attempts to traverse the user's file system and encrypt files. The ransomware calls system functions (such as `readdir`) to obtain a list of files. This system intercepts this request using code instrumentation and calls a custom process verification function. The process verification function checks and finds that the process is neither in the whitelist nor the blacklist, determining it to be a suspicious process. It then fabricates and returns a list of files containing decoy files.

[0060] Next, the ransomware begins to iterate through the returned file list. If the ransomware accesses the bait file, the system immediately terminates the process and adds it to the blacklist. If the ransomware accesses a high-value user file, the system intercepts its file operations using code instrumentation and invokes a silent, legitimate process to seize the file handle, preventing the ransomware from operating on that high-value file. If the ransomware accesses a low- to medium-value user file, its file operations are intercepted using code instrumentation, and an operation delay (e.g., 5 seconds) is introduced to postpone its encryption behavior. During the delay, the system continues to monitor the ransomware's behavior. If the ransomware accesses the bait file during the delay, the system immediately terminates the process and adds it to the blacklist.

[0061] Example 2

[0062] like Figure 3 As shown, suppose a legitimate text editor process (such as Microsoft Word) attempts to open a user's document. This process has been manually added to the whitelist by the user, and is therefore deemed legitimate by the system. The text editor calls a system function (such as `readdir`) to retrieve a list of files. The system intercepts this request using code instrumentation and calls a custom process verification function. The process verification function checks and finds that the process exists in the whitelist, indicating that the process is highly secure and trustworthy. It then directly calls the original system function, returning the actual list of files. At this point, the text editor accesses the user's file normally based on the returned file list, and the system does not interfere with or delay the file access operations of the legitimate process in any way.

Claims

1. A multi-layered ransomware protection method based on dynamic trust, characterized in that, Includes the following steps: Step 1: Set up the initial whitelist and blacklist; The whitelist is manually added by the trusted administrator at the beginning, while the blacklist is initially empty and is dynamically added during subsequent detection processes; Step two: When a process calls a system function to obtain a file list, the system intercepts the operation through code instrumentation and determines the type of the process through a process verification function. The process verification function injects hook functions into the system call path through code instrumentation technology to intercept critical operations. Its judgment logic is as follows: it obtains the unique identifier of the process through the process fingerprint generation algorithm, and combines it with the software digital signature, and compares it with the blacklist and whitelist for verification. Processes are classified into three types based on the criteria: legitimate processes, malicious processes, and suspicious processes. (1) Legitimate process: If a process exists in the whitelist, it is determined to be a legitimate process; the system will allow the process and call the original system function to return the real file list to it; (2) Malicious process: If a process exists in the blacklist, it is determined to be a malicious process, and the system will terminate the process immediately; (3) Suspicious process: If a process is neither in the whitelist nor the blacklist, it is determined to be an unknown suspicious process; the system will fabricate and return a list of files containing the decoy file to the process to guide it to access the decoy file; Step 3: If the process is a suspicious process, the system will monitor and respond to it in real time through the suspicious process monitoring module; Suspicious processes traverse the list of files containing bait files. The suspicious process monitoring module monitors in real time whether the files accessed by the suspicious process are bait files. If so, the system will immediately terminate the process, mark it as a malicious process, and add it to the blacklist. Otherwise, if the suspicious process accesses user files, the system will intercept its system calls related to file access through code instrumentation technology and take different protection strategies according to the value level of the file. Different protection strategies are adopted based on the value level of the document, specifically: For high-value files, the system will call a legitimate silent process to preempt the file handle, directly preventing suspicious processes from encrypting or modifying the files, thus ensuring the absolute security of high-value files. For low- to medium-value files, the system uses a dynamic delay mechanism to limit the access speed of suspicious processes, artificially introducing operational delays to postpone their encryption behavior and give the system more time for behavioral analysis and response. If a suspicious process accesses the bait file during the delay period, the system immediately terminates the process and adds it to the blacklist.

2. The multi-layered ransomware protection method based on dynamic trust as described in claim 1, characterized in that, The decoy file is a highly realistic and enticing fake file generated based on the current directory context information.

3. The multi-layered ransomware protection method based on dynamic trust as described in claim 1, characterized in that, The decoy file utilizes code instrumentation technology to insert itself into the file list returned by the system to a suspicious process, so that the suspicious process receives a file list containing the decoy file.

4. The multi-layered ransomware protection method based on dynamic trust as described in claim 1, characterized in that, The value level of the files is specified by the user, including high-value files and medium-to-low-value files.

5. A multi-layered ransomware protection system based on dynamic trust, characterized in that, It includes a process verification module and a suspicious process monitoring module, implementing the multi-layer ransomware protection method based on dynamic trust as described in any one of claims 1 to 4.

Images