Ransomware detection method, device and equipment, medium and program product

Abstract

The invention discloses a ransomware detection method and device, equipment, a medium and a program product. The method comprises the steps of performing feature extraction on an original file directory to obtain a high-dimensional attribute feature vector set; performing feature dimension reduction on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performing clustering analysis on the low-dimensional attribute feature vector set, and constructing a bait file generation template; generating a target bait file according to the bait file generation template, and deploying the target bait file in the original file directory to obtain a target file directory; and monitoring a behavior of modifying the target bait file, when it is detected that the target bait file is subjected to the target file modification behavior, determining a process executing the target file modification behavior as a ransomware process, and triggering a ransomware defense mechanism. The application can enhance the adaptability and anti-avoidance capability to various ransomware encryption strategies, significantly improve the cheating effect of the bait file on the ransomware, and can be widely applied to the technical field of computers.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a ransomware detection method, apparatus, device, medium, and program product. Background Technology

[0002] Ransomware has become one of the most significant cybersecurity threats, making decoy file-based detection methods one of the most promising approaches. However, current ransomware detection methods typically use decoy files created based on static rules, making it difficult to personalize them for different ransomware variants and attack strategies. This leads to a decrease in the decoy files' persuasive effectiveness. In other words, current decoy file deployment strategies suffer from problems such as limited coverage, monotonous file types that are easily circumvented, and weak persuasive capabilities when facing the increasingly complex encryption behaviors of emerging ransomware families. These issues hinder timely detection of ransomware and triggering of response measures, resulting in undetected ransomware attacks, significant file loss, and a serious threat to data security.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0004] The embodiments of this application aim to at least partially solve one of the technical problems in the related art. Therefore, the main objective of the embodiments of this application is to propose a ransomware detection method, apparatus, device, medium, and program product, which can enhance adaptability and anti-evasion capabilities against various ransomware encryption strategies, significantly improve the deception effect of decoy files on ransomware, and thus enhance the ability to quickly detect and respond to ransomware.

[0005] To achieve the above objectives, one aspect of this application proposes a ransomware detection method, the method comprising the following steps: Determine the original file directory; wherein, the original file directory contains several files; Feature extraction is performed on each file in the original file directory to obtain a high-dimensional attribute feature vector set; The high-dimensional attribute feature vector set is subjected to feature dimensionality reduction processing to obtain a low-dimensional attribute feature vector set; Cluster analysis is performed on the low-dimensional attribute feature vector set to construct a decoy file generation template; Based on the decoy file generation template, a target decoy file is generated, and the target decoy file is deployed in the original file directory to obtain the target file directory; The system dynamically monitors any modifications made to the target decoy file. When modifications to the target decoy file are detected, the process performing the modification is identified as a ransomware process, and the ransomware defense mechanism is triggered.

[0006] In some embodiments, after generating a target decoy file based on the decoy file generation template and deploying the target decoy file in the original file directory to obtain a target file directory, the method further includes: The file attribute changes of each file in the target file directory are monitored periodically. When the file attribute changes of any file in the target file directory meet the preset decoy file update conditions, the target file directory is used as the original file directory, and the process of extracting features from each file in the original file directory to obtain a high-dimensional attribute feature vector set is returned until the target decoy file is generated, so as to realize the periodic update of the target decoy file.

[0007] In some embodiments, the step of performing feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set includes: The original file directory is traversed to extract the metadata attributes of each file. The metadata attributes of each file in the original file directory are uniformly normalized to obtain the high-dimensional attribute feature vectors corresponding to each file in the original file directory; The high-dimensional attribute feature vector set is constructed based on the high-dimensional attribute feature vectors corresponding to each file in the original file directory.

[0008] In some embodiments, the step of performing feature dimensionality reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set includes: An autoencoder is used to perform nonlinear dimensionality reduction on the high-dimensional attribute feature vector set to obtain the low-dimensional attribute feature vector set.

[0009] In some embodiments, the step of performing cluster analysis on the low-dimensional attribute feature vector set to construct a decoy file generation template includes: The low-dimensional attribute feature vector set is subjected to a first clustering analysis using a first preset clustering algorithm to obtain common representative files; The low-dimensional attribute feature vector set is subjected to a second clustering analysis using a second preset clustering algorithm to obtain a personalized representative document; Based on the common representative files and the individual representative files, construct the decoy file generation template.

[0010] In some embodiments, generating a target decoy file based on the decoy file generation template includes: Copy the contents of the common representative file and the individual representative file in the decoy file generation template to the target new file, and modify the file name of the target new file to generate the target decoy file.

[0011] To achieve the above objectives, another aspect of this application provides a ransomware detection device, which includes the following modules: The file directory determination module is used to determine the original file directory; wherein, the original file directory contains several files; The feature extraction processing module is used to perform feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set; The feature dimensionality reduction processing module is used to perform feature dimensionality reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. The clustering analysis processing module is used to perform clustering analysis processing on the low-dimensional attribute feature vector set and construct a decoy file generation template; The decoy file generation module is used to generate a target decoy file according to the decoy file generation template, and deploy the target decoy file in the original file directory to obtain the target file directory; The decoy file monitoring module is used to dynamically monitor the modification behavior of the target decoy file. When the target decoy file is detected to be modified, the process executing the target file modification behavior is identified as a ransomware process, and the ransomware defense mechanism is triggered.

[0012] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0013] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0014] To achieve the above objectives, another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0015] The embodiments of this application include at least the following beneficial effects: This application provides a ransomware detection method, apparatus, device, medium, and program product. This solution involves determining an original file directory; wherein the original file directory contains several files; performing feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set; performing feature dimensionality reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performing cluster analysis processing on the low-dimensional attribute feature vector set to construct a decoy file generation template; generating a target decoy file according to the decoy file generation template, and deploying the target decoy file in the original file directory to obtain a target file directory; dynamically monitoring the behavior of modifying the target decoy file; when the target decoy file is detected to be modified, the process executing the target file modification behavior is identified as a ransomware process, and a ransomware defense mechanism is triggered. This application embodiment reduces the dimensionality of a high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. This not only significantly reduces the computational overhead of the subsequent clustering stage but also improves the expressive power of the original features. That is, the dimensionality-reduced feature vectors maintain the main semantics while possessing higher computational efficiency and clustering resolution. By performing cluster analysis on the dimensionality-reduced file feature vectors, representative target file samples from the ransomware perspective are identified as decoy file generation templates. This enhances the adaptability and anti-evasion capability against various ransomware encryption strategies. Furthermore, based on the decoy file generation template, highly persuasive decoy files that better match the ransomware's encryption preferences are generated, significantly improving the deception effect of the decoy files on ransomware. Finally, the generated highly persuasive decoy files are deployed in the target file directory, effectively inducing ransomware to prioritize accessing the decoy files in the target file directory during the encryption process. By monitoring the modification behavior of the target decoy files in real time, ransomware can be identified, significantly improving the ability to quickly detect and respond to ransomware, thereby enhancing file security. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the steps of a ransomware detection method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating a ransomware detection method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a ransomware detection device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0018] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0019] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0021] Ransomware has become one of the most significant cybersecurity threats, making its detection and prevention a major research focus in the cybersecurity field. Currently, ransomware attack detection still faces numerous challenges. Due to the rapid evolution of ransomware and the constant emergence of new variants, current detection mechanisms, which rely heavily on feature matching or behavioral pattern recognition, lack universality and are ineffective against new ransomware variants. As the confrontation between ransomware attackers and security teams escalates, both sides are continuously enhancing their technical capabilities. While security experts develop new detection strategies, ransomware developers are constantly employing more complex techniques to circumvent these detection systems. Modern ransomware attacks utilize diverse and complex techniques, significantly increasing the difficulty of detection and defense. For example, attackers often exploit zero-day vulnerabilities for initial penetration, use fileless attacks to bypass traditional protection measures, or employ process injection techniques to hide malicious behavior. These techniques significantly enhance the stealth and targeting of ransomware, posing a severe challenge to defense systems. Currently, decoy file-based detection methods are among the most promising approaches for ransomware detection. These methods implant decoy files into computer systems, triggering alerts when ransomware accesses these files, thus achieving detection. However, current decoy file-based detection methods suffer from limitations such as simplistic deployment strategies and a limited variety of decoy file types, making them easily identifiable and evaded by attackers. For example, decoy files utilizing specific file types or naming characteristics may be filtered by ransomware, leading to detection failure.

[0022] For example, a significant characteristic of emerging ransomware families is the introduction of file attribute-based encryption priority strategies. Ransomware sets filtering rules based on file metadata (such as size, creation date, and file type), prioritizing encryption of specific target types to circumvent current detection mechanisms. Taking BlackRuby as an example, this ransomware first traverses all available files before encryption, filtering out non-target objects according to preset exclusion rules, and only encrypting specific types of documents smaller than 512MB. This priority strategy allows it to encrypt high-value data in a very short time, increasing attack speed and reducing the risk of detection. Current decoy file generation strategies mostly do not fully consider the file attribute-based encryption behavior of these ransomwares, still employing decoy deployment strategies based on directory traversal order, resulting in a significant decrease in detection effectiveness against emerging ransomware. Specifically, current decoy file-based detection technologies have several shortcomings, mainly reflected in the simplistic deployment strategies, limited coverage, and the monotonous file types that are easily circumvented. The specific reasons are as follows: (1) The decoy file deployment strategy is singular and has limited coverage: Currently, most detection methods based on decoy files are based on the assumption that ransomware encrypts files sequentially according to the directory traversal order, which is often based on the lexicographical order of the filenames. Based on this assumption, current detection methods deploy two decoy files at the beginning and end of the sorting, hoping that the ransomware will access these files first, thereby triggering the detection mechanism and achieving a rapid response and interception of the ransomware. However, as new ransomware families continue to evolve, this "sequential traversal" encryption mode has gradually been replaced by more complex encryption strategies. New ransomware families are gradually adopting file attribute-oriented encryption strategies, which significantly weakens the effectiveness of decoy deployment strategies based on directory traversal order. Decoy files may be encrypted later or even completely bypassed, causing the ransomware to be undetected in a timely manner, which may result in large-scale file loss in severe cases.

[0023] (2) The decoy file types are monotonous and easily identified and evaded by ransomware: The decoy files used in current detection methods are mostly homogeneous files (such as named pipes of uniform type or files of fixed type). Attackers can bypass the decoy files by filtering specific file types or naming characteristics, thereby evading detection. This design lacks adaptability to the diversified attack behaviors of ransomware.

[0024] In summary, current detection methods typically use decoy files created based on static rules, ignoring the ransomware's encryption behavior based on file attributes. This makes it difficult to personalize the decoy files for different ransomware variants and attack strategies, and they cannot effectively adapt to emerging attack methods such as multi-threaded concurrency and file attribute-based encryption priority strategies. Consequently, the decoy file's persuasive effectiveness decreases. In other words, current decoy file deployment strategies suffer from problems such as limited coverage, monotonous file types that are easily circumvented, and weak persuasive capabilities when facing the increasingly complex encryption behaviors of emerging ransomware families. This makes it difficult to detect ransomware in a timely manner and trigger response measures, resulting in undetected ransomware attacks and significant file loss. Especially as emerging ransomware families increasingly adopt file attribute-based encryption priority strategies, bypassing decoy files and evading detection, data security is seriously threatened.

[0025] In view of this, embodiments of this application provide a ransomware detection method, apparatus, device, medium, and program product. This solution involves: determining an original file directory containing several files; performing feature extraction on each file in the original file directory to obtain a high-dimensional attribute feature vector set; performing feature dimensionality reduction on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performing cluster analysis on the low-dimensional attribute feature vector set to construct a decoy file generation template; generating a target decoy file based on the decoy file generation template and deploying the target decoy file in the original file directory to obtain a target file directory; dynamically monitoring modifications to the target decoy file; and when modification of the target decoy file is detected, identifying the process performing the modification as a ransomware process and triggering a ransomware defense mechanism. This application embodiment reduces the dimensionality of a high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. This not only significantly reduces the computational overhead of the subsequent clustering stage but also improves the expressive power of the original features. That is, the dimensionality-reduced feature vectors maintain the main semantics while possessing higher computational efficiency and clustering resolution. By performing cluster analysis on the dimensionality-reduced file feature vectors, representative target file samples from the ransomware perspective are identified as decoy file generation templates. This enhances the adaptability and anti-evasion capability against various ransomware encryption strategies. Furthermore, based on the decoy file generation template, highly persuasive decoy files that better match the ransomware's encryption preferences are generated, significantly improving the deception effect of the decoy files on ransomware. Finally, the generated highly persuasive decoy files are deployed in the target file directory, effectively inducing ransomware to prioritize accessing the decoy files in the target file directory during the encryption process. By monitoring the modification behavior of the target decoy files in real time, ransomware can be identified, significantly improving the ability to quickly detect and respond to ransomware, thereby enhancing file security.

[0026] The ransomware detection method provided in this application relates to the field of computer technology. The ransomware detection method provided in this application can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the ransomware detection method, but is not limited to the above forms.

[0027] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0028] Please see Figure 1 , Figure 1 This is an optional flowchart of the ransomware detection method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0029] Step S101: Determine the original file directory; wherein the original file directory contains several files; The original file directory refers to the actual user file directory where the decoy files need to be deployed. It can be determined by providing a directory name with a path. The original file directory contains several files.

[0030] In this embodiment of the application, the original file directory refers to the folder where the decoy files need to be deployed. It can be specified by the user or set as the directory that ransomware prioritizes. By placing decoy files in the directory and monitoring the decoy files, ransomware can be identified and corresponding response measures can be taken in a timely manner.

[0031] It should be noted that in the embodiments of this application, the file directory can be simply referred to as the directory, and the embodiments of this application will be described directly as the directory in the following description.

[0032] Step S102: Perform feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set; In some embodiments, step S102 may include: traversing each file in the original file directory to extract the metadata attributes of each file in the original file directory; performing unified normalization processing on the metadata attributes of each file in the original file directory to obtain the high-dimensional attribute feature vector corresponding to each file in the original file directory; and constructing a high-dimensional attribute feature vector set based on the high-dimensional attribute feature vector corresponding to each file in the original file directory.

[0033] Specifically, the standardized processing of file attributes involves the following steps: Different standardization strategies are employed based on the characteristics of different attributes. Continuous attributes (such as file size) are transformed into data with a mean of 0 and a variance of 1 using a standard normalization method. Categorical attributes (such as file type) are encoded using integers. For time-related attributes (such as creation and modification times), sine and cosine transforms are used to preserve their periodicity. Through these processes, each file is uniformly represented as a standardized feature vector, forming a feature matrix of dimension N×M, where N represents the number of files and M represents the number of standardized attribute dimensions. This feature matrix serves as the input basis for subsequent decoy file selection and deployment algorithms, providing structured support for achieving accurate and highly realistic decoy file generation.

[0034] In its implementation, the target directory is first traversed to extract metadata attributes for each file, including but not limited to file size, file type, creation time, and last modification time. After all extracted file attributes are standardized, they are encoded into corresponding feature vectors, with each file corresponding to a single feature vector that accurately represents the file's attribute characteristics. This application's feature extraction processing section supports efficient batch processing of massive amounts of files in large-scale file systems, ensuring data integrity and consistency during feature extraction. This provides high-quality raw input for subsequent feature dimensionality reduction and clustering analysis, and lays the foundation for decoy file generation strategies.

[0035] Step S103: Perform feature dimensionality reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; In some embodiments, step S103 may include: using an autoencoder to perform nonlinear dimensionality reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set.

[0036] In this embodiment, given that modern user systems often contain a large number of files, directly using high-dimensional original feature vectors for clustering would result in enormous computational resource consumption, low processing efficiency, and even affect the stability of the clustering results. Therefore, this application introduces an autoencoder to perform nonlinear dimensionality reduction on the original file attribute feature vectors. By compressing redundant dimensions and extracting potential key features, not only is the computational overhead of the clustering stage significantly reduced, but the expressive power of the original features is also improved. That is, the dimensionality-reduced feature vectors retain the main semantics while possessing higher computational efficiency and clustering resolution.

[0037] Step S104: Perform cluster analysis on the low-dimensional attribute feature vector set to construct a decoy file generation template; In some embodiments, step S104 may include: performing a first clustering analysis on the low-dimensional attribute feature vector set using a first preset clustering algorithm to obtain common representative files; performing a second clustering analysis on the low-dimensional attribute feature vector set using a second preset clustering algorithm to obtain individual representative files; and constructing a decoy file generation template based on the common representative files and the individual representative files.

[0038] In this application embodiment, the first preset clustering algorithm refers to the AP (Affinity Propagation) clustering algorithm, and the second preset clustering algorithm refers to the DBSCAN clustering algorithm.

[0039] In this embodiment, to improve sample coverage and generalization ability, two clustering algorithms are used together to obtain representative files: Firstly, the AP clustering algorithm is used to identify similar file clusters in the file attribute space, and cluster center samples are selected from each cluster as representatives to represent the common features of that type of file, serving as representative files with commonalities. Secondly, the DBSCAN clustering algorithm is used to mine low-density regions in the feature space, extracting outlier samples that cannot be classified into regular clusters, serving as marginal attribute representatives to cover a small number of files with unique attributes in the file set, serving as representative files with individual characteristics. The final output representative sample set contains both common and individual file features, comprehensively covering files with different attribute distributions in the target directory, serving as a template for generating decoy files for subsequent construction of diverse and highly persuasive decoy files.

[0040] Step S105: Generate a target decoy file based on the decoy file generation template, and deploy the target decoy file in the original file directory to obtain the target file directory; In some embodiments, the step of generating a target decoy file based on a decoy file generation template may include: copying the contents of common representative files and individual representative files in the decoy file generation template to a newly created target file, and modifying the filename of the newly created target file to generate the target decoy file.

[0041] In its implementation, based on the representative file samples output in step S105, corresponding decoy files are generated by copying the file content and adjusting the filename. The generated decoy files highly simulate the characteristics of a user's real files at the metadata level, possessing strong concealment and persuasiveness, effectively enticing ransomware to prioritize access during the encryption process. Furthermore, this application can control the number and distribution density of decoy files generated, balancing system performance overhead with decoy file coverage.

[0042] For example, the process of generating the decoy file is as follows: directly copy the content of the "representative file sample" output in step S105 to a newly created file, and modify the file name accordingly to obtain the decoy file. The decoy file is named using common prefixes or suffixes, such as "File", "Document", "Report", etc., or using a naming convention with a timestamp (e.g., file_2025_01_01_001.txt) to further enhance its deceptiveness. In addition, some characters (such as _x, _backup, etc.) will be randomly added to the file name to make it look consistent with ordinary files, thereby increasing its deceptiveness during the ransomware encryption process and improving the deception effect of the decoy file on ransomware.

[0043] In some embodiments, after step S105, the method may further include: periodically monitoring changes in the file attributes of each file in the target file directory; when the changes in the file attributes of any file in the target file directory meet the preset decoy file update conditions, using the target file directory as the original file directory, and returning to perform feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set, until the target decoy file is generated, so as to realize the periodic update of the target decoy file.

[0044] The preset decoy file update condition can refer to the threshold value reached by changes in the attributes of files in the target directory. This threshold value can be limited according to the actual application situation, and this application embodiment does not impose such a limitation. It is understood that, in this application embodiment, given that the user's file environment may change at any time, in order to maintain the deceptive effect of the decoy file, this application designs a mechanism for a dynamic update module to periodically monitor changes in file attributes in the target directory (such as file additions, deletions, modifications, etc.). Once a significant change in file attributes is detected (such as when the file attribute change reaches the file attribute change threshold, it is determined that the preset decoy file update condition is met), processes such as file attribute extraction, feature dimensionality reduction, cluster analysis, and decoy file generation are automatically triggered to achieve dynamic adaptive updates of the decoy file. This application supports custom update cycles and trigger thresholds to realize a dynamic update mechanism for the decoy file, maintaining continuous awareness of ransomware behavior while also considering system operating efficiency.

[0045] The decoy files are periodically updated via a dynamic update module. The purpose is to regenerate these files based on environmental changes when users make extensive modifications to files in the directory. This ensures the decoy files maintain their attributes in the locations where ransomware is likely to prioritize encryption, thus preserving the validity of their attributes. In the event of ransomware attack, this periodic update mechanism can still detect and terminate the ransomware process in a timely manner while minimizing file loss.

[0046] Step S106: Dynamically monitor the behavior of modifying the target decoy file. When the target decoy file is detected to be modified, the process that performs the modification behavior is identified as a ransomware process, and the ransomware defense mechanism is triggered.

[0047] The modification behavior of the target file may include, but is not limited to, writing, deleting, renaming and other modification operations.

[0048] In practical applications, a decoy file monitor is used to monitor implanted decoy files in real time. Modifications to the decoy files are used as the basis for ransomware identification. Once a process is detected modifying the decoy file (such as writing, deleting, or renaming operations), that process is identified as ransomware, and defensive measures are immediately implemented, such as terminating the malicious process or disconnecting the host from the network, thereby effectively mitigating ransomware attacks. This significantly improves the ability to quickly detect and respond to ransomware, thus enhancing file security.

[0049] Steps S101 to S106 as shown in the embodiments of this application involve: determining an original file directory containing several files; performing feature extraction on each file in the original file directory to obtain a high-dimensional attribute feature vector set; performing feature dimensionality reduction on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performing cluster analysis on the low-dimensional attribute feature vector set to construct a decoy file generation template; generating a target decoy file based on the decoy file generation template and deploying the target decoy file in the original file directory to obtain a target file directory; dynamically monitoring the modification behavior of the target decoy file; when the target decoy file is detected to be modified, the process executing the target file modification behavior is identified as a ransomware process, and the ransomware defense mechanism is triggered. This application embodiment reduces the dimensionality of a high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. This not only significantly reduces the computational overhead of the subsequent clustering stage but also improves the expressive power of the original features. That is, the dimensionality-reduced feature vectors maintain the main semantics while possessing higher computational efficiency and clustering resolution. By performing cluster analysis on the dimensionality-reduced file feature vectors, representative target file samples from the ransomware perspective are identified as decoy file generation templates. This enhances the adaptability and anti-evasion capability against various ransomware encryption strategies. Furthermore, based on the decoy file generation template, highly persuasive decoy files that better match the ransomware's encryption preferences are generated, significantly improving the deception effect of the decoy files on ransomware. Finally, the generated highly persuasive decoy files are deployed in the target file directory, effectively inducing ransomware to prioritize accessing the decoy files in the target file directory during the encryption process. By monitoring the modification behavior of the target decoy files in real time, ransomware can be identified, significantly improving the ability to quickly detect and respond to ransomware, thereby enhancing file security. That is, the ransomware detection method provided in this application embodiment can make the decoy file representative in the file metadata space, and can actively integrate into the set of priority encryption targets of ransomware, thereby enhancing the adaptability and anti-evasion capability of various ransomware encryption strategies.

[0050] The overall implementation process of the ransomware detection method provided in this application embodiment is as follows: First, feature extraction is performed on all files in the target directory to obtain metadata information including but not limited to file size, creation time, last modification time, and file type, and each file is converted into a corresponding file attribute feature vector; then, an autoencoder is used to perform feature dimensionality reduction on the high-dimensional file attribute feature vector, effectively reducing subsequent computational overhead by compressing redundant dimensions and retaining key feature information, while improving the efficiency and accuracy of clustering analysis; then, the dimensionality-reduced feature vector is clustered, introducing two complementary clustering strategies to obtain diverse representative samples: on the one hand, the AP clustering algorithm is used to cluster the dimensionality-reduced feature vectors. The algorithm uses eigenvector clustering to select files whose attributes are located at the cluster center as representative files with commonalities. On the other hand, the DBSCAN clustering algorithm is used to identify non-dense regions in the feature space and extract outlier samples whose attribute features deviate from the conventional pattern as personalized file representatives. These two types of representative samples together constitute the template library for generating decoy files, ensuring that the generated decoy files cover the target areas that ransomware may prioritize encrypting. Furthermore, decoy files are generated based on representative samples, making them highly realistic in appearance and attributes to resemble real user files, ensuring strong deception from the ransomware's perspective. Finally, to ensure the real-time nature of the decoy files, directory updates are checked periodically, and the decoy files are dynamically updated once a significant change in the environment is detected.

[0051] To explain in detail the principle of the technical solution of the present invention, the overall process of the present invention will be described below with reference to some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0052] In practical applications, emerging ransomware families are increasingly adopting file attribute-oriented encryption strategies. These ransomwares typically set filtering rules based on file metadata (such as file size, creation date, and type), prioritizing the encryption of specific types of targets. This behavior significantly weakens the effectiveness of decoy deployment strategies based on directory traversal order. Decoy files may be encrypted later or even completely bypassed, making it impossible for ransomware to be detected in time. In severe cases, this can lead to the risk of large-scale file loss. However, current detection methods based on decoy files mainly rely on static rules to generate decoy files, ignoring the ransomware's encryption behavior based on file attributes during the encryption process. Decoy file deployment strategies are simplistic, with limited coverage, and the types of decoy files are monotonous, making them easy for ransomware to identify and circumvent.

[0053] To address the problems existing in current decoy file detection methods, this application proposes an adaptive decoy file deployment method (i.e., a ransomware detection method) based on machine learning. Specifically, firstly, by extracting file attributes from all files in the target directory, each file is represented as a feature vector. Then, the feature vectors are dimensionality-reduced. After obtaining the dimensionality-reduced feature vectors, the file feature clustering analysis module uses the AP algorithm and the DBSCAN algorithm to cluster them. Specifically, the AP clustering algorithm adaptively selects files whose file attributes are located at the cluster centers as representative files with commonalities. The DBSCAN clustering algorithm groups files with similar attributes into a single large class, while identifying "outliers" that cannot be classified into the main class. These "outliers" represent files with unique file attributes and are also selected as representative files. Finally, all selected representative files are used as templates for generating the final decoy file. The clustering strategy used in this application covers both files whose file attributes are located at the cluster center and files with personalized attributes during the decoy generation process, thereby enhancing adaptability and resistance to evasion of various ransomware encryption strategies. Furthermore, to maintain the decoy files' persuasiveness and detection effectiveness, this application periodically checks for directory updates and dynamically updates the decoy files.

[0054] Please see Figure 2 , Figure 2 This is a flowchart illustrating a ransomware detection method provided in an embodiment of this application, as shown below. Figure 2 As shown, the ransomware detection system of this application mainly includes five functional modules: a file attribute extraction module, a feature dimensionality reduction module, a file feature clustering analysis module, a decoy file generation and deployment module, and a dynamic update module. The specific functions of each module are as follows: (1) File attribute extraction module: The main function of this module is to convert each file in the target directory into a structured feature vector to support subsequent clustering analysis.

[0055] Specifically, the file attribute extraction module first traverses the target directory, extracting metadata attributes for each file, including but not limited to file size, file type, creation time, and last modification time. After all extracted file attributes are standardized, they are encoded into corresponding feature vectors, with each file corresponding to a single feature vector that accurately represents the file's attribute characteristics. This module supports efficient batch processing of massive amounts of files in large-scale file systems, ensuring data integrity and consistency in the feature extraction process. It provides high-quality raw input for subsequent feature dimensionality reduction and clustering analysis, and lays the foundation for decoy file generation strategies.

[0056] Specifically, the standardized processing of file attributes involves the following steps: Different standardization strategies are employed based on the characteristics of different attributes. Continuous attributes (such as file size) are transformed into data with a mean of 0 and a variance of 1 using a standard normalization method. Categorical attributes (such as file type) are encoded using integers. For time-related attributes (such as creation and modification times), sine and cosine transforms are used to preserve their periodicity. Through these processes, each file is uniformly represented as a standardized feature vector, forming a feature matrix of dimension N×M, where N represents the number of files and M represents the number of standardized attribute dimensions. This feature matrix serves as the input basis for subsequent decoy file selection and deployment algorithms, providing structured support for achieving accurate and highly realistic decoy file generation.

[0057] (2) Feature Dimensionality Reduction Module: Given that modern user systems often contain a large number of files, directly using high-dimensional original feature vectors for clustering would result in huge computational resource consumption, low processing efficiency, and even affect the stability of the clustering results. Therefore, this module introduces an autoencoder to perform nonlinear dimensionality reduction on the original file attribute feature vectors. By compressing redundant dimensions and extracting potential key features, not only is the computational cost of the clustering stage significantly reduced, but the expressive power of the original features is also improved. That is, the dimensionality-reduced feature vectors maintain the main semantics while also possessing higher computational efficiency and clustering resolution.

[0058] (3) File Feature Clustering Analysis Module: The main function of this module is to perform clustering analysis on the dimensionality-reduced file feature vectors to identify representative target file samples from the perspective of ransomware. To improve the sample coverage and generalization ability, two clustering algorithms are used in combination: On the one hand, the AP (Affinity Propagation) clustering algorithm is used to identify similar file clusters in the file attribute space, and the cluster center sample is selected from each cluster as a representative to represent the common features of the files and serve as representative files with commonalities; on the other hand, the DBSCAN clustering algorithm is used to mine low-density regions in the feature space and extract outlier samples that cannot be classified into regular clusters as representative marginal attributes, so as to cover a small number of files with unique attributes in the file set and serve as representative files with individual characteristics. The final output representative sample set contains file features with both common and individual characteristics, comprehensively covering files with different attribute distributions in the target directory, and serves as a template for generating decoy files for subsequent construction of diversified and highly persuasive decoy files.

[0059] (4) Decoy File Generation and Deployment Module: This module generates corresponding decoy files based on representative file samples output by the cluster analysis module by copying file content and adjusting filenames. The generated decoy files highly simulate the characteristics of real user files at the metadata level, possessing strong concealment and inducement, and can effectively entice ransomware to access them preferentially during the encryption process. In addition, this module can control the number and distribution density of decoy files generated, balancing system performance overhead and decoy file coverage.

[0060] (5) Dynamic Update Module: Given that the user's file environment may change at any time, in order to maintain the decoy file's inducing effect, this module periodically monitors changes in file attributes in the target directory (such as file additions, deletions, modifications, etc.). Once a significant change is detected, it automatically triggers processes such as file attribute extraction, feature dimensionality reduction, cluster analysis, and decoy file generation to achieve dynamic adaptive updates of the decoy file. This module supports custom update cycles and trigger thresholds to realize a dynamic update mechanism for the decoy file, maintaining continuous awareness of ransomware behavior while also considering system operating efficiency.

[0061] The purpose of the dynamic update module is to ensure that after a large number of changes are made to the files by the user, the decoy file can be regenerated with scientific file attributes according to the changed environment. If ransomware is encountered, it can still detect and terminate the ransomware with minimal file loss.

[0062] like Figure 2As shown, the overall workflow of the ransomware detection method provided in this application embodiment includes: First, the target (file) directory is scanned by the file attribute extraction module to extract metadata information of all files in the target directory, including but not limited to file size, creation time, last modification time, file type, etc., and each file is represented as a corresponding feature vector; then, the feature dimensionality reduction processing module uses an autoencoder to perform feature dimensionality reduction on the original feature vector obtained by the file attribute extraction module to compress redundant dimensions and retain key feature information, effectively reducing subsequent computational overhead; after completing feature dimensionality reduction, the file feature clustering analysis module uses the AP clustering algorithm and the DBSCAN clustering algorithm to perform clustering analysis on the dimensionality-reduced feature vector, respectively. The AP algorithm is used to identify similar file clusters in the file attribute space and selects cluster center samples from each cluster as representatives to represent the common features of this type of file. That is, the AP clustering algorithm adaptively selects files whose file attributes are located at the cluster center from the user files as representative files with common features; the DBSCAN algorithm... Outlier files in low-density areas are used as representative samples with personalized characteristics. The DBSCAN clustering algorithm groups "mainstream files" into a single class while identifying "outliers" that cannot be grouped into the main class. These outliers represent files with personalized attributes and serve as representative files. These two types of representative file samples together form the template for generating decoy files. Then, the decoy file generator copies the selected representative file samples and adjusts the filenames to generate decoy files with highly realistic structural attributes. These decoy files are then deployed in the target directory to increase their access priority in the ransomware encryption ranking process. Furthermore, to ensure the real-time nature of the decoy files, the system has a dynamic update mechanism that periodically monitors file changes in the target directory (such as additions, deletions, and modifications). Once a significant change is detected, the system automatically re-executes the above steps (starting from the step of scanning the target (file) directory from the file attribute extraction module to extract metadata information of all files in the target directory), achieving dynamic adaptive updates of the decoy files to maintain their deceptive ability and detection effectiveness.

[0063] It should be noted that this embodiment is only a brief illustrative description of the overall process of the ransomware detection method. Detailed descriptions of each step can be found in the relevant content of the foregoing embodiments, and will not be repeated here. It is understood that the present invention does not impose any limitations on this.

[0064] This application embodiment determines an original file directory containing several files; performs feature extraction on each file in the original file directory to obtain a high-dimensional attribute feature vector set; performs feature dimensionality reduction on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performs cluster analysis on the low-dimensional attribute feature vector set to construct a decoy file generation template; generates a target decoy file based on the decoy file generation template and deploys the target decoy file in the original file directory to obtain a target file directory; dynamically monitors the behavior of modifying the target decoy file, and when the target decoy file is detected to be modified, the process executing the target file modification behavior is identified as a ransomware process, and the ransomware defense mechanism is triggered. This application embodiment reduces the dimensionality of a high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. This not only significantly reduces the computational overhead of the subsequent clustering stage but also improves the expressive power of the original features. That is, the dimensionality-reduced feature vectors maintain the main semantics while possessing higher computational efficiency and clustering resolution. By performing cluster analysis on the dimensionality-reduced file feature vectors, representative target file samples from the ransomware perspective are identified as decoy file generation templates. This enhances the adaptability and anti-evasion capability against various ransomware encryption strategies. Furthermore, based on the decoy file generation template, highly persuasive decoy files that better match the ransomware's encryption preferences are generated, significantly improving the deception effect of the decoy files on ransomware. Finally, the generated highly persuasive decoy files are deployed in the target file directory, effectively inducing ransomware to prioritize accessing the decoy files in the target file directory during the encryption process. By monitoring the modification behavior of the target decoy files in real time, ransomware can be identified, significantly improving the ability to quickly detect and respond to ransomware, thereby enhancing file security.

[0065] In summary, the ransomware detection method provided in this application differs from current detection methods as follows: (1) Current detection methods typically use decoy files created based on static rules, ignoring the ransomware's encryption behavior based on file attributes. This makes it difficult to personalize the decoy files for different ransomware variants and attack strategies, and fails to effectively adapt to emerging attack methods such as multi-threaded concurrency and file attribute-based encryption, resulting in a decrease in the decoy's effectiveness. However, this application extracts file metadata, converts the files into feature vectors, and combines the AP and DBSCAN algorithms for clustering to extract representative file samples that represent both commonalities and individual characteristics of files. Using these representative file samples as templates, decoy files are generated. The decoy files generated in this application cover both files with common attributes and files with individual attributes within the file clusters, thereby improving the decoy files' adaptability and resistance to evasion of various ransomware encryption strategies.

[0066] (2) Currently, the decoy files used in detection methods are mostly homogeneous files (such as named pipes of uniform type or files of fixed type). Attackers can bypass the decoy files by filtering specific file types or naming characteristics, thereby evading detection. This design lacks adaptability to the diverse attack behaviors of ransomware. However, this application achieves the diversity and high simulation of decoy files by selecting files with representative file attributes as templates for generating decoy files.

[0067] (3) Current detection methods typically use a static deployment method for decoy files, which does not support dynamic updates based on directory changes and is difficult to adapt to changes in the file environment. This application introduces a dynamic update mechanism to maintain the decoy file's ability to induce and detect.

[0068] Therefore, compared with current decoy file deployment methods, this application achieves several technological breakthroughs in decoy generation strategies, coverage, diversity, and deceptiveness. This application proposes a machine learning-based adaptive decoy file deployment method. First, it extracts metadata information from all files in the target directory, representing each file as a corresponding feature vector. Then, it uses AutoEncoder to reduce the dimensionality of the feature vectors and combines AP clustering and DBSCAN clustering algorithms to select representative decoy file samples as templates for generating decoy files, thereby generating highly persuasive decoy files that better match the encryption preferences of ransomware. Compared with traditional methods of generating decoy files based on static rules, this application significantly improves the decoy files' ability to detect ransomware, effectively reduces file loss, and shortens detection latency. The proposed decoy file deployment method has strong adaptability and anti-evasion capabilities, capable of generating highly realistic files in multiple dimensions such as type, size, and timestamp, thus effectively combating ransomware that evades detection by filtering encryption targets. Compared to current methods that only generate homogeneous decoy files (such as using only named pipe type files as decoy files), this application significantly improves the deception effect of decoy files on ransomware by constructing diverse and deceptive decoy files.

[0069] In summary, this application aims to overcome the technical bottlenecks of current decoy file deployment strategies in terms of guidance and adaptability. This application automatically generates highly persuasive decoy files by modeling and analyzing the metadata attributes (such as file size, type, timestamp, etc.) and distribution patterns of real user files in the system. Combined with the structural characteristics of the user file space, this achieves reasonable deployment within the system, thereby increasing the probability of the decoy file being preferentially accessed when ransomware encrypts files, and enhancing the decoy file's ability to perceive ransomware behavior. Specifically, on the one hand, this application can generate decoy files that highly simulate real files in terms of attributes, improving the decoy file's concealment and deception from the ransomware's perspective. On the other hand, by performing cluster analysis on user file attributes, representative files are extracted as templates for generating decoy files, enabling the generated decoy files to cover key feature areas in attribute distribution, prompting preferential access and enhancing the decoy file's adaptability and anti-evasion capabilities against diverse ransomware variants. Through the synergistic effect of these two technologies, the ability of decoy file-based detection methods to quickly detect and respond to ransomware can be significantly improved.

[0070] Please see Figure 3 This application also provides a ransomware detection device 300, which can implement the above-described method. The device includes the following modules: File directory determination module 301 is used to determine the original file directory; wherein, the original file directory contains a number of files; Feature extraction processing module 302 is used to perform feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set; The feature dimensionality reduction processing module 303 is used to perform feature dimensionality reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. Clustering analysis processing module 304 is used to perform clustering analysis processing on the low-dimensional attribute feature vector set and construct a decoy file generation template; The decoy file generation module 305 is used to generate a target decoy file according to the decoy file generation template, and deploy the target decoy file in the original file directory to obtain a target file directory; The decoy file monitoring module 306 is used to dynamically monitor the behavior of modifying the target decoy file. When the target decoy file is detected to be modified, the process that is executing the target file modification behavior is identified as a ransomware process, and the ransomware defense mechanism is triggered.

[0071] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0072] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0073] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0074] Please see Figure 4 , Figure 4 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 401 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 402 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 402 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 402 and is called and executed by the processor 401 using the methods described in the embodiments of this application. Input / output interface 403 is used to implement information input and output; The communication interface 404 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 405 transmits information between various components of the device (e.g., processor 401, memory 402, input / output interface 403, and communication interface 404); The processor 401, memory 402, input / output interface 403 and communication interface 404 are connected to each other within the device via bus 405.

[0075] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0076] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0077] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0078] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0079] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0080] This application provides a ransomware detection method, apparatus, device, medium, and program product, which involves: determining an original file directory containing several files; performing feature extraction on each file in the original file directory to obtain a high-dimensional attribute feature vector set; performing feature dimensionality reduction on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performing cluster analysis on the low-dimensional attribute feature vector set to construct a decoy file generation template; generating a target decoy file based on the decoy file generation template and deploying the target decoy file in the original file directory to obtain a target file directory; dynamically monitoring the modification behavior of the target decoy file; and when the target decoy file is detected to be modified, identifying the process executing the target file modification behavior as a ransomware process and triggering a ransomware defense mechanism. This application embodiment reduces the dimensionality of a high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set. This not only significantly reduces the computational overhead of the subsequent clustering stage but also improves the expressive power of the original features. That is, the dimensionality-reduced feature vectors maintain the main semantics while possessing higher computational efficiency and clustering resolution. By performing cluster analysis on the dimensionality-reduced file feature vectors, representative target file samples from the ransomware perspective are identified as decoy file generation templates. This enhances the adaptability and anti-evasion capability against various ransomware encryption strategies. Furthermore, based on the decoy file generation template, highly persuasive decoy files that better match the ransomware's encryption preferences are generated, significantly improving the deception effect of the decoy files on ransomware. Finally, the generated highly persuasive decoy files are deployed in the target file directory, effectively inducing ransomware to prioritize accessing the decoy files in the target file directory during the encryption process. By monitoring the modification behavior of the target decoy files in real time, ransomware can be identified, significantly improving the ability to quickly detect and respond to ransomware, thereby enhancing file security.

[0081] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0082] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0083] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0084] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0085] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0086] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0087] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0088] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0089] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0090] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0091] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A ransomware detection method, characterized by, The method comprises the following steps: determining an original file directory; wherein the original file directory contains a plurality of files; performing feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set; performing feature dimension reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; performing clustering analysis processing on the low-dimensional attribute feature vector set to construct a deco file generation template; generating a target deco file according to the deco file generation template, and deploying the target deco file in the original file directory to obtain a target file directory; dynamically monitoring the behavior of modifying the target deco file, and when detecting that the target deco file is executed to perform a target file modification behavior, determining a process that performs the target file modification behavior as a ransomware process, and triggering a ransomware defense mechanism.

2. The method of claim 1, wherein, After the step of generating a target deco file according to the deco file generation template, and deploying the target deco file in the original file directory to obtain a target file directory, the method further comprises: periodically monitoring the file attribute changes of each file in the target file directory, and when monitoring that the file attribute changes of any file in the target file directory satisfy a preset deco file update condition, taking the target file directory as the original file directory, and returning to perform the step of performing feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set, until the target deco file is generated, to realize periodic updating of the target deco file.

3. The method of claim 1, wherein, The step of performing feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set comprises: performing traversal operation on each file in the original file directory to extract the metadata attributes of each file in the original file directory; performing unified normalization processing on the metadata attributes of each file in the original file directory to obtain the high-dimensional attribute feature vector corresponding to each file in the original file directory; constructing the high-dimensional attribute feature vector set according to the high-dimensional attribute feature vector corresponding to each file in the original file directory.

4. The method of claim 1, wherein, The step of performing feature dimension reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set comprises: performing nonlinear dimension reduction processing on the high-dimensional attribute feature vector set by using an autoencoder to obtain the low-dimensional attribute feature vector set.

5. The method of claim 1, wherein, The step of performing clustering analysis processing on the low-dimensional attribute feature vector set to construct a deco file generation template comprises: performing first clustering analysis processing on the low-dimensional attribute feature vector set by using a first preset clustering algorithm to obtain common representative files; performing second clustering analysis processing on the low-dimensional attribute feature vector set by using a second preset clustering algorithm to obtain individual representative files; constructing the deco file generation template according to the common representative files and the individual representative files.

6. The method of claim 5, wherein, The step of generating a target deco file according to the deco file generation template comprises: Copy file contents of the common representative file and the individual representative file in the decoy file generation template to a target new file, and modify a file name of the target new file to generate the target decoy file.

7. A ransomware detection apparatus characterized by comprising: The device comprises the following modules: A file directory determination module is configured to determine an original file directory, wherein the original file directory comprises a plurality of files; A feature extraction processing module is configured to perform feature extraction processing on each file in the original file directory to obtain a high-dimensional attribute feature vector set; A feature dimension reduction processing module is configured to perform feature dimension reduction processing on the high-dimensional attribute feature vector set to obtain a low-dimensional attribute feature vector set; A clustering analysis processing module is configured to perform clustering analysis processing on the low-dimensional attribute feature vector set to construct a decoy file generation template; A decoy file generation module is configured to generate a target decoy file according to the decoy file generation template, and deploy the target decoy file in the original file directory to obtain a target file directory; A decoy file monitoring module is configured to dynamically monitor a behavior of modifying the target decoy file, and when detecting that the target decoy file is executed with the target file modification behavior, determine a process that executes the target file modification behavior as a ransomware process, and trigger a ransomware defense mechanism.

8. An electronic device, comprising: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The computer program is executed by the processor to implement the method in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method in any one of claims 1 to 6.

Images