Ransomware defense method and device, equipment and storage medium

Abstract

The invention discloses a ransomware defense method and device, equipment and a storage medium, and relates to the technical field of network and information security, and the method comprises the steps: inducing a ransomware to carry out encryption operation on a honeypot file in a honeypot environment; acquiring encryption behavior data of the ransomware in the encryption operation process; determining a feature combination on which the ransomware judges that the file is encrypted according to the encryption behavior data; according to the ransomware, judging the feature combination on which the file is encrypted depends, and carrying out pseudo-encryption operation on the target file to obtain a pseudo-encrypted file; and establishing a mapping table between the pseudo-encrypted file and the target file so as to recover the pseudo-encrypted file into the target file according to the mapping table. According to the method, the target file is subjected to pseudo-encryption operation, so that the target file is misjudged to be encrypted when the virus is scanned or the file is tried to be accessed, and an actual encryption process is skipped, so that active deception defense for a file system is realized, and the active defense capability for unknown ransomware viruses can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of network and information security technology, and in particular to a method, apparatus, device and storage medium for defending against ransomware. Background Technology

[0002] Ransomware encrypts user files, forcing users to pay a ransom to recover their data, seriously threatening personal privacy and corporate data security. Currently, related technologies mainly focus on pre-attack detection and prevention, including early identification of malware through entropy analysis, behavioral monitoring, and blacklist matching. However, these technologies have significant blind spots when facing new or variant ransomware. Once ransomware has successfully infiltrated and begun encrypting files, these technologies often adopt a passive response, failing to effectively prevent the ransomware from encrypting files. Therefore, improving proactive defense against unknown ransomware has become a pressing technical problem for those skilled in the art. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus, device, and storage medium for defending against ransomware, which can effectively improve the proactive defense capability against unknown ransomware.

[0004] To address the aforementioned technical problems, this application provides a method for defending against ransomware, comprising:

[0005] Inducing ransomware to encrypt honeypot files within the honeypot environment;

[0006] Obtain encryption behavior data of the ransomware during the encryption process;

[0007] Based on the encryption behavior data, determine the combination of features that the ransomware relies on to determine that a file has been encrypted;

[0008] Based on the characteristic combination that the ransomware relies on to determine that a file is encrypted, a pseudo-encryption operation is performed on the target file to obtain a pseudo-encrypted file;

[0009] A mapping table is established between the pseudo-encrypted file and the target file so that the pseudo-encrypted file can be restored to the target file according to the mapping table.

[0010] In some embodiments, the combination of features upon which the ransomware determines that a file has been encrypted, based on the encryption behavior data, includes:

[0011] Feature extraction is performed on the encrypted behavior data;

[0012] An encryption judgment logic model is trained based on the extracted features;

[0013] The encryption determination logic model determines the combination of features that the ransomware relies on to determine if a file is encrypted.

[0014] In some embodiments, performing pseudo-encryption on the target file based on the feature combination relied upon by the ransomware to determine that the file is encrypted includes:

[0015] Based on the combination of features that the ransomware relies on to determine that a file is encrypted, a pseudo-encryption feature template is generated.

[0016] The target file is pseudo-encrypted based on the pseudo-encryption feature template.

[0017] In some embodiments, obtaining the encryption behavior data of the ransomware during the encryption process includes:

[0018] Record the system call sequence and file I / O events when the ransomware performs file encryption;

[0019] Collect data on file change characteristics.

[0020] In some embodiments, it also includes:

[0021] When ransomware activity ceases or defense conditions are terminated, the fake encrypted file is restored to the target file according to the mapping table.

[0022] In some embodiments, feature extraction of the encrypted behavior data includes:

[0023] Feature extraction is performed on the encrypted behavior data to obtain file operation layer features, data structure layer features, and encryption rate distribution features.

[0024] In some embodiments, it also includes:

[0025] Collect encrypted behavioral data on new virus samples;

[0026] The feature library is updated based on the encryption behavior data of the new virus samples;

[0027] The encryption determination logic model is updated using an incremental learning algorithm based on the feature library.

[0028] To address the aforementioned technical problems, this application also provides a ransomware defense device, comprising:

[0029] The inducement module is used to induce ransomware to encrypt honeypot files within the honeypot environment;

[0030] The acquisition module is used to acquire encryption behavior data of the ransomware during the encryption operation process;

[0031] The determination module is used to determine the combination of features that the ransomware relies on to determine that a file has been encrypted, based on the encryption behavior data;

[0032] The pseudo-encryption module is used to perform pseudo-encryption on the target file based on the feature combination that the ransomware relies on to determine that the file is encrypted, so as to obtain a pseudo-encrypted file.

[0033] A module is established to create a mapping table between the pseudo-encrypted file and the target file, so as to restore the pseudo-encrypted file to the target file according to the mapping table.

[0034] To address the aforementioned technical problems, this application also provides an electronic device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor for executing the computer program to implement the ransomware defense method described above.

[0037] To address the aforementioned technical problems, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the ransomware defense method described above.

[0038] The ransomware defense method provided in this application includes: inducing ransomware to encrypt honeypot files in a honeypot environment; acquiring encryption behavior data of the ransomware during the encryption process; determining the feature combination that the ransomware relies on to determine that a file is encrypted based on the encryption behavior data; performing pseudo-encryption on the target file based on the feature combination that the ransomware relies on to determine that a file is encrypted, thereby obtaining a pseudo-encrypted file; and establishing a mapping table between the pseudo-encrypted file and the target file, so as to restore the pseudo-encrypted file to the target file based on the mapping table.

[0039] As can be seen, the ransomware defense method provided in this application constructs a honeypot environment to induce ransomware to perform encryption operations and obtains encryption behavior data of the ransomware during the encryption process. Based on the encryption behavior data, it determines the feature combinations that the ransomware relies on to determine if a file is encrypted. According to the feature combinations that the ransomware relies on to determine if a file is encrypted, it performs a pseudo-encryption operation on the target file, causing the target file to be mistakenly judged as encrypted when the virus scans or attempts to access the file, thus skipping the actual encryption process, thereby achieving proactive deception defense against the file system. The entire process does not require prior identification of the virus type, and the pseudo-encryption operation is non-destructive, ensuring file integrity. In addition, the target file can be restored at any time through the mapping table. This effectively improves the proactive defense capability against unknown ransomware.

[0040] The ransomware defense devices, equipment, and computer-readable storage media provided in this application all have the aforementioned technical effects. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the prior art and embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A schematic flowchart illustrating a ransomware defense method provided in an embodiment of this application;

[0043] Figure 2 A schematic diagram of a ransomware defense system provided in an embodiment of this application;

[0044] Figure 3 A schematic diagram of a ransomware defense device provided in an embodiment of this application;

[0045] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0046] The core of this application is to provide a method, device, equipment, and storage medium for defending against ransomware, which can effectively improve the proactive defense capability against unknown ransomware.

[0047] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a ransomware defense method provided in an embodiment of this application. (Refer to...) Figure 1 As shown, the method includes:

[0049] S101: Induces ransomware to encrypt honeypot files within the honeypot environment.

[0050] A honeypot environment refers to a specific file directory built in an isolated environment, in which a set of fake files with the same structure as the real business environment are deployed. The purpose is to induce ransomware to prioritize attacking the set of fake files through access inducement strategies.

[0051] In an isolated virtualized execution environment, a controlled honeypot directory is built, and a set of pseudo-files with a structure consistent with the real business environment is deployed—that is, honeypot files. The content of the honeypot files is similar to that of real files, but does not contain important data. This guides ransomware to attack these honeypot files first, without affecting the actual business data.

[0052] By setting up access inducement strategies, such as file naming, path simulation, and access permission adjustments, ransomware can be induced to prioritize encrypting honeypot files. This approach effectively guides ransomware to encrypt honeypot files, preventing actual damage to the production environment. Furthermore, system-level hooks or kernel monitoring mechanisms can be used to capture the ransomware's encryption calls at the file operation and memory levels. Real-time monitoring can record the ransomware's encryption behavior, providing crucial data support for subsequent analysis.

[0053] This application embodiment dynamically constructs a honeypot directory consistent with the real business environment in an isolated virtualized execution environment. It employs system-level hooks and kernel monitoring mechanisms to capture ransomware behavior, achieving secure and controllable behavior trapping and full-process data collection. Compared to existing static trapping methods, this application embodiment can avoid ransomware detecting honeypot traces and can record underlying behavior in real time.

[0054] S102: Obtain the encryption behavior data of the ransomware during the encryption operation process.

[0055] In some embodiments, obtaining the encryption behavior data of the ransomware during the encryption process includes:

[0056] Record the system call sequence and file I / O events when the ransomware performs file encryption;

[0057] Collect data on file change characteristics.

[0058] Record the system call sequence and file I / O events during ransomware file encryption. This sequence reveals the underlying operations of the ransomware during file encryption, aiding in the analysis of its encryption behavior. Collect file change characteristic data. This data includes changes in file extensions, file header and footer structures, file block encryption intervals, and information entropy changes. This data provides crucial information for determining whether a file has been encrypted. The collected encryption behavior data can be archived into an encryption behavior dataset using a log analysis component. This dataset provides a rich sample of encryption behaviors for subsequent analysis and learning.

[0059] This application embodiment records the system call sequence and file I / O events during the virus encryption process in real time through a system-level monitoring interface, collects file block operations and information entropy changes, and archives them as an encryption behavior dataset. This collection method has higher granularity and can reflect the dynamic characteristics of encryption behavior.

[0060] S103: Determine the combination of features that the ransomware relies on to determine that a file has been encrypted based on the encryption behavior data.

[0061] In some embodiments, the combination of features upon which the ransomware determines that a file has been encrypted, based on the encryption behavior data, includes:

[0062] Feature extraction is performed on the encrypted behavior data;

[0063] An encryption judgment logic model is trained based on the extracted features;

[0064] The encryption determination logic model determines the combination of features that the ransomware relies on to determine if a file is encrypted.

[0065] In some embodiments, feature extraction of the encrypted behavior data includes:

[0066] Feature extraction is performed on the encrypted behavior data to obtain file operation layer features, data structure layer features, and encryption rate distribution features.

[0067] The encrypted behavior data is preprocessed and standardized. Preprocessing helps reduce noise. Feature extraction is performed on the encrypted behavior data, extracting file operation layer features, data structure layer features, and encryption rate distribution features. Extracting multi-dimensional features aims to provide sufficient input data for pattern recognition of virus encryption behavior. Through feature clustering and pattern mining algorithms, the characteristic conditions relied upon by ransomware when determining whether a file is encrypted can be identified. Data mining techniques are used to reveal the internal logic of the virus in determining the file encryption status, helping to build an encryption determination logic model.

[0068] This application's embodiments extract features from multiple dimensions—file operation layer, data structure layer, and encryption rate layer—and can reveal the inherent logical conditions by which ransomware determines whether a file is encrypted through clustering and pattern mining algorithms.

[0069] The extracted multidimensional features (file operation layer features, data structure layer features, and encryption rate distribution features) are input into a machine learning model to train the encryption determination logic. By training the model, logical rules for determining whether a file is encrypted can be obtained. Using labeled encrypted and unencrypted samples, the model is trained to obtain the determination boundary for the file encryption state. Through training, the encryption determination logic model can distinguish the differences between encrypted and unencrypted files and clearly define the determination rules. The output encryption determination logic model is used for subsequent pseudo-encryption template generation.

[0070] By inputting multidimensional features into a machine learning model, the system automatically learns the logical boundary conditions used by ransomware to determine the encryption status of files, forming an interpretable encryption judgment logic model. This model can adaptively train on new samples, achieving automated learning and evolution, thus solving the problem of rigidity in traditional static rule systems.

[0071] S104: Based on the feature combination that the ransomware relies on to determine that a file is encrypted, perform a pseudo-encryption operation on the target file to obtain a pseudo-encrypted file.

[0072] The ransomware performs a pseudo-encryption operation on the target file based on the characteristic combinations it relies on to determine if a file is encrypted. This pseudo-encryption causes the ransomware to mistakenly believe the file is already encrypted, thus allowing it to skip the actual encryption process. The target file is the real file to be pseudo-encrypted.

[0073] In some embodiments, performing pseudo-encryption on the target file based on the feature combination relied upon by the ransomware to determine that the file is encrypted includes:

[0074] Based on the combination of features that the ransomware relies on to determine that a file is encrypted, a pseudo-encryption feature template is generated.

[0075] The target file is pseudo-encrypted based on the pseudo-encryption feature template.

[0076] Based on the encryption judgment logic model, the key feature combinations required by ransomware to determine if a file is encrypted are identified. By analyzing the model output, the feature combinations relied upon by ransomware when judging the file encryption status are determined. A pseudo-encryption template is generated, including operations such as extension modification, pseudo-random file header injection, timestamp adjustment, and file attribute spoofing. Based on the ransomware's logical conditions for judging the file encryption status, pseudo-encryption features can be generated to simulate a file already encrypted, thereby deceiving the ransomware.

[0077] Based on the encryption judgment model, this application embodiment dynamically generates a pseudo-encryption feature template that includes operations such as extension modification, pseudo-random file header injection, and timestamp spoofing. The file is pseudo-encrypted according to the pseudo-encryption feature template, so that the ransomware will mistakenly judge that the file is encrypted when scanning or accessing it, thereby skipping the actual encryption process.

[0078] S105: Establish a mapping table between the pseudo-encrypted file and the target file, so as to restore the pseudo-encrypted file to the target file according to the mapping table.

[0079] A mapping table is established between the pseudo-encrypted file and the original target file. The mapping table is used to record the correspondence between the file after the pseudo-encryption operation is performed and the original target file, and serves as the basis for file state recovery.

[0080] In some embodiments, it also includes:

[0081] When ransomware activity ceases or defense conditions are terminated, the fake encrypted file is restored to the target file according to the mapping table.

[0082] When virus activity terminates or defense conditions cease, the mapping table is invoked to batch restore the original state of the pseudo-encrypted files. The files are restored to their normal state through the mapping table, preventing them from being encrypted and corrupted by the virus. The pseudo-random file header and extension identifier are removed, restoring the file metadata. It is ensured that there are no traces of pseudo-encryption after file recovery to maintain the file's authenticity and usability. File usability is verified to ensure that the pseudo-encryption operation did not affect the integrity of the file content. A file integrity check ensures that the recovered files can be used normally and that their content has not been tampered with.

[0083] This application's embodiments implement a recovery mechanism that achieves a one-to-one correspondence between the pseudo-encrypted file and the original target file through a mapping table. After the defense is completed, the pseudo-random file header is automatically deleted, the extension and timestamp are restored, ensuring file integrity and availability without manual intervention. This non-destructive defense mechanism completes defense and recovery in a closed loop within the same logical system.

[0084] In some embodiments, it also includes:

[0085] Collect encrypted behavioral data on new virus samples;

[0086] The feature library is updated based on the encryption behavior data of the new virus samples;

[0087] The encryption determination logic model is updated using an incremental learning algorithm based on the feature library.

[0088] This embodiment aims to perform adaptive incremental updates of the model to cope with the variants and evolution of ransomware.

[0089] Continuously collect encryption behavior data of new virus samples to form a dynamic feature library. By collecting encryption behavior data of new viruses and establishing and updating the feature library, the defense system can identify new ransomware behaviors. Utilize incremental learning algorithms to update the encryption judgment logic model and expand the pseudo-encryption template library. Through incremental learning algorithms, update the model to adapt to the encryption behavior of new ransomware and optimize pseudo-encryption feature templates. Achieve self-evolution of the defense strategy to adapt to changes in the encryption characteristics of new ransomware. Through automated learning and updating mechanisms, the defense system can continuously adapt to ransomware variants and continuously improve its defense capabilities.

[0090] By continuously collecting behavioral data from new virus samples through incremental learning algorithms, the system dynamically updates the model and pseudo-encryption template library, achieving self-evolution and long-term effectiveness of the defense strategy. The system possesses continuous learning and self-evolution capabilities, automatically adjusting its feature judgment logic to maintain defense effectiveness when facing unknown ransomware.

[0091] The embodiments of this application are mainly applied to file system defense at the operating system level. Its core idea (learning the judgment logic of malware and deceiving it) can be extended to other fields, such as:

[0092] Applications in network intrusion detection: Learn the characteristics and logic of an intruder scanning network ports or services, and then deceive them by returning forged response data.

[0093] Applications in data access control: Learn the logic of unauthorized users accessing specific sensitive data and mislead them by falsifying data or metadata.

[0094] To address fake encryption operations, the fake encryption signature template can incorporate time-related features. For example, ransomware might rely on the file's most recent modification or access time to help determine if it's encrypted, so the timestamp can be dynamically adjusted. For different file types (e.g., documents, images, database files), the fake encryption signature template can be more refined. For instance, for database files, specific database file header markers can be forged instead of simply using a generic pseudo-random file header.

[0095] refer to Figure 2As shown, the ransomware defense method provided in this application can be implemented based on an isolation analysis environment module, a low-level behavior data acquisition module, an encryption pattern learning module, a pseudo-encryption execution module, a core data storage module, and a file recovery and adaptation module. The isolation analysis environment module achieves secure trapping of ransomware behavior by constructing controlled sandboxes and honeypot directories. The low-level behavior data acquisition module captures the virus's low-level file I / O and system call behavior in real time, providing fine-grained analysis data. This data is fed into the encryption pattern learning module, which trains a set of inherent logical conditions describing the virus's encryption judgment through multi-dimensional feature extraction and interpretable machine learning. The pseudo-encryption execution module dynamically generates pseudo-encryption feature templates using these inherent logical conditions and performs non-destructive deception operations on target files. The core data storage module is mainly responsible for maintaining the mapping table and encryption behavior dataset, supporting the deception, recovery, and learning processes. The file recovery and adaptation module ensures file content integrity and performs recovery based on the mapping table, while continuously updating the logical model using an incremental learning algorithm, giving the defense strategy self-evolution capabilities, thereby constructing an intelligent ransomware defense system.

[0096] In summary, the ransomware defense method provided in this application constructs a honeypot environment to induce ransomware to perform encryption operations and obtains encryption behavior data during the encryption process. Based on the encryption behavior data, it determines the feature combinations that the ransomware relies on to determine if a file is encrypted. According to the feature combinations relied upon by the ransomware to determine if a file is encrypted, it performs a pseudo-encryption operation on the target file, causing the target file to be mistakenly identified as encrypted when the virus scans or attempts to access the file, thus skipping the actual encryption process and achieving proactive deception defense against the file system. The entire process does not require prior identification of the virus type, and the pseudo-encryption operation is non-destructive, ensuring file integrity. Furthermore, the target file can be restored at any time through a mapping table. This effectively improves the proactive defense capability against unknown ransomware.

[0097] This application also provides a ransomware defense device, which is described below and can be referred to in conjunction with the method described above. Please refer to... Figure 3 , Figure 3 This is a schematic diagram of a ransomware defense device provided in an embodiment of this application, combined with... Figure 3 As shown, the device includes:

[0098] The inducement module 10 is used to induce ransomware to encrypt honeypot files in the honeypot environment;

[0099] The acquisition module 20 is used to acquire encryption behavior data of the ransomware during the encryption operation process;

[0100] The determination module 30 is used to determine the combination of features that the ransomware relies on to determine that a file has been encrypted, based on the encryption behavior data.

[0101] The pseudo-encryption module 40 is used to perform pseudo-encryption on the target file based on the feature combination on which the ransomware determines that the file is encrypted, so as to obtain a pseudo-encrypted file.

[0102] The module 50 is used to establish a mapping table between the pseudo-encrypted file and the target file, so as to restore the pseudo-encrypted file to the target file according to the mapping table.

[0103] Based on the above embodiments, as a specific implementation method, the determining module 30 includes:

[0104] The extraction unit is used to extract features from the encrypted behavior data;

[0105] The training unit is used to train an encryption decision logic model based on the extracted features.

[0106] The determining unit is used to determine the combination of features on which the ransomware determines that the file has been encrypted, based on the encryption determination logic model.

[0107] Based on the above embodiments, as a specific implementation method, the pseudo-encryption module 40 includes:

[0108] The generation unit is used to generate a pseudo-encryption feature template based on the feature combination that the ransomware relies on to determine that a file is encrypted.

[0109] The pseudo-encryption unit is used to perform pseudo-encryption operations on the target file according to the pseudo-encryption feature template.

[0110] Based on the above embodiments, as a specific implementation method, the acquisition module 20 includes:

[0111] The recording unit is used to record the system call sequence and file I / O events when the ransomware performs file encryption.

[0112] The acquisition unit is used to collect data on file change characteristics.

[0113] Based on the above embodiments, as a specific implementation method, it further includes:

[0114] The recovery module is used to restore the fake encrypted file to the target file according to the mapping table when ransomware activity stops or defense conditions are terminated.

[0115] Based on the above embodiments, as a specific implementation method, the extraction unit is used for:

[0116] Feature extraction is performed on the encrypted behavior data to obtain file operation layer features, data structure layer features, and encryption rate distribution features.

[0117] Based on the above embodiments, as a specific implementation method, it further includes:

[0118] The collection module is used to collect encrypted behavioral data of new virus samples;

[0119] The first update module is used to update the feature library based on the encrypted behavior data of the new virus sample;

[0120] The second update module is used to update the encryption judgment logic model based on the feature library using an incremental learning algorithm.

[0121] The ransomware defense device provided in this application constructs a honeypot environment to induce ransomware to perform encryption operations and obtains encryption behavior data during the encryption process. Based on the encryption behavior data, it determines the feature combinations that the ransomware relies on to determine if a file is encrypted. According to the feature combinations relied upon by the ransomware to determine if a file is encrypted, it performs a pseudo-encryption operation on the target file, causing the target file to be mistakenly identified as encrypted when the virus scans or attempts to access the file, thus skipping the actual encryption process and achieving proactive deception defense against the file system. The entire process does not require prior identification of the virus type, and the pseudo-encryption operation is non-destructive, ensuring file integrity. Furthermore, the target file can be restored at any time through a mapping table. This effectively improves the proactive defense capability against unknown ransomware.

[0122] This application also provides an electronic device, referenced... Figure 4 As shown, the device includes a memory 1 and a processor 2.

[0123] Memory 1 is used to store computer programs;

[0124] Processor 2 is used to execute computer programs to perform the following steps:

[0125] In a honeypot environment, a ransomware virus is induced to encrypt files within the honeypot; encryption behavior data of the ransomware virus during the encryption process is obtained; based on the encryption behavior data, the feature combination that the ransomware virus relies on to determine that a file is encrypted is determined; a pseudo-encryption operation is performed on the target file based on the feature combination that the ransomware virus relies on to determine that a file is encrypted, resulting in a pseudo-encrypted file; a mapping table is established between the pseudo-encrypted file and the target file, so that the pseudo-encrypted file can be restored to the target file based on the mapping table.

[0126] For a description of the equipment provided in this application, please refer to the above method embodiments; further details will not be provided here.

[0127] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the following steps:

[0128] In a honeypot environment, a ransomware virus is induced to encrypt files within the honeypot; encryption behavior data of the ransomware virus during the encryption process is obtained; based on the encryption behavior data, the feature combination that the ransomware virus relies on to determine that a file is encrypted is determined; a pseudo-encryption operation is performed on the target file based on the feature combination that the ransomware virus relies on to determine that a file is encrypted, resulting in a pseudo-encrypted file; a mapping table is established between the pseudo-encrypted file and the target file, so that the pseudo-encrypted file can be restored to the target file based on the mapping table.

[0129] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0130] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0131] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatuses, devices, and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant details can be found in the method section.

[0132] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0133] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0134] The ransomware defense methods, apparatus, devices, and storage media provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for defending against ransomware, characterized in that, include: Inducing ransomware to encrypt honeypot files within the honeypot environment; Obtain encryption behavior data of the ransomware during the encryption process; Based on the encryption behavior data, determine the combination of features that the ransomware relies on to determine that a file has been encrypted; Based on the characteristic combination that the ransomware relies on to determine that a file is encrypted, a pseudo-encryption operation is performed on the target file to obtain a pseudo-encrypted file; A mapping table is established between the pseudo-encrypted file and the target file so that the pseudo-encrypted file can be restored to the target file according to the mapping table.

2. The ransomware defense method according to claim 1, characterized in that, The combination of features that the ransomware relies on to determine whether a file is encrypted, based on the encryption behavior data, includes: Feature extraction is performed on the encrypted behavior data; An encryption judgment logic model is trained based on the extracted features; The encryption determination logic model determines the combination of features that the ransomware relies on to determine if a file is encrypted.

3. The ransomware defense method according to claim 1, characterized in that, The pseudo-encryption operation on the target file based on the characteristic combination relied upon by the ransomware to determine that the file is encrypted includes: A pseudo-encryption feature template is generated based on the combination of features that the ransomware relies on to determine that a file is encrypted. The target file is pseudo-encrypted based on the pseudo-encryption feature template.

4. The ransomware defense method according to claim 1, characterized in that, Obtaining the encryption behavior data of the ransomware during the encryption process includes: Record the system call sequence and file I / O events when the ransomware performs file encryption; Collect data on file change characteristics.

5. The ransomware defense method according to claim 1, characterized in that, Also includes: When ransomware activity ceases or defense conditions are terminated, the fake encrypted file is restored to the target file according to the mapping table.

6. The ransomware defense method according to claim 2, characterized in that, Feature extraction of the encrypted behavior data includes: Feature extraction is performed on the encrypted behavior data to obtain file operation layer features, data structure layer features, and encryption rate distribution features.

7. The ransomware defense method according to claim 2, characterized in that, Also includes: Collect encrypted behavioral data on new virus samples; The feature library is updated based on the encryption behavior data of the new virus samples; The encryption determination logic model is updated using an incremental learning algorithm based on the feature library.

8. A ransomware defense device, characterized in that, include: The inducement module is used to induce ransomware to encrypt honeypot files within the honeypot environment; The acquisition module is used to acquire encryption behavior data of the ransomware during the encryption operation process; The determination module is used to determine the combination of features that the ransomware relies on to determine that a file has been encrypted, based on the encryption behavior data; The pseudo-encryption module is used to perform pseudo-encryption on the target file based on the feature combination that the ransomware relies on to determine that the file is encrypted, so as to obtain a pseudo-encrypted file. A module is established to create a mapping table between the pseudo-encrypted file and the target file, so as to restore the pseudo-encrypted file to the target file according to the mapping table.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the ransomware defense method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the ransomware defense method as described in any one of claims 1 to 7.

Images