Defense method and device for ransomware encrypted file and storage medium
By generating a substitute file at the kernel driver layer and redirecting suspicious process handles, the problem of missed detection in ransomware defense in existing technologies is solved, achieving effective defense against ransomware-encrypted files. It is applicable to multiple operating systems and application areas.
Patent Information
- Application Number
- CN202511144510.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-15
- Publication Date
- 2026-02-13
AI Technical Summary
Existing endpoint ransomware protection software relies on behavioral analysis and judgment, which cannot effectively prevent ransomware from performing its first encryption action, resulting in a high risk of file encryption and leakage.
By monitoring file operations at the kernel driver level, generating surrogate files and redirecting file handles of suspicious processes, ransomware behavior can be identified by judging process attributes and operation behavior, thus preventing file encryption.
Effectively defends against ransomware encryption of files, reduces false negative rates, avoids file encryption and leakage risks, and is applicable to multiple operating systems and application areas.
Smart Images
Figure CN121525075A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of ransomware defense, and in particular to a defense method and device for ransomware encrypted files and a storage medium. BACKGROUND
[0003] Ransom attacks generally cause data theft, data encryption and business interruption, resulting in data exposure, file unlocking, business recovery, economic loss and reputation loss.
[0004] Most terminal anti-ransomware software and terminal security software currently rely on behavior analysis to intercept ransomware. This technical means is the main defense module of the terminal security software to actively monitor whether the terminal has a batch file encryption behavior, and combines the signature attributes and other characteristics of the process to determine whether it is a ransomware encryption behavior. If so, the terminal security software will alarm and block behavior. The disadvantage of this technology is that the first encryption behavior of the ransomware has been successful. Even if some terminal security software has the ability to automatically backup files, it cannot avoid the possibility of encrypted file leakage. SUMMARY
[0005] To solve the above technical problems, the present application provides a defense method for ransomware encrypted files. When the kernel driver layer perceives that a process is opening a file, it determines whether the process is a suspicious process.
[0006] If so, a dummy file is generated; the original file handle requested by the suspicious process is redirected to the dummy file.
[0007] The file is a preset protected file.
[0008] Further, the determination of whether the process is a suspicious process comprises:
[0009] The kernel driver layer identifies the attributes of the process. If the process is any one of a non-system process, a non-trusted process or a non-officially authorized digitally signed process, the process is determined to be a suspicious process.
[0010] Further, it is monitored whether the suspicious process performs an operation on the dummy file; if so, the dummy file is analyzed for format.
[0011] If the format of the dummy file is damaged, the suspicious process is determined to be a ransom behavior.
[0012] Further, in the monitoring of whether the suspicious process performs an operation on the dummy file, the operation performed includes renaming, writing, moving and closing.
[0013] Further, before determining that the suspicious process is a ransom behavior, the method further comprises determining whether the damaged file is greater than a preset value, and if yes, determining that the suspicious process is a ransom behavior.
[0014] The present application provides a defense system against ransomware encrypted files, characterized in that it comprises:
[0015] A defense module located in the kernel driver layer for monitoring file operations;
[0016] A dummy file generation module for generating dummy files;
[0017] When the defense module perceives that a process is opening a file, it determines whether the process is a suspicious process; if yes, it redirects the original file handle requested by the suspicious process to a dummy file.
[0018] The present application provides a defense device against ransomware encrypted files, comprising:
[0019] A file perception unit for the kernel driver layer to perceive that a process is opening a file;
[0020] A process determination unit for determining whether the process is a suspicious process;
[0021] A file generation unit for generating dummy files;
[0022] A file replacement unit for redirecting the original file handle requested by the suspicious process to a dummy file;
[0023] A main processing unit for realizing parameter input, acquisition and function configuration of the file perception unit, the process determination unit, the file generation unit and the file replacement unit.
[0024] The present application embodiment provides a storage medium, wherein the storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the steps of the defense method against ransomware encrypted files provided by the present application embodiment.
[0025] The present application can effectively defend against ransomware encrypted terminal files and leaked files, greatly optimize the current ransomware defense means relying on ransomware detection engine and behavior analysis determination technology, reduce the probability of ransomware false negatives, and also avoid the risk of file encryption and leakage caused by the first encryption behavior of ransomware. BRIEF DESCRIPTION OF DRAWINGS
[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0027] Figure 1 A flowchart illustrating a ransomware encryption file defense method provided in this embodiment of the invention;
[0028] Figure 2 A flowchart of a ransomware-encrypted file defense system provided in an embodiment of the present invention;
[0029] Figure 3 This is a structural diagram of a ransomware-encrypted file defense device provided in an embodiment of the present invention;
[0030] Figure 4 This is a structural diagram of another ransomware encryption file defense device provided in an embodiment of the present invention. Detailed Implementation
[0031] To better understand the purpose, structure, and function of this invention, the invention will be described in further detail below with reference to the accompanying drawings.
[0032] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0033] This invention provides a flowchart of a method for defending against ransomware encryption of files, as shown in the following embodiments. Figure 1 As shown, the method in this embodiment may include the following steps 101-105:
[0034] Step 101: The kernel driver layer detects that the process is opening a file.
[0035] In this embodiment, the kernel driver layer for ransomware detection automatically identifies and senses whether a process is opening a preset protected file. If an opening operation for a preset protected file is detected, it immediately determines whether the process is a suspicious process.
[0036] The preset protected files can be system files, trusted files, or user-defined files.
[0037] Step 102: Determine whether the process is a suspicious process.
[0038] In this step, the attribute of the process needs to be identified by the kernel driver layer. If the process is any one of a non-system process, a non-trusted process, or a non-officially authorized digitally signed process.
[0039] The system process is the main process of the Windows system, such as system.exe, explorer.exe, svchost.exe, etc.
[0040] The trusted process is a process in the anti-ransom process whitelist customized by the user according to the user's use scenario and defense range.
[0041] The officially authorized digitally signed process is a digitally signed process authorized by Microsoft.
[0042] If the process is any one of a non-system process, a non-trusted process, or a non-officially authorized digitally signed process, it is determined to be a suspicious process, and step 103 is performed.
[0043] If the process is not a suspicious process, step 104 is performed.
[0044] Step 103, automatically generating a dummy file.
[0045] In this step, the kernel driver layer for ransomware detection will create a dummy file with similar attributes such as format and size based on the attributes of the file.
[0046] Step 104, allowing the process to open the file and operate.
[0047] If the process is not a suspicious process, i.e., the process is any one of a system process, a trusted process, or an officially authorized digitally signed process, the process is allowed to open the file and operate.
[0048] Step 105, redirecting the original file handle requested by the suspicious process to the dummy file.
[0049] When the kernel driver layer senses that the suspicious process is opening a file, it redirects the original file handle requested by the suspicious process to the dummy file. If all subsequent ransom behavior operations are operations on the dummy file rather than reading the file, this technical method will ensure that the files in the terminal will not be encrypted and leaked by ransomware.
[0050] Monitoring whether the suspicious process performs operations on the dummy file, including renaming, writing, moving, closing, etc.
[0051] If so, format analysis is performed on the dummy file.
[0052] If the format of the dummy file is destroyed, it is determined that the suspicious process is a ransom behavior.
[0053] Before determining the suspicious process as the ransom behavior, further comprising: determining whether the damaged file is greater than a preset value, and if yes, determining the suspicious process as the ransom behavior, wherein the preset value can be 5.
[0054] If the format of the dummy file is not damaged, it cannot be simply determined that the suspicious process is not a ransom behavior, and further research and judgment are needed in combination with subsequent operations.
[0055] The corresponding operation handle of the suspicious process performed on the dummy file is redirected to the original preset protection file to generate a new preset protection file, and the original preset protection file and the dummy file are backed up.
[0056] In the embodiment, the terminal file encrypted by the ransomware and the leaked file are effectively prevented by the file replacement method, the current ransomware defense means relying on the ransom virus detection engine and behavior analysis determination technology is greatly optimized, and the risk of ransom virus false reporting, file encryption and leakage is avoided.
[0057] The embodiment of the application provides a defense system flowchart for a ransomware encrypted file, as shown in Figure 2 The method of the embodiment can include the following modules 201-202.
[0058] The defense module 201 is located in the kernel driver layer and is used for monitoring file operations.
[0059] The dummy file generation module 202 is used for generating a dummy file.
[0060] When the defense module perceives that a process is opening a file, it is determined whether the process is a suspicious process, and if yes, the original file handle requested by the suspicious process to access is redirected to the dummy file.
[0061] Further, it is determined whether the process is a suspicious process, comprising:
[0062] The kernel driver layer identifies the attribute of the process, and if the process is any one of a non-system process, a non-trusted process or a non-officially authorized digitally signed process, the process is determined as a suspicious process.
[0063] Further, it is monitored whether the suspicious process performs an operation on the dummy file, and if yes, the format of the dummy file is analyzed.
[0064] If the format of the dummy file is damaged, the suspicious process is determined as a ransom behavior.
[0065] Further, in the monitoring of whether the suspicious process performs an operation on the dummy file, the operation performed includes renaming, writing, moving and closing.
[0066] Further, before determining that the suspicious process is a ransomware, the method further comprises determining whether the damaged file is greater than a preset value, and if yes, determining that the suspicious process is a ransomware.
[0067] The technology can support Windows system, Linux system, unix system, embedded system, FreeBSD system and domestic operating system, and has little influence on the performance of the operating system, and can be widely applied to network servers, data centers, industrial control and personal desktops and other fields.
[0068] The following is an apparatus embodiment of the present application, which can be used to execute the method embodiment of the present application. For details not disclosed in the apparatus embodiment, please refer to the method embodiment of the present application.
[0069] As shown in Figure 3 , the embodiment of the present application provides a device for a defense device against ransomware encrypted files and a defense device against ransomware encrypted files. The embodiment of the device can be realized by software, or realized by hardware or a combination of software and hardware.
[0070] From the hardware layer, as shown in Figure 3 , a hardware structure diagram of a device for a defense device against ransomware encrypted files is provided in the embodiment of the present application. In addition to the processor, memory, network interface and non-volatile memory shown in Figure 3 , the device for the defense device against ransomware encrypted files in the embodiment usually can also include other hardware, such as a forwarding chip responsible for processing packets and the like.
[0071] Taking software implementation as an example, as shown in Figure 4 , as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the CPU of the device where it is located. As shown in Figure 4 , the embodiment of the present application provides a defense device against ransomware encrypted files, which comprises a file perception unit 401, a process judgment unit 402, a file generation unit 403, a file replacement unit 404 and a main processing unit 405.
[0072] The file perception unit 401 is used for the kernel driver layer to perceive that a process is opening a file.
[0073] In the embodiment, the kernel driver layer for ransomware detection automatically identifies and perceives whether a process is opening a preset protected file. If it is detected that there is an opening operation for the preset protected file, it is immediately determined whether the process is a suspicious process.
[0074] The preset protection file can be a system file, a trusted file or a user-defined file.
[0075] The process judging unit 402 is configured to judge whether the process is a suspicious process.
[0076] In this step, the attribute of the process is identified by the kernel driver layer, and if the process is any one of a non-system process, a non-trusted process or a non-officially authorized digitally signed process.
[0077] The system process is a main process of the Windows system, such as system.exe, explorer.exe, svchost.exe, etc.
[0078] The trusted process is a process in the anti-ransom process whitelist defined by the user according to the use scene and defense range of the user.
[0079] The officially authorized digitally signed process is a digitally signed process authorized by Microsoft.
[0080] If the process is any one of a non-system process, a non-trusted process or a non-officially authorized digitally signed process, it is determined to be a suspicious process.
[0081] The file generating unit 403 is configured to generate a dummy file.
[0082] In this step, the kernel driver layer for ransomware detection will make a dummy file with similar attributes such as format and size according to the attributes of the file.
[0083] The file replacing unit 404 is configured to redirect the original file handle requested by the suspicious process to access to the dummy file.
[0084] When the kernel driver layer perceives that the suspicious process is opening a file, the original file handle requested by the suspicious process to access is redirected to the dummy file, and if all subsequent ransom behavior operations are operations on the dummy file rather than reading the file, this technical method will ensure that the files in the terminal will not be encrypted and leaked by the ransomware.
[0085] The suspicious process is monitored to determine whether it performs operations on the dummy file, and the operations include renaming, writing, moving, closing, etc.
[0086] If so, the format of the dummy file is analyzed.
[0087] If the format of the dummy file is damaged, it is determined that the suspicious process is a ransom behavior.
[0088] Before the suspicious process is determined to be a ransom behavior, it further includes judging whether the damaged file is greater than a preset value, and if so, determining that the suspicious process is a ransom behavior.
[0089] The main processing unit 405 is configured to implement the parameter input, acquisition and function configuration of the file perception unit, the process judgment unit, the file generation unit and the file replacement unit.
[0090] The embodiment of the present application further provides a computer readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method in any of the foregoing implementation manners.
[0091] It should be noted that, in the present document, the relationship terms such as first and second are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.
[0092] Each embodiment in the present specification is described in a related manner, and the same or similar parts between each embodiment can be referred to each other, and each embodiment mainly explains the difference from other embodiments.
[0093] Especially, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiment.
[0094] For the convenience of description, the above device is described in various units / modules respectively according to functions. Of course, in the implementation of the present application, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.
[0095] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiment methods can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM) and the like.
[0096] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.
Claims
1. A method for defending against ransomware encryption of files, characterized in that: When the kernel driver layer detects that a process is opening a file, it determines whether the process is suspicious. If so, generate a substitute file; redirect the original file handle requested by the suspicious process to the substitute file; The file in question is a pre-protected file.
2. The method as described in claim 1, characterized in that, The determination of whether the process is a suspicious process includes: The kernel driver layer identifies the attributes of the process. If the process is any of the following: a non-system process, an untrusted process, or a non-official authorized digital signature non-formal signature process, then the process is determined to be a suspicious process.
3. The method as described in claim 2, characterized in that, It also includes monitoring whether the suspicious process performs operations on the substitute file; if so, performing format analysis on the substitute file; If the format of the substitute file is corrupted, the suspicious process is determined to be an extortion attempt.
4. The method as described in claim 3, characterized in that, In monitoring whether the suspicious process performs operations on the substitute file, the operations performed include renaming, writing, moving, and closing.
5. The method as described in claim 3, characterized in that: Before determining that the suspicious process is a ransomware attack, the method further includes determining whether the damaged file is larger than a preset value. If it is larger, the suspicious process is determined to be a ransomware attack.
6. A defense system against ransomware-encrypted files, characterized in that: include: The defense module, located in the kernel driver layer, is used to monitor file operations; The substitute file generation module is used to generate substitute files; When the defense module detects that a process is opening a file, it determines whether the process is suspicious; if so, it redirects the original file handle requested by the suspicious process to the substitute file.
7. A defense device based on ransomware encryption of files, characterized in that, include: File awareness unit: used by the kernel driver layer to detect when a process is opening a file; Process determination unit: used to determine whether the process is a suspicious process; File generation unit: used to generate substitute files; File replacement unit: used to redirect the original file handle requested by a suspicious process to a substitute file; Main processing unit: Used to implement parameter input, acquisition, and function configuration for the file reading perception unit, process judgment unit, file generation unit, and file replacement unit.
8. A storage medium, characterized in that, The storage medium stores multiple instructions, which are adapted to be loaded by a processor and executed as steps of any of the methods described in claims 1-5.