Real-time ransomware protection backup method and device based on file system

Abstract

The invention provides a real-time ransomware protection backup method and device based on a file system. The method relates to the field of information security and data protection, and comprises the following steps: monitoring a file write-in operation of a target file system, and counting the write-in times of a file in a preset time window; when the write-in times exceed a dynamically set threshold value, carrying out on-demand backup on a target file; marking the backup file as a read-only attribute, and adding a special identifier in a file name; and detecting a write-in request for the backup file, and if the write-in request is detected, triggering a defense action. According to the method, the abnormal writing behavior of the file system can be detected in real time and the backup is triggered as required, so that the consumption of storage and computing resources is effectively reduced, and the response speed and protection precision of ransomware attacks are improved.

Description

Technical Field

[0001] This disclosure relates to the fields of information security and data protection, and in particular to a real-time ransomware protection backup method and apparatus based on a file system. Background Technology

[0002] As an important component of information security protection, file systems are widely used in enterprise data management, personal terminal protection, and cloud computing platforms.

[0003] With the increasing prevalence of ransomware attacks, these attacks pose a serious threat to system availability by encrypting user data and demanding ransom. Related technologies typically build protection systems through the collaborative operation of behavior monitoring, anomaly detection, and backup and recovery. Specifically, this system covers the entire process from file access monitoring and encryption behavior identification to data recovery, including key aspects such as machine learning-based predictive detection, periodic full backups, and cloud storage synchronization. However, existing protection methods directly use static thresholds or fixed time intervals to trigger backups, without fully considering the differences in write behavior under different business scenarios. This can lead to high false positive rates, long backup delays, or malicious encryption and overwriting of backup files, thus affecting the effectiveness of data recovery. Furthermore, existing technologies often struggle to distinguish between normal programs and malicious behavior when restricting abnormal writes, easily interfering with system operation, especially in business environments with high-frequency write operations, where the problem of false positives in protection mechanisms is particularly prominent. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] This invention proposes a real-time ransomware protection backup method based on a file system.

[0006] Another objective of this invention is to provide a real-time ransomware protection backup device based on a file system.

[0007] To achieve the above objectives, a first aspect of the present invention proposes a real-time ransomware protection backup method based on a file system, comprising:

[0008] S1, monitor file write operations on the target file system and count the number of file writes within a preset time window; S2, when the number of writes exceeds the dynamically set threshold, the target file is backed up on demand; S3 marks the backup file as read-only and adds a special identifier to the filename; S4, detect write requests to the backup file. If a write request is detected, trigger a defense action.

[0009] In one embodiment of the present invention, monitoring file write operations of the target file system and counting the number of file writes within a preset time window includes: S11, A sliding time window algorithm is used to perform real-time statistics on file write operations, and the length of the sliding time window is configured as needed; S12 sets different time window lengths and write count thresholds for files in different directories to achieve directory-level differentiated monitoring.

[0010] In one embodiment of the present invention, the step of backing up the target file on demand when the number of writes exceeds a dynamically set threshold includes: S21, perform incremental backup only on the files that triggered the abnormal write behavior, the incremental backup includes file content differences and metadata updates; S22. Before the backup operation, the target file is hash-checked. If the hash value differs from the historical record by more than a preset range, the backup is performed.

[0011] In one embodiment of the present invention, marking the backup file as read-only and adding a special identifier to the filename further includes: S31, the special identifier is a fixed prefix string and includes the timestamp that triggered the backup and the file hash digest; S32, the read-only attribute is set by both file system permission bits and access control lists to prevent malicious programs from bypassing permissions to modify backup files.

[0012] In one embodiment of the present invention, it further includes: S5. According to the preset directory protection policy, backup operations are performed only on files in the key directories specified by the user. The key directories include the user document directory, working directory and database directory, but backups are not performed on the system recoverable directories.

[0013] To achieve the above objectives, another aspect of the present invention proposes a real-time ransomware protection backup device based on a file system, comprising: The file write monitoring module is used to monitor file write operations on the target file system and count the number of file writes within a preset time window. The on-demand backup trigger module is used to perform on-demand backup of the target file when the number of writes exceeds a dynamically set threshold. The backup file marking module is used to mark backup files as read-only and add a special identifier to the filename; The backup file defense detection module is used to detect write requests to the backup file. If a write request is detected, a defense action is triggered.

[0014] The real-time ransomware protection backup method and apparatus based on the file system of this invention can detect abnormal write behavior of the file system in real time and trigger backup as needed, effectively reducing storage and computing resource consumption and improving the response speed and protection accuracy of ransomware attacks.

[0015] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0016] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a real-time ransomware protection backup method based on a file system according to an embodiment of the present invention; Figure 2 This is a structural diagram of a real-time ransomware protection backup device based on a file system according to an embodiment of the present invention. Detailed Implementation

[0017] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] The following description, with reference to the accompanying drawings, describes a real-time ransomware protection backup method and apparatus based on a file system, according to an embodiment of the present invention.

[0020] Figure 1 This is a flowchart of a file system-based real-time ransomware protection backup method according to an embodiment of the present invention, such as... Figure 1 As shown, it includes: S1 monitors file write operations on the target file system and counts the number of file writes within a preset time window.

[0021] Specifically, the technical implementation of this step is based on the operating system kernel-level file system monitoring interface, such as inotify or eBPF (Extended Berkeley Packet Filter) technology in Linux systems. In some implementations, the system registers file system event listeners to capture file operation events such as write, open (write mode), and truncate in real time, and records these events in an event queue in memory for analysis by subsequent processing modules.

[0022] In this step, the preset time window and write count threshold are key configuration parameters. The time window is typically set between 30 seconds and 30 minutes, preferably 30 minutes, to balance real-time performance and false alarm rate. The write count threshold is dynamically adjusted based on file type and system load. For example, it can be set to 50 times / 30 minutes during off-peak hours, while in high-concurrency write scenarios, it can be appropriately increased to 100 times / 30 minutes to avoid accidental backup triggers. In addition, the system supports user-defined configurations, allowing adjustment of the time window length and write count threshold according to specific business needs.

[0023] This step is applicable to monitoring critical data directories in servers, desktop systems, and cloud environments. For example, in an enterprise file server, the system can perform granular monitoring of user document directories (such as / home / user / documents), while not frequently monitoring system directories (such as / usr / bin), thus achieving directory-level differentiated protection. Through this step, the system can quickly identify abnormal behavior when ransomware performs high-frequency encryption operations, providing a basis for triggering subsequent backup and defense mechanisms.

[0024] This step, through a low-overhead event monitoring mechanism, enables real-time perception and quantitative analysis of file write behavior, effectively improving the detection sensitivity of ransomware attacks. Combined with a dynamic threshold mechanism, the system can accurately identify potential attack behaviors without significantly impacting system performance, thereby triggering backup operations in the early stages of an attack and providing reliable protection for data recovery. The implementation of this step significantly reduces the false positive rate while improving the real-time nature and targeting of backup triggering, and is a key technical support for the lightweight and efficient protection achieved in this invention.

[0025] Furthermore, S1 includes: S11 uses a sliding time window algorithm to perform real-time statistics on file write operations, and the length of the sliding time window can be configured as needed.

[0026] Specifically, this step employs a sliding time window algorithm to perform real-time statistics on file write operations. Its core lies in quantitatively analyzing file system I / O behavior through a dynamic time window mechanism, thereby identifying potential ransomware attack behaviors. In some implementations, this algorithm is based on a time-series data processing model, dividing file write events into continuous time windows. The length of each window can be configured from 10 seconds to 30 minutes to adapt to the performance and security requirements of different application scenarios.

[0027] The system captures file write events in real time through kernel-level file system monitoring modules (such as Linux's inotify or eBPF mechanism) and records the event timestamps and operation types in a memory queue. The sliding window algorithm adopts a time-driven approach, updating the window content at fixed time intervals (e.g., every 5 seconds) to ensure that the window always contains write operation data from the most recent N seconds. For example, when the window length is set to 30 seconds, the system maintains a dynamic window with a time range of [t - 30s, t]. Whenever a new write event occurs, the old event is removed from the window according to its timestamp, thereby achieving real-time sliding statistics of data.

[0028] The window size and window slide interval are key configuration parameters. The window size is typically set from 10 seconds to 30 minutes, depending on the target system's I / O load characteristics and the attack response speed requirements. The window slide interval is generally 1 / 3 to 1 / 2 of the window size to ensure statistical continuity and sensitivity. In addition, the system sets a write operation threshold; for example, exceeding 50 writes within a 30-second window triggers a backup mechanism. This threshold can be customized by the user or dynamically adjusted using a machine learning model.

[0029] This step is applicable to file system protection in enterprise-level servers, personal computers, and cloud storage environments. Especially in industries frequently targeted by ransomware attacks (such as healthcare, finance, and education), real-time statistics on file write frequency can effectively identify characteristic patterns of encryption behavior, thereby triggering backups in the early stages of an attack and preventing critical data from being encrypted on a large scale.

[0030] By employing a sliding time window algorithm, the system can dynamically and in real-time monitor file writing behavior, significantly reducing false positive and false negative rates compared to static threshold detection methods. Simultaneously, this mechanism provides reliable data for subsequent backup triggering, read-only marking, and defense response, enhancing the overall system's responsiveness and protection efficiency against ransomware attacks.

[0031] S12 sets different time window lengths and write count thresholds for files in different directories to achieve directory-level differentiated monitoring.

[0032] Specifically, this step, "setting different time window lengths and write count thresholds for files in different directories to achieve directory-level differentiated monitoring," aims to improve the system's response capability to ransomware attacks through refined monitoring strategies, while reducing interference with normal business operations.

[0033] This step involves introducing a directory-level policy configuration mechanism into the file system monitoring module, binding file access behavior of different directories to their respective monitoring policies. Specifically, during the initialization phase, the system loads the directory policy table configured by the user or administrator. This table defines two key parameters for each target directory: the time window duration and the write count threshold. For example, for the user document directory (e.g., ` / home / user / documents`), a time window of 30 seconds and a write count threshold of 10 can be set; while for the system log directory (e.g., ` / var / log`), due to its high-frequency write characteristics, a time window of 1 minute and a write count threshold of 50 can be set. The system captures file write events in real time through kernel-level file system hooks (such as Linux's inotify or eBPF mechanisms) and maintains a write counter for each file in memory. Combining this with timestamps, a sliding window calculation is performed to determine whether backup conditions are triggered.

[0034] The time window length is typically measured in seconds or milliseconds, while the write count threshold is dynamically configured based on the directory's usage frequency and security sensitivity. For example, for highly sensitive directories, a shorter time window (e.g., 10 seconds) and a lower write count threshold (e.g., 5 times) can be used to improve detection sensitivity; while for less sensitive directories, the parameters can be relaxed to reduce false alarms. Furthermore, the system supports further granular policy configuration based on file type (e.g., documents, images, videos) or user identity, thereby achieving more precise differentiated monitoring.

[0035] This procedure is applicable to various file system environments, including enterprise servers, personal computers, and cloud storage nodes. Especially in industries prone to ransomware attacks (such as healthcare, finance, and education), setting stricter monitoring policies for critical business directories can effectively identify and intercept abnormal encryption behavior, while adopting more lenient policies for system directories or temporary file directories to avoid impacting normal system operation.

[0036] This step, by introducing a directory-level differentiated monitoring strategy, significantly improves the system's accuracy in identifying and responding to ransomware attacks. On the one hand, it avoids the false positives or false negatives caused by a globally uniform threshold; on the other hand, through dynamic policy configuration, it achieves optimal resource utilization and reduces storage and computing overhead. Furthermore, this mechanism enhances the system's configurability and scalability, facilitating flexible adjustments based on different business scenarios, thereby improving overall protection capabilities.

[0037] S2, when the number of writes exceeds the dynamically set threshold, the target file is backed up on demand.

[0038] Specifically, when the number of write operations exceeds a dynamically set threshold, the target file is backed up on demand. This is a key response mechanism in the file system-based real-time ransomware protection backup technology of this invention. This step combines dynamic behavior analysis with threshold judgment to achieve rapid response and data protection against potential ransomware attacks.

[0039] The system tracks write operations to target files in real time through kernel-level file system monitoring modules (such as Linux's inotify or eBPF mechanisms). Each time a file is written, the system records the timestamp and number of operations, comparing them to a dynamically set threshold. This threshold is based not only on the number of writes but also on a time window (such as 30 seconds, 1 minute, or 30 minutes) for a combined judgment. For example, if a file is written more than 10 times within 30 seconds, or more than 50 times within 3 minutes, the system determines that the file may be affected by abnormal encryption behavior of ransomware, thus triggering a backup process.

[0040] The dynamic threshold can be adaptively adjusted based on system load, user behavior patterns, and historical data. The initial threshold can be set to "writes > 10 within 30 seconds" or "writes > 50 within 3 minutes," and dynamically optimized using machine learning models (such as time-series-based anomaly detection algorithms). Parameters such as the backup operation trigger frequency, time window length, and write count threshold can all be customized in the system configuration file to adapt to the performance and security requirements of different application scenarios.

[0041] This step applies to critical data directories (such as user documents, database files, etc.) in enterprise servers, personal workstations, and cloud storage environments. The system can set differentiated threshold policies for different directories. For example, more sensitive write monitoring can be set for user document directories, while restrictions can be relaxed for system directories (such as / usr / bin), thereby achieving efficient resource utilization and precise deployment of protection policies.

[0042] This step, through an on-demand backup mechanism, effectively avoids the resource waste associated with traditional periodic full backups, while also improving the response speed to ransomware attacks. Combined with read-only backups and honeypot mechanisms, the system can immediately identify and take defensive measures when attackers attempt to overwrite backup files, thereby achieving real-time protection and proactive trapping of critical data and significantly enhancing the system's security resilience.

[0043] Furthermore, S2 includes: S21, perform incremental backup only on the files that triggered the abnormal write behavior, the incremental backup includes file content differences and metadata updates.

[0044] Specifically, this step, "performing incremental backups only for files that trigger abnormal write behavior, whereby the incremental backup includes file content differences and metadata updates," is the core execution step in the "Real-time Ransomware Protection Backup Technology Based on File System" of this invention. Its technical implementation is based on a real-time monitoring and intelligent response mechanism for file system I / O behavior. In some implementations, the system captures file write events in real time through kernel-level file system hooks or user-space file monitoring tools (such as inotify, fanotify, and other Linux system interfaces), and combines this with a dynamic threshold algorithm to determine whether abnormal write behavior has been triggered. For example, if a file experiences more than 10 write operations within 30 seconds, or if the number of bytes written exceeds a preset rate threshold (e.g., 5MB / min) within 5 minutes, the system determines that the file may be under ransomware encryption attack, thereby triggering the backup process.

[0045] Incremental backups combine differential backups with version snapshots. File content differences are extracted by comparing the hash values ​​(such as SHA-256) of the original file with the current version or by using binary difference algorithms (such as xdelta, bsdiff). Only the newly added or modified data blocks are stored, not the entire file content. Metadata updates include changes to key attributes such as file permissions (mode), modification time (mtime), access time (atime), and owner information (uid / gid). These changes are captured and recorded through the file system event log (such as ext4's journal mechanism) or a custom metadata tracking module.

[0046] Backup trigger thresholds can be configured by the user based on system load and security policies, such as write frequency thresholds (N times / time window T), write rate thresholds (R bytes / minute), and file modification patterns (e.g., continuous writes, random overwrites, etc.). Backup files can be stored in standard backup compression formats (e.g., tar.gz, zip) or custom binary formats to improve storage efficiency. The automatic expiration time for backup files can be set to 5-30 minutes to ensure a recovery window is maintained after an attack is confirmed, while avoiding prolonged occupation of storage resources.

[0047] This step is suitable for environments requiring real-time protection against ransomware attacks, such as enterprise servers, personal workstations, and cloud hosts. Especially in critical business directories (such as user documents and database folders), the system can prioritize incremental backups of high-risk files, while relaxing monitoring policies for system directories (such as / usr / bin), thus achieving directory-level differentiated protection. By backing up only the files that trigger the anomaly, the system significantly reduces backup frequency and storage overhead, while improving response speed and recovery efficiency.

[0048] By accurately identifying abnormal write behavior and implementing a minimal backup strategy, ransomware can be effectively prevented from overwriting original files during an attack, while avoiding the resource waste associated with traditional full backups. Combining read-only backup files as a "honeypot" mechanism further enhances the proactive targeting of malicious activities, thereby improving the overall system's security and recovery capabilities.

[0049] S22. Before the backup operation, the target file is hash-checked. If the hash value differs from the historical record by more than a preset range, the backup is performed.

[0050] Specifically, this step involves performing a hash check on the target file before executing the backup operation, and determining whether to trigger the backup based on whether the difference between the hash value and historical records exceeds a preset range. The technology implements a file content-based integrity verification mechanism combined with a dynamic threshold judgment strategy to achieve real-time response and data protection against potential ransomware attacks.

[0051] The system first captures file write events in real time through a file system monitoring module (such as inotify on Linux or File SystemWatcher on Windows). When multiple write operations are detected on a file within a preset time window (e.g., 30 seconds to 5 minutes), the system triggers a hash verification process. This process uses a secure hash algorithm (such as SHA-256 or MD5) to calculate the content digest of the target file and compares the current hash value with historical hash values ​​stored in a local database or memory cache. If the hash value difference exceeds a preset similarity threshold (e.g., Hamming distance greater than 10% or inconsistent hash values), it is determined that the file content may have been tampered with, and the system will immediately perform a backup operation.

[0052] The frequency of hash verification, time window length, write count threshold, hash algorithm type, and similarity judgment criteria can all be configured by the user according to actual needs. For example, the time window can be set to 30 seconds, the write count threshold to 10 times, the hash algorithm to SHA-256, and the similarity threshold to a Hamming distance greater than 10%. These parameter settings must comply with the data integrity control requirements of the ISO / IEC 27001 information security management system.

[0053] In application scenarios, this step is suitable for enterprise servers, personal computers, and cloud storage environments, and is particularly valuable in industries prone to ransomware attacks (such as healthcare, finance, and education). By backing up only when file content undergoes abnormal changes, the system can effectively reduce unnecessary backup operations and lower the consumption of storage and computing resources.

[0054] The hash verification mechanism enables accurate identification of file content changes, avoiding false positives and false negatives based on static rules or behavioral patterns, thus improving the targeting and real-time nature of backups. Furthermore, combined with subsequent read-only backups and automatic expiration mechanisms, the system's defense capabilities and resource management efficiency are further enhanced, making it one of the core components of this invention for achieving lightweight, low-cost, and highly efficient protection.

[0055] S3 marks the backup file as read-only and adds a special identifier to the filename.

[0056] Specifically, this step involves marking the backup file as read-only and adding a special identifier to the filename. The underlying technology is based on the operating system's file attribute control and naming rules, aiming to enhance the security of backup files through file system-level access control policies and prevent ransomware from re-encrypting or tampering with the backup data.

[0057] This step sets the access permissions of the backup file to read-only by calling the file attribute interface provided by the operating system (such as the `chmod` command in Linux or the `SetFileAttributes` API in Windows). Specifically, after creating the backup file, the system immediately performs an attribute modification operation, setting the file permissions to `0444` (Linux) or `FILE_ATTRIBUTE_READONLY` (Windows), ensuring that only processes or users with administrator privileges can modify the file. Furthermore, the system embeds a predefined special identifier (such as `_RO_BACKUP_` or `__INSURANCE__`) in the backup file's name. This identifier must conform to file system naming conventions (such as not containing illegal characters and adhering to length limits) so that the subsequent access control module can quickly identify and process it.

[0058] The read-only attribute setting must comply with the operating system's standard permission model to ensure compatibility and stability. The format of the special identifier is configurable, and its length is usually controlled between 3 and 15 characters to avoid compatibility issues caused by excessively long filenames. In the lifecycle management of backup files, this identifier works in conjunction with an automatic expiration mechanism (such as automatic deletion after 5 minutes) to ensure that backup files have high security during their validity period, while avoiding long-term occupation of storage resources.

[0059] This step is primarily used during the real-time backup of critical data directories (such as user documents, database files, etc.). When the system detects abnormal behavior in a file within a set time window (e.g., more than 50 writes within 30 minutes) and triggers a backup, the backup file will be immediately marked as read-only, and a special identifier will be added to the filename. This design effectively prevents ransomware from continuing to encrypt the backup file after backup is complete, while also facilitating the security module's identification and handling of backup file access behavior.

[0060] This step significantly enhances the immutability of backup data and strengthens the system's proactive defense against ransomware attacks through a dual mechanism of file attribute control and naming identifiers. Simultaneously, the introduction of special identifiers provides clear identification criteria for subsequent access monitoring and alerting mechanisms, facilitating rapid location of attack behaviors and the implementation of response measures. This design achieves dynamic protection of backup data without increasing additional computational overhead, and is one of the core technologies of this invention for achieving lightweight and low-cost protection.

[0061] Furthermore, S3 includes: S31, the special identifier is a fixed prefix string and includes the timestamp that triggered the backup and the file hash digest.

[0062] Specifically, in some implementations, the special identifier is a fixed prefix string "_inspur_backup_" and includes a timestamp that triggered the backup and a file hash digest. This step is one of the core mechanisms in this invention for identifying and managing backup files. Its technical implementation principle is based on a combination of file naming conventions and metadata to ensure that backup files are identifiable, traceable, and immutable within the file system.

[0063] When the system detects that the number of write operations to the target file exceeds a dynamically set threshold (e.g., 50 times) within a preset time window (e.g., 30 minutes), it will trigger the backup process. When the backup file is created, its filename will be constructed according to a predefined format: a fixed prefix "_inspur_backup_" will be added before the original filename, followed by the timestamp of the backup trigger (in the format YYYYMMDD_HHMMSS, accurate to the second), and a hash digest of the original file (e.g., a 64-bit hexadecimal string generated by the SHA-256 algorithm). For example, if the original filename is "document.txt" and its hash value is "a1b2c3d4...", then the backup filename will be "_inspur_backup_20250405_143000_a1b2c3d4..._document.txt".

[0064] The precision of the timestamp determines the traceability of backup events. It typically uses system UTC time or local timezone to ensure cross-platform consistency. The choice of hash algorithm must conform to industry standards, such as SHA-256 or SHA-3, to guarantee data integrity. The length of backup filenames must be controlled within the maximum length supported by the file system (e.g., 4096 bytes in Linux systems) to avoid storage or access anomalies caused by excessively long names.

[0065] This naming mechanism is widely applicable to real-time backup systems for enterprise-level file servers, cloud storage environments, and terminal devices. By combining a fixed prefix with a hash digest, the system can quickly identify backup files and immediately trigger defense mechanisms (such as process termination and network isolation) when an illegal write operation to a backup file is detected, thereby achieving "honeypot"-style proactive defense.

[0066] Standardized naming rules enhance the manageability and security of backup files. Combined with hash digest verification, this ensures the backup content has not been tampered with, providing a reliable basis for subsequent recovery operations. Furthermore, the embedded timestamps facilitate audit tracing and attack timing analysis, strengthening the system's responsiveness and attribution capabilities in the face of ransomware attacks.

[0067] S32, the read-only attribute is set by both file system permission bits and access control lists to prevent malicious programs from bypassing permissions to modify backup files.

[0068] Specifically, in this step, backup files are marked as read-only by using both file system permission bits and access control lists (ACLs), thus preventing malicious programs from modifying backup files by bypassing permission mechanisms. This technology implements a file permission model based on Linux or Unix-like systems, combined with the POSIX ACL standard, to achieve strict access control over backup files.

[0069] After creating the backup file, the system first calls the `chmod()` system call to set the file permissions to `0444` (i.e., read-only permissions). Then, it uses the `setfacl()` command to append ACL rules to the backup file, such as `-mu::r -mg::r -mo::r`, ensuring that all users, groups, and other users have no write permissions. Furthermore, the system can set a default ACL to prevent permissions from being reset after the backup file is copied or moved. Additionally, specific identifiers (such as the `.inspur-backup` suffix) can be appended to the backup file name to facilitate system identification and application of specific permission policies.

[0070] Permission settings must comply with the POSIX standard (IEEE 1003.1-2017) to ensure cross-platform compatibility. The read-only attribute of backup files must take effect immediately upon file creation and remain unchanged throughout the backup file's lifecycle until it is deleted according to a preset automatic expiration mechanism (e.g., after 5 minutes). Simultaneously, the system can configure ACL inheritance policies to ensure that all subfiles and subdirectories under the backup directory inherit the read-only attribute.

[0071] This step is suitable for real-time backup scenarios of critical data directories (such as user documents, database files, etc.). When the system detects that a file has undergone more than 50 write operations within 30 minutes, the backup process is triggered, and the file is immediately set to read-only after the backup is completed. This mechanism effectively prevents ransomware from continuing to encrypt the backup file after backup is completed, thereby ensuring the integrity and availability of the backup data.

[0072] By employing dual control through permission bits and ACLs, the protection level of backup files is significantly improved, avoiding the problems of backup files being overwritten or tampered with due to lax permission configuration in traditional backup mechanisms. Simultaneously, this design enhances the system's proactive defense capabilities, using backup files as "honeypots" to lure and trap attack behaviors, providing evidence for subsequent tracing and response, and possessing high security value and practicality. S4, detect write requests to the backup file. If a write request is detected, trigger a defense action.

[0073] Specifically, the step of "detecting write requests to the backup file and triggering defense actions if a write request is detected" is a key security response mechanism in the real-time ransomware protection backup technology based on the file system of this invention. Its technical implementation principle is based on a combination of file system access monitoring and access control policies. In some implementations, this step uses kernel-level file system hooks or user-space file access monitoring tools (such as inotify, fanotify, and other Linux system interfaces) to monitor file system access events in real time, particularly identifying and intercepting write operations to backup files.

[0074] In terms of specific operation, after creating a backup file, the system sets the backup file's permissions to read-only through file attribute settings (such as the chmod command), and optionally embeds a special identifier (such as the "_inspur_backup_" prefix) in the filename for system identification and management. When a write request to the backup file is detected, the system first verifies the legitimacy of the request through access control lists (ACLs) or file system metadata. If it is confirmed to be an illegal write, defensive actions are immediately triggered, including but not limited to terminating the process initiating the write, logging, sending alarm information to the administrator terminal, or disconnecting the network connection to prevent further spread.

[0075] The triggering conditions for defense actions can be configured based on file access patterns (such as write, modify, and delete) and access frequency. For example, the system can be set to consider more than 3 writes to a backup file within any 5-second period as abnormal behavior and trigger a defense response. In addition, the response level of the defense action can also be set in stages, such as logging only for low-risk situations, and terminating or isolating processes for medium- and high-risk situations.

[0076] This step, by setting the backup files to read-only and monitoring their access behavior in real time, effectively prevents malicious programs from tampering with or overwriting the backup files, thus improving the system's resistance to attacks. Simultaneously, by combining dynamic thresholds and directory-level differentiated protection strategies, this step achieves precise protection of critical data without significantly impacting system performance, enhancing the overall security and practicality of the backup mechanism.

[0077] The real-time ransomware protection backup method based on the file system in this invention effectively reduces storage and computing resource consumption, improves the real-time detection and response capabilities to ransomware attacks, and ensures the recoverability of critical file data and system security through dynamic threshold-triggered backup and directory-level differentiated protection.

[0078] Furthermore, it also includes: S5. According to the preset directory protection policy, backup operations are performed only on files in the key directories specified by the user. The key directories include the user document directory, working directory and database directory, but backups are not performed on the system recoverable directories.

[0079] Specifically, this step, "According to the preset directory protection policy, only the files in the key directories specified by the user are backed up, including the user document directory, working directory and database directory, and the system recoverable directory is not backed up," is one of the core differentiated protection mechanisms in the "real-time ransomware protection backup technology based on the file system" of the present invention. Its technical implementation principle is based on the file system path identification and policy matching mechanism.

[0080] In some implementations, this step integrates a directory whitelist and blacklist policy engine into the file system monitoring module to achieve real-time determination of file operation paths. The system first loads the user-preset protection policy configuration file, which explicitly lists critical directories (such as ` / home / user / Documents`, ` / home / user / Work`, ` / var / lib / mysql`, etc.) and system recoverable directories (such as ` / usr / bin`, ` / etc`, ` / tmp`, etc.). When a file system event is triggered, the system uses a path matching algorithm (such as prefix matching or regular expression matching) to determine whether the file is located in a critical directory. If a match is successful, the backup process is triggered; if the file is located in a system recoverable directory, the backup operation is ignored.

[0081] Furthermore, the policy engine supports dynamic configuration updates. Users can modify the list of critical directories in real time through the management interface. Upon receiving the configuration changes, the system immediately updates the monitoring policy without requiring a service restart. In addition, backup operations are performed only on files in critical directories. The backup granularity can be set to file-level or directory-level, and the backup method can be incremental or snapshot backup, determined by the system policy.

[0082] The definition of critical directories must conform to the POSIX standard path format, while system recoverable directories are typically standard Linux system paths or protected Windows system directories. In the backup triggering policy, the backup priority of critical directories can be set to "high," while the backup priority of system directories can be set to "low" or "disabled." Backup frequency and storage usage can be controlled through policy configuration; for example, setting the retention time for critical directory backups to 5 minutes can be used in conjunction with an automatic expiration mechanism.

[0083] This step is particularly suitable for critical data protection scenarios in enterprise servers, personal workstations, and cloud environments. For example, in a database server, only files in the ` / var / lib / mysql` directory are backed up, while system logs or temporary file directories are ignored, thereby significantly reducing backup overhead and improving response efficiency.

[0084] Through directory-level differentiated protection strategies, the system can accurately identify and protect the data assets that users truly care about, avoid redundant backups of the system directory, thereby saving storage resources, improving backup efficiency, and enhancing data recovery capabilities under ransomware attacks.

[0085] In summary, this invention proposes a real-time ransomware detection and backup technology based on a file system, implementing a mechanism for triggering backups on demand. It protects file system security by using dynamic thresholds to trigger backups. Specifically, it includes the following aspects: Dynamic threshold-triggered backup: This solution uses dynamic thresholds to trigger backups. When the number of file write operations exceeds a predefined threshold, the system creates a backup. The threshold can include a time dimension, such as more than 50 writes within 30 minutes. Backup creation only when the number of file write operations exceeds the predefined threshold: This solution only creates backups when necessary, reducing storage overhead and improving efficiency. Threshold can include a time dimension: The threshold in this solution can be based not only on the number of write operations but also on a time dimension. For example, more than 50 writes within 30 minutes. Read-only backup as a "honeypot": This solution marks backup files as read-only. Any attempt to write to the backup is considered malicious, triggering defensive actions (such as terminating the process, notifying the administrator, or disconnecting from the network). Automatic expiration mechanism: This solution supports an automatic expiration mechanism. Backup files are automatically deleted after a preset time (e.g., 5 minutes), reducing storage overhead. Lightweight and low-cost: This solution only backs up files suspected of being attacked, avoiding the waste of resources from full backups. Directory-level differentiated protection: This solution supports protecting only critical directories (such as user personal documents), rather than system recoverable files (such as / usr / bin).

[0086] The working principle of this solution is as follows: Monitoring the file system: This solution continuously monitors file write operations in the file system. Detecting abnormal behavior: When the number of file write operations exceeds a predefined threshold, this solution detects abnormal behavior. Triggering backups: This solution creates backups to protect the file system. Marking backup files as read-only: This solution marks backup files as read-only to prevent malicious behavior. Automatic expiration: This solution automatically deletes backup files to reduce storage overhead.

[0087] Furthermore, based on this working principle, the implementation process of the present invention can be as follows: Installation and configuration: Users need to install and configure the software for this solution, and set the threshold and automatic expiration time.

[0088] File system monitoring: This solution begins monitoring file write operations in the file system.

[0089] Abnormal behavior detection: This solution detects abnormal behavior and triggers a backup.

[0090] Create backup: This solution creates backups to protect the file system.

[0091] Mark backup files as read-only: This solution marks backup files as read-only to prevent malicious behavior.

[0092] Automatic expiration: This solution automatically deletes backup files to reduce storage overhead.

[0093] The process involves detecting file access, intercepting and alerting if the file is a backup, counting if it is not a backup, and creating a read-only backup if the threshold is exceeded. Three design details are particularly noteworthy: 1) The threshold can include a time dimension (e.g., more than X writes within 30 minutes); 2) Backup filenames have special identifiers for easy identification; and 3) Backup files are used to proactively lure and trap attack behavior.

[0094] Compared to full backup, the embodiments of the present invention can save resources, and when combined with other detection mechanisms, can effectively avoid data loss. At the same time, it provides limited protection for critical directories, while relaxing the protection for system directories. This differentiated design is very practical.

[0095] To achieve the above embodiments, such as Figure 2 As shown, this embodiment also provides a real-time ransomware protection backup device 10 based on a file system, including: The file write monitoring module 100 is used to monitor file write operations on the target file system and count the number of file writes within a preset time window. The on-demand backup trigger module 200 is used to perform on-demand backup of the target file when the number of writes exceeds a dynamically set threshold. Backup file marking module 300 is used to mark backup files as read-only and add a special identifier to the file name; The backup file defense detection module 400 is used to detect write requests to the backup file. If a write request is detected, a defense action is triggered.

[0096] Furthermore, the file writing monitoring module is also used for: A sliding time window algorithm is used to perform real-time statistics on file write operations, and the length of the sliding time window is configured as needed. Different time window lengths and write count thresholds are set for files in different directories to achieve directory-level differentiated monitoring.

[0097] Furthermore, the on-demand backup trigger module is also used for: Incremental backups are performed only on files that trigger abnormal write behavior, and the incremental backups include file content differences and metadata updates; Before performing a backup operation, the target file is hash-checked. If the hash value differs from the historical record by more than a preset range, the backup is executed.

[0098] Furthermore, the backup file tagging module is also used for: The special identifier is a fixed prefix string that includes the timestamp that triggered the backup and a file hash digest; The read-only attribute is set through both file system permission bits and access control lists to prevent malicious programs from bypassing permissions to modify backup files.

[0099] Furthermore, it also includes: The directory protection strategy module is used to perform backup operations only on files in key directories specified by the user, according to a preset directory protection strategy. The key directories include the user document directory, working directory, and database directory, but do not perform backups on the system's recoverable directories.

[0100] The real-time ransomware protection backup device based on the file system according to embodiments of the present invention effectively reduces storage and computing resource consumption, improves the real-time detection and response capability to ransomware attacks, and ensures the recoverability of critical file data and system security through dynamic threshold-triggered backup and directory-level differentiated protection.

[0101] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0102] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A file system-based real-time ransom protection backup method, characterized by, include: S1, monitor file write operations on the target file system and count the number of file writes within a preset time window; S2, when the number of writes exceeds the dynamically set threshold, the target file is backed up on demand; S3 marks the backup file as read-only and adds a special identifier to the filename; S4, detect write requests to the backup file. If a write request is detected, trigger a defense action.

2. The method of claim 1, wherein, The monitoring of file write operations on the target file system, and the counting of file writes within a preset time window, includes: S11 uses a sliding time window algorithm to perform real-time statistics on file write operations, and the length of the sliding time window can be configured as needed. S12 sets different time window lengths and write count thresholds for files in different directories to achieve directory-level differentiated monitoring.

3. The method of claim 1, wherein, When the number of write operations exceeds a dynamically set threshold, the target file is backed up on demand, including: S21, perform incremental backup only on the files that triggered the abnormal write behavior, the incremental backup includes file content differences and metadata updates; S22. Before the backup operation, the target file is hash-checked. If the hash value differs from the historical record by more than a preset range, the backup is performed.

4. The method of claim 1, wherein, The step of marking the backup file as read-only and adding a special identifier to the filename also includes: S31, the special identifier is a fixed prefix string and includes the timestamp that triggered the backup and the file hash digest; S32, the read-only attribute is set by both file system permission bits and access control lists to prevent malicious programs from bypassing permissions to modify backup files.

5. The method as described in claim 1, characterized in that, Also includes: S5. According to the preset directory protection policy, backup operations are performed only on files in the key directories specified by the user. The key directories include the user document directory, working directory and database directory, but backups are not performed on the system recoverable directories.

6. A real-time ransomware protection backup device based on a file system, characterized in that, include: The file write monitoring module is used to monitor file write operations on the target file system and count the number of file writes within a preset time window. The on-demand backup trigger module is used to perform on-demand backup of the target file when the number of writes exceeds a dynamically set threshold. The backup file marking module is used to mark backup files as read-only and add a special identifier to the filename; The backup file defense detection module is used to detect write requests to the backup file. If a write request is detected, a defense action is triggered.

7. The apparatus as claimed in claim 6, characterized in that, The file writing monitoring module is also used for: A sliding time window algorithm is used to perform real-time statistics on file write operations, and the length of the sliding time window can be configured as needed. Different time window lengths and write count thresholds are set for files in different directories to achieve directory-level differentiated monitoring.

8. The apparatus as claimed in claim 6, characterized in that, The on-demand backup triggering module is also used for: Incremental backups are performed only on files that trigger abnormal write behavior, and the incremental backups include file content differences and metadata updates; Before performing a backup operation, the target file is hash-checked. If the hash value differs from the historical record by more than a preset range, the backup is executed.

9. The apparatus as claimed in claim 6, characterized in that, The backup file marking module is also used for: The special identifier is a fixed prefix string that includes the timestamp that triggered the backup and a file hash digest; The read-only attribute is set through both file system permission bits and access control lists to prevent malicious programs from bypassing permissions to modify backup files.

10. The apparatus as claimed in claim 6, characterized in that, Also includes: The directory protection strategy module is used to perform backup operations only on files in key directories specified by the user, according to a preset directory protection strategy. The key directories include the user document directory, working directory, and database directory, but do not perform backups on the system's recoverable directories.

Images