File backup method, apparatus, device, and computer program product

Abstract

Embodiments of the present application provide a file backup method, device, equipment and computer program product; the file backup method comprises: obtaining a file write request; in the case that the file write request is a file modification request, determining probability information of the file write request corresponding to a ransom behavior; in the case that the probability information is greater than or equal to a preset threshold, then before performing a write operation based on the file write request, copying a request file corresponding to the file write request to a preset protected directory, wherein the protected directory is located in the kernel. In the present embodiment, since the protected directory is located in the kernel, the access permission of the protected directory is higher than the access request of the file write request, so that in the case of write request operation, the file in the protected directory cannot be written, thereby avoiding the ransom operation on the request file, while ensuring the safety and reliability of the information content, further improving the practicability of the method.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a file backup method, apparatus, device, and computer program product. Background Technology

[0002] Ransomware is malware that prevents users from accessing their data by encrypting files on a victim's computer and demanding a ransom for the decryption key. Currently, most Endpoint Detection and Response (EDR) solutions rely on in-depth behavioral analysis techniques to identify ransomware. This process often requires the ransomware to exhibit sufficient activity characteristics before triggering an alert. However, this delay may result in critical user files being encrypted before an alert is triggered, causing irreparable data loss. Summary of the Invention

[0003] This invention provides a file backup method, apparatus, device, and computer program product that can perform backup operations on critical files when signs of ransomware are detected, thereby avoiding the loss of file information.

[0004] In a first aspect, embodiments of the present invention provide a file backup method, including:

[0005] Get file write request;

[0006] In the case that the file write request is a file modification request, determine the probability information that the file write request corresponds to ransomware behavior;

[0007] If the probability information is greater than or equal to a preset threshold, then before performing a write operation based on the file write request, the request file corresponding to the file write request is copied to a preset protected directory, wherein the protected directory is located in the kernel.

[0008] Secondly, embodiments of the present invention provide a file backup device, comprising:

[0009] The first acquisition module is used to acquire file write requests;

[0010] The first determining module is used to determine the probability information that the file write request corresponds to ransomware behavior when the file write request is a file modification request;

[0011] The first processing module is configured to, when the probability information is greater than or equal to a preset threshold, copy the request file corresponding to the file write request to a preset protected directory before performing a write operation based on the file write request, wherein the protected directory is located in the kernel.

[0012] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the file backup method in the first aspect described above.

[0013] Fourthly, embodiments of the present invention provide a computer storage medium for storing a computer program, wherein the computer program, when executed by a computer, implements the file backup method described in the first aspect above.

[0014] Fifthly, embodiments of the present invention provide a computer program product, comprising: a computer-readable storage medium storing computer instructions, wherein when the computer instructions are executed by one or more processors, the one or more processors cause the one or more processors to perform the steps in the file backup method described in the first aspect above.

[0015] The file backup method, apparatus, device, and computer program product provided in this invention, by acquiring a file write request, can determine the probability information of ransomware behavior corresponding to the file write request when the file write request is a file modification request. If the probability information is greater than or equal to a preset threshold, before performing a write operation based on the file write request, the requested file corresponding to the file write request is copied to a preset protected directory. Since the protected directory is located in the kernel layer, the access permissions of the protected directory are higher than those of the file write request. In this way, when the file write request performs a write request operation, it cannot perform write operations on the files in the protected directory, thereby avoiding ransomware attacks on the requested file and ensuring the security and reliability of the information content in the requested file, further improving the practicality of the method. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic diagram illustrating a file backup method provided in an embodiment of the present invention;

[0018] Figure 2 A flowchart illustrating a file backup method provided in an embodiment of the present invention;

[0019] Figure 3A flowchart illustrating the probability information of ransomware behavior corresponding to the file write request provided in an embodiment of the present invention;

[0020] Figure 4 A flowchart illustrating another file backup method provided in an embodiment of the present invention;

[0021] Figure 5 This is a schematic diagram of the structure of a file backup device provided in an embodiment of the present invention;

[0022] Figure 6 To and Figure 5 A schematic diagram of the electronic device corresponding to the file backup device provided in the embodiment. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise; “multiple” generally includes at least two, but does not exclude the inclusion of at least one.

[0025] It should be understood that the term "and / or" used in this document is merely a description of the relationship between associated devices, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this document generally indicates that the preceding and following associated devices are in an "or" relationship.

[0026] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0027] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes that element.

[0028] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0029] Terminology Explanation:

[0030] Endpoint Detection and Response (EDR) is a network security technology used to continuously detect endpoint activity, detect suspicious behavior, and respond to security incidents, including investigation, containment, and remediation.

[0031] Ransomware is a type of malware that prevents users from accessing their data by encrypting files on a victim's computer and demanding a ransom in exchange for the decryption key.

[0032] Ransomware Baiting is a defense strategy that uses seemingly important but actually worthless or recoverable "bait" files deployed on the system to attract and identify ransomware. When these files are encrypted, potential ransomware attacks can be quickly identified.

[0033] Ransomware detection by file overwriting frequency: This method determines ransomware activity by monitoring the speed and number of files being encrypted. If a large number of files are modified within a short period, it may indicate that ransomware is running.

[0034] To facilitate understanding of the specific implementation process and effects of the file backup method, apparatus, device, and computer program product in this embodiment, the relevant technologies are briefly described below:

[0035] With the rapid development of science and technology, information security is receiving increasing attention. Currently, ransomware detection and response (EDR) technology can be used to detect ransomware. Specifically, most EDR solutions rely on in-depth behavioral analysis to identify ransomware. This process often requires ransomware to exhibit sufficient activity characteristics before triggering an alert. In particular, ransomware detection often requires it to demonstrate a series of specific actions before it can be accurately classified as malicious. For example, ransomware trapping techniques only confirm its threat nature after detecting a malicious sample traversing the hard drive and encrypting specially designed trap files; similarly, strategies based on file encryption frequency require a significant number of files to be encrypted before ransomware activity can be determined.

[0036] Unfortunately, this delay may result in users' critical files being encrypted before the alert is triggered, causing irreparable information loss; under this type of judgment mechanism, users' files may have already suffered some degree of encryption damage before the formal judgment.

[0037] To ensure the security and reliability of information processing, related technologies provide a file backup method, specifically a full disk backup operation on a hard drive or in the cloud. While this allows for comprehensive data recovery, it has the following drawbacks: (1) High resource consumption: backing up all data, including non-essential files, requires a large amount of storage; (2) Low efficiency: the backup process is lengthy and inefficient due to the inclusion of numerous non-essential files; (3) Server dependence: requiring an additional backup server, increasing the cost and complexity of data backup; (4) Inflexible recovery: a full disk recovery will result in the loss of recently modified data.

[0038] To address the aforementioned technical problems, embodiments of the present invention provide a file backup method, apparatus, device, and computer program product, wherein, with reference to the appendix... Figure 1As shown, the file backup method is executed by a file backup device 200, which can be communicatively connected to a client 100 to provide file backup services to users. When the file backup device 200 is implemented as a cloud server, the file backup method can be executed in the cloud. Several computing nodes (cloud servers) can be deployed in the cloud, each with computing and storage resources. In the cloud, multiple computing nodes can be organized to provide a certain service; conversely, a single computing node can provide one or more services. The cloud can provide this service through an external service interface, which users can call to use the corresponding service. Service interfaces include Software Development Kits (SDKs) and Application Programming Interfaces (APIs).

[0039] Specifically, the client 100, which communicates with the file backup device 200, can be a mobile phone, a personal computer (PC), a tablet computer, a configuration application, a wearable device, etc. Furthermore, the basic structure of the client 100 can include multiple processors. The number of processors depends on the configuration and type of the client 100. The client 100 may also include memory, which can be volatile, such as Random Access Memory (RAM), or non-volatile, such as Read-Only Memory (ROM), flash memory, etc., or both types. The memory typically stores the operating system (OS), one or more applications, and may also store program data. In addition to the processing unit and memory, the client 100 also includes some basic configurations, such as a network interface card (NIC) chip, an I / O bus, a display component, and some peripheral devices. Optionally, some peripheral devices may include, for example, a keyboard, a mouse, a stylus, a printer, etc. Other peripheral devices are well known in the art and will not be described in detail here.

[0040] File backup device 200 refers to a device that can provide file backup operations in a network virtual environment, typically referring to a device that utilizes a network for information planning and file backup operations. In physical implementation, file backup device 200 can be any device capable of providing computing services and responding to file backup requests to perform file backup operations, such as a cluster server, a regular server, a cloud server, a cloud host, or a virtual data center. The file backup device 200 mainly consists of a processor, hard disk, memory, system bus, etc., similar to a general computer architecture.

[0041] In this embodiment described above, a network connection is established between the client 100 and the file backup device 200. This network connection can be a wireless or wired network connection. If the connection between the client 100 and the file backup device 200 is a communication connection, the network standard of the mobile network can be any one of 2G (Global System for Mobile Communications GSM), 2.5G (General Packet Radio Service GPRS), 3G (Wideband Code Division Multiple Access WCDMA, Time Division Synchronous Code Division Multiple Access TD-SCDMA, Code Division Multiple Access 2000 CDMA2000, Universal Mobile Communications System UTMS), 4G (Long Term Evolution LTE), 4G+ (Enhanced Long Term Evolution LTE+), WiMax (Global Microwave Access Interoperability), 5G, 6G, etc.

[0042] Client 100 provides an application programming interface (API) for file processing services. When a user has a file writing requirement, the user can obtain a file write request through the API. Specifically, client 100 can display a human-computer interaction interface that includes the API; obtain the interactive operations input by the user through the human-computer interaction interface for the API, such as interface interaction operations, voice interaction operations, etc., and then generate a file write request based on the interactive operations. In order to perform file write operations safely and stably, the file write request can be sent to file backup device 200.

[0043] The file backup device 200 is used to acquire file write requests sent by the client 100. To ensure the legitimacy of file write operations, after acquiring the file write request, it can analyze and process the file write request to identify whether the file write request is a file modification request. If the file write request is not a file modification request, it means that the file write request is likely a file creation request, and the file write request is directly confirmed as a legitimate request, and the corresponding operation is also a legitimate operation. If the file write request is a file modification request, in order to avoid the possibility of the file being extorted, the file write request can be further analyzed and processed to identify the probability information of extortion behavior corresponding to the file write request. That is, when a file write operation is performed based on the file write request, the probability information of extortion behavior occurring in the file write operation is high. If the probability information is greater than or equal to a preset threshold, it means that the probability of extortion behavior occurring in the file write request is relatively high. To prevent files from being extorted, the requested file can be copied to a pre-defined protected directory before the write operation is performed based on the file write request. The protected directory is located in the kernel, meaning that the access permissions of the protected directory are higher than those of the file write request. This effectively ensures that when a file write operation is performed based on the file write request, no access or write operation can be performed on the files in the protected directory, thus preventing the requested file from being extorted and ensuring the security and reliability of the file information.

[0044] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Where there is no conflict between the embodiments, the following embodiments and features can be combined with each other. Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0045] Figure 2 This is a flowchart illustrating a file backup method provided in an embodiment of the present invention; see attached diagram. Figure 2 As shown, this embodiment provides a file backup method. The execution subject of this method is a file backup device, which can be implemented as software or a combination of software and hardware. When the file backup device is implemented as hardware, it can be various electronic devices with file backup capabilities, including but not limited to personal computers, servers, etc. When the file backup device is implemented as software, it can be installed in the electronic devices listed above. Specifically, the file backup device can be implemented as an EDR device, and the EDR device can be located in the kernel. Based on the above-mentioned file backup device, the file backup method in this embodiment can include:

[0046] Step S201: Obtain the file write request.

[0047] Step S202: If the file write request is a file modification request, determine the probability information that the file write request corresponds to ransomware behavior.

[0048] Step S203: If the probability information is greater than or equal to a preset threshold, before performing a write operation based on the file write request, the request file corresponding to the file write request is copied to a preset protected directory, wherein the protected directory is located in the kernel.

[0049] The specific implementation process and effects of each of the above steps are explained in detail below:

[0050] Step S201: Obtain the file write request.

[0051] When a user has a file write requirement, the file backup device can obtain the file write request. In some instances, the file write request can be obtained through a preset human-computer interaction operation. In this case, obtaining the file write request may include: displaying the human-computer interaction interface; obtaining the user's selection operation on the requested file in the human-computer interaction interface; and determining the file write request based on the selection operation. This effectively ensures the accuracy and reliability of obtaining the file write request.

[0052] In other instances, file write requests can be obtained through a preset device. In this case, obtaining a file write request may include: identifying a preset device that is communicatively connected to the file backup device; and actively or passively obtaining the file write request through the preset device. This effectively ensures the accuracy and reliability of obtaining the file write request.

[0053] In some other instances, file write requests can be obtained not only through human-computer interaction or preset devices, but also through detection programs. In this case, multiple detection anchors can be deployed in the file backup device, and continuous listening operations can be performed at the detection anchors. When a pending process is detected, the file operation-related information can be determined through the callback function corresponding to the pending process. Based on the file operation-related information, the file write request can be determined, thus ensuring the accuracy and reliability of obtaining the file write request.

[0054] Step S202: If the file write request is a file modification request, determine the probability information that the file write request corresponds to ransomware behavior.

[0055] For file write requests, different application scenarios can correspond to different types of file write requests. These different types of file write requests can include file creation requests, file modification requests, etc., and since different types of file write requests can correspond to different file backup strategies, in order to perform file backup operations accurately, after obtaining the file write request, the request type of the file write request can be determined first. At this time, the method in this embodiment can also include: determining the request file corresponding to the file write request; identifying whether the request file already exists and obtaining a first identification result; and based on the first identification result, determining the request type of the file write request, which can include any one of the following: file modification request, file creation request.

[0056] Specifically, after obtaining a file write request, the file write request can be analyzed and processed to determine the request file corresponding to the file write request. Determining the request file corresponding to the file write request can include: determining the request file identifier based on the file write request. In some instances, the file write request may include a request file identifier, which can be obtained by performing information extraction operations on the file write request; then, the request file corresponding to the file write request can be determined based on the request file identifier.

[0057] After obtaining the requested file, it can be determined whether the requested file already exists, that is, whether the requested file is an existing file. The existing file can be all the files created by the file backup device at a historical time. At this time, determining whether the requested file already exists can include: obtaining the existing file identifier corresponding to each of the existing files; analyzing and comparing the request file identifier with the existing file identifier; if there is an existing file identifier that matches the request file identifier, it means that the requested file already exists; if there is no existing file identifier that matches the request file identifier, it means that the requested file is not an existing historical file.

[0058] After obtaining the first identification result of whether the requested file already exists, the request type of the file write request can be determined based on the first identification result. Specifically, determining the request type of the file write request based on the first identification result can include: if the first identification result indicates that the requested file is an existing file, then the file write request can be determined as a file modification request; if the first identification result indicates that the requested file is not an existing file, then the file write request can be determined as a file creation request. This effectively realizes the accurate determination of the request type of the file write request.

[0059] Different types of file write requests can correspond to different file backup strategies, and then different file backup strategies can be used to perform corresponding file processing operations. Specifically, when a file write request is a file creation request, since the file write request does not correspond to an existing file, it is impossible to perform ransomware encryption on the existing file when performing a write operation based on the file write request. In this case, no processing operation is required for the file creation request.

[0060] When it is determined that a file write request is a file modification request, in order to avoid the possibility that the file write request corresponds to illegal ransomware behavior, the probability information of ransomware behavior can be determined. Specifically, the probability information can be determined by analyzing and processing the file write request through a pre-trained neural network model. In this case, determining the probability information of ransomware behavior corresponding to the file write request may include: obtaining the pre-trained neural network model; determining the ransomware behavior characteristics; inputting the file write request and ransomware behavior characteristics into the neural network model for analysis and processing, and determining the probability information of ransomware behavior corresponding to the file write request output by the neural network model. This effectively ensures the accuracy and reliability of determining the probability information.

[0061] Step S203: If the probability information is greater than or equal to a preset threshold, before performing a write operation based on the file write request, the request file corresponding to the file write request is copied to a preset protected directory, wherein the protected directory is located in the kernel.

[0062] The preset threshold is a pre-configured value used to identify file write requests that are highly likely to correspond to ransomware attacks. Users can configure the preset threshold according to specific application scenarios or requirements; for example, the preset threshold can be 70%, 80%, or 90%. After obtaining the probability information of a file write request corresponding to ransomware attacks, the probability information can be analyzed and compared with the preset threshold. If the probability information is greater than or equal to the preset threshold, it indicates that the probability of the file write request corresponding to ransomware attacks is relatively high. To avoid information security risks caused by ransomware attacks, the request file corresponding to the file write request can be copied to a preset protected directory before performing the write operation based on the file write request. The protected directory can be a preset folder located in the kernel. Since the file write request is an application-level request operation, while the protected directory is located in the kernel layer, the kernel layer's access permissions are higher than the application layer's access permissions. That is, the access permissions of the protected directory are higher than the access requests of the file write request. In this way, when the file write request performs a write operation, it cannot perform write operations on the files in the protected directory, thereby ensuring the security and reliability of the information content in the request file.

[0063] The file backup method provided in this embodiment obtains file write requests. When the file write request is a file modification request, it can determine the probability information of ransomware behavior corresponding to the file write request. If the probability information is greater than or equal to a preset threshold, before performing a write operation based on the file write request, the requested file corresponding to the file write request is copied to a preset protected directory. Since the protected directory is located in the kernel layer, the access permissions of the protected directory are higher than the access requests of the file write request. In this way, when the file write request performs a write request operation, it cannot perform write operations on the files in the protected directory, thereby avoiding ransomware operations on the requested file and ensuring the security and reliability of the information content in the requested file, further improving the practicality of the method.

[0064] Figure 3 This is a flowchart illustrating the probability information of determining a file write request corresponding to ransomware behavior, provided in an embodiment of the present invention. Based on the above embodiments, refer to the appendix... Figure 3 As shown, this embodiment provides a method for determining probability information by checking whether the file format in the request file has been changed. In this case, the probability information for determining whether a file write request corresponds to ransomware behavior may include:

[0065] Step S301: Before performing a write operation based on a file write request, identify whether the file format of the requested file has been changed, and obtain a second identification result.

[0066] Since ransomware attacks often alter the file format of the requested file, to accurately determine the probability of ransomware activity associated with a file write request, it's possible to identify whether the file format has been changed before performing the write operation based on the request, obtaining a second identification result. In some instances, identifying whether the file format has been changed can be achieved by analyzing the file format. In this case, identifying whether the file format has been changed can include: obtaining the original file format of the requested file; obtaining the expected post-operation format of the requested file based on the file write request before performing the write operation; and identifying whether the file format has been changed based on the original file format and the expected post-operation format. Specifically, if the original file format and the expected post-operation format are the same, it indicates that the file format has not been changed; if the original file format and the expected post-operation format are different, it indicates that the file format has been changed.

[0067] In other instances, the file format of a requested file can be identified by whether its header has changed. In this case, identifying whether the file format of a requested file has been changed may include: obtaining the pre-write header before the file write operation is performed on the requested file based on the file write request; determining the reference header corresponding to the file type of the requested file; and identifying whether the file format of the requested file has been changed based on the pre-write header and the reference header.

[0068] After obtaining a file write request, the pre-write header before performing the file write operation on the requested file can be obtained based on the file write request. Obtaining the pre-write header of the requested file based on the file write request may include: determining the system callback function based on the file write request; determining the write operation information corresponding to the file write request based on the system callback function; and determining the pre-write header before performing the file write operation on the requested file based on the write operation information.

[0069] Specifically, after obtaining a file write request, the system call function corresponding to the file write request is obtained; based on the system call function, the write operation information corresponding to the file write operation is determined, which may include: write permission information, write location information, etc.; then, based on the write operation information, the file header before writing to the requested file can be determined, thus effectively ensuring the accuracy and reliability of determining the file header before writing.

[0070] It is understandable that the file header before writing a requested file can be determined not only by the system callback function, but also by simulating the execution of the operation. In this case, obtaining the file header before writing a requested file based on the file write request can include: performing a simulated write operation on the requested file based on the file write request and obtaining the simulated write result; obtaining the file header before writing a requested file based on the simulated write result. This can also accurately obtain the file header before writing.

[0071] In addition, in order to identify whether the file format of the requested file has been changed, besides obtaining the file header before the file write operation on the requested file, a reference file header corresponding to the file type of the requested file can also be determined. Since the reference file header is related to the file type of the requested file, the reference file header can be determined based on the file type of the requested file. In this case, determining the reference file header of the requested file may include: obtaining the file type of the requested file; and determining the reference file header of the requested file based on the file type.

[0072] Specifically, after obtaining the requested file, it can be analyzed and processed to determine its file type. The file type can be determined by the file extension or file attribute characteristics. For example, if the file extension of the requested file is "doc" or "docx", then the file type of the requested file is determined to be "word". Alternatively, the file type of the requested file can be determined by file attribute characteristics.

[0073] Since different file types can correspond to different reference headers, and the same text type can correspond to the same reference header, after obtaining the file type of the requested file, the reference header of the requested file can be determined based on the file type. Specifically, the reference header of the requested file can be determined through a preset mapping relationship and the file type. For example, when the file type is "doc", the reference header corresponding to the requested file can be "504B0304", etc. This effectively ensures the accuracy and reliability of determining the reference header.

[0074] After obtaining the pre-write header and reference header, the pre-write header and reference header can be analyzed and compared to identify whether the file format of the requested file has been changed. In some instances, identifying whether the file format of the requested file has been changed can be determined by a pre-trained machine learning model. In this case, the pre-trained machine learning model is obtained, and the pre-write header and reference header are input into the machine learning model for analysis and processing. The recognition result output by the machine learning model is obtained, and this recognition result is used to identify whether the file format of the requested file has been changed.

[0075] In other instances, the file format of the requested file can be identified by directly comparing the pre-write header and the reference header. In this case, identifying whether the file format of the requested file has been changed based on the pre-write header and the reference header can include: if the pre-write header and the reference header are the same, it can be determined that the file format of the requested file has not been changed; if the pre-write header and the reference header are different, it can be determined that the file format of the requested file has been changed. This effectively achieves accurate identification of whether the file format of the requested file has been changed.

[0076] Step S302: Based on the second identification result, determine the probability information that the file write request corresponds to ransomware behavior.

[0077] After identifying whether the file format of the requested file has been changed, the probability information of ransomware behavior corresponding to the file write request can be determined based on the obtained second identification result. Different second identification results can correspond to different probability information. In some instances, a lookup operation can be performed based on different second identification results and preset mapping relationships to determine the probability information corresponding to the second identification result.

[0078] In other instances, based on the second identification result, determining the probability information that a file write request corresponds to ransomware may include: if the second identification result indicates that the file format of the requested file has not been changed, determining the probability information as a first probability less than a preset threshold; or if the second identification result indicates that the file format of the requested file has been changed, determining the probability information as a second probability greater than or equal to a preset threshold.

[0079] It is understandable that both the first probability and the second probability are pre-configured probability values ​​corresponding to different identification results. For example, if the file format of the requested file is not changed according to the second identification result, it means that the probability of ransomware behavior in the file write request is relatively low. The probability can then be configured as a first probability less than a preset threshold, such as 10%, 5%, 15%, etc. Conversely, if the file format of the requested file has been changed according to the second identification result, it means that the probability of ransomware behavior in the file write request is relatively high. The probability can then be configured as a second probability greater than or equal to a preset threshold, such as 90%, 95%, 98%, or 93%, etc. This effectively allows different probability information to be determined based on different second identification results.

[0080] In this embodiment, before performing a write operation based on a file write request, the probability information of ransomware behavior corresponding to the file write request is determined by identifying whether the file format of the requested file has been changed, and then the probability information of ransomware behavior corresponding to the file write request is determined based on the obtained second identification result. This effectively ensures the accuracy and reliability of determining the probability information of ransomware behavior corresponding to the file write request.

[0081] Figure 4 This is a flowchart illustrating another file backup method provided by an embodiment of the present invention; based on any of the above embodiments, refer to the appendix. Figure 4 As shown, after copying the request file corresponding to the file write request to a preset protected directory, this embodiment provides a technical solution for accurately identifying whether the file write request corresponds to ransomware. At this time, the method in this embodiment may further include:

[0082] Step S401: Obtain the write behavior characteristics corresponding to the file write request.

[0083] After obtaining a file write request, the file write request can be analyzed and processed to obtain the write behavior characteristics corresponding to the file write request. The write behavior characteristics can be determined by analyzing and processing the file write request using a neural network model. The obtained write behavior characteristics may include at least one of the following: the write position corresponding to the file write request, the file content corresponding to the file write request, the file name corresponding to the file write request, etc.

[0084] Step S402: Determine the standard behavioral characteristics corresponding to the extortion behavior.

[0085] To accurately identify whether a file write request corresponds to ransomware, it's necessary not only to obtain the write behavior characteristics corresponding to the file write request but also to determine the standard behavioral characteristics corresponding to the ransomware. These standard behavioral characteristics can include: behavior characteristics related to encrypting files, behavior characteristics related to demanding ransom, etc. In some instances, standard behavioral characteristics can be determined through human-computer interaction. In this case, determining the standard behavioral characteristics corresponding to ransomware can include: obtaining configuration operations based on user-inputted behavioral characteristics; and determining the standard behavioral characteristics corresponding to the ransomware based on these configuration operations. This effectively ensures the accuracy and reliability of determining the standard behavioral characteristics.

[0086] Alternatively, in other instances, standard behavioral characteristics can be determined by a preset device. In this case, determining the standard behavioral characteristics corresponding to the ransomware behavior may include: determining the preset device that the file backup device is connected to, wherein the preset device may contain the standard behavioral characteristics corresponding to the ransomware behavior; determining the standard behavioral characteristics corresponding to the ransomware behavior actively or passively through the preset device, thus ensuring the accuracy and reliability of determining the standard behavioral characteristics.

[0087] Step S403: If the write behavior characteristics include standard behavior characteristics, then it is determined that the file write request corresponds to ransomware behavior;

[0088] Step S404: If the write behavior characteristics do not include standard behavior characteristics, then it is determined that the file write request does not correspond to ransomware behavior.

[0089] After obtaining the write behavior characteristics and standard behavior characteristics, the write behavior characteristics and standard behavior characteristics can be analyzed and compared. If the analysis and comparison result shows that the write behavior characteristics include the standard behavior characteristics, it can be determined that the file write request corresponds to ransomware behavior; if the analysis and comparison result shows that the write behavior characteristics do not include the standard behavior characteristics, it can be determined that the file write request does not correspond to ransomware behavior. This effectively achieves the accurate identification of whether a file write request corresponds to ransomware behavior.

[0090] Furthermore, after determining that the file write request corresponds to ransomware, this embodiment provides a processing strategy for analyzing and processing ransomware. At this time, the method in this embodiment may also include: terminating the ransomware; and performing file recovery operations on the requested file corresponding to the ransomware based on the protected directory.

[0091] Once it is determined that the file write request corresponds to ransomware, the ransomware can be terminated to prevent it from continuing to damage the file. Specifically, the ransomware can be terminated by terminating the file write request or the process corresponding to the ransomware. At this time, the termination command provided by the system can be used to terminate the file write request or the process corresponding to the ransomware, thus stopping the continued operation of the ransomware.

[0092] After the ransomware attack is terminated, in order to accurately perform file read and write operations, the requested files corresponding to the ransomware attack can be recovered through the protected directory. This involves copying the requested files corresponding to the ransomware attack from the protected directory to the original file location, allowing users to perform normal file read and write operations and ensuring the security and reliability of file processing operations.

[0093] In this embodiment, by obtaining the write behavior characteristics corresponding to the file write request, and then determining the standard behavior characteristics corresponding to the ransomware behavior, if the write behavior characteristics include the standard behavior characteristics, it can be determined that the file write request corresponds to ransomware behavior; if the write behavior characteristics do not include the standard behavior characteristics, it can be determined that the file write request does not correspond to ransomware behavior. This effectively realizes the accurate identification of whether a file write request corresponds to ransomware behavior, and then facilitates the corresponding file processing operations based on the identification results, thus effectively improving the security and reliability of file processing operations.

[0094] In practical application, this embodiment provides a method for proactive file backup against ransomware. This method can autonomously initiate a file backup process before potential ransomware is officially identified as a threat. This protects files from encryption before ransomware causes widespread damage, ensuring data recoverability. Specifically, the executor of this method can be a proactive file backup device, which can be deployed at the kernel level. The proactive file backup method implemented based on the aforementioned proactive file backup device can include the following steps:

[0095] Step 1: Real-time monitoring of process behavior.

[0096] The active file backup device includes a driver module that can be loaded and configured at the kernel level. This driver module can continuously monitor all file write requests in the active file backup device. When there is a file processing operation, the driver module can be used to realize real-time detection of process behavior.

[0097] Step 2: Identify whether the file write request is a file modification request.

[0098] After obtaining a file write request, it can be analyzed and processed to identify whether it is a file modification request. In some instances, identifying whether a file write request is a file modification request can be determined through a system callback function. Specifically, identifying whether a file write request is a file modification request can include: determining the system call function corresponding to the file write request, and using the system call function to determine the relevant information of the file write operation. This relevant information can include the operation type corresponding to the file write request, etc. Then, the operation type can be used to identify whether the file write request is a file modification request.

[0099] In other instances, identifying whether a file write request is a file modification request can be determined by whether the file corresponding to the file write request exists. In this case, identifying whether a file write request is a file modification request may include: obtaining the file to be written to corresponding to the file write request; identifying whether the file to be written to already exists; if the file to be written to exists, then the file write request is determined to be a file modification request; if the file to be written to does not exist, then the file write request is determined to be a file creation request.

[0100] Step 3: Modify the detection operation.

[0101] After obtaining a file write request, it can be determined whether the file write request can modify the file. If the file modification request modifies the file, the system will closely monitor the subsequent write actions of the file write request. Specifically, the detection of the subsequent write actions of the file write request can be implemented through the system framework (e.g., the minifilter framework). The subsequent write actions can include at least one of the following: the file opening path, the permissions of the file write request, and information related to the corresponding process, etc.

[0102] Step 4: Determine the probability information of ransomware behavior corresponding to the file write request.

[0103] If a file write request is determined to be a file modification request, then the probability information of ransomware behavior corresponding to the file write request can be determined. This probability information can be obtained through a comparison of file headers. After determining that the file write request is a file modification request, the file header information before the suspected ransomware operation on the requested file and the predefined file header corresponding to the requested file can be obtained. The predefined file header can be determined based on the file type of the requested file. Then, the probability information of ransomware behavior corresponding to the file write request can be determined based on the file header information and the predefined file header.

[0104] Specifically, after determining that a file write request is a file modification request, we can focus on the offset position of the write operation. If the file write operation needs to start writing from the file header, the file header corresponding to the requested file is likely to have changed. In this case, the file write operation often indicates that the file format may have been modified. For example, if it is modified to bytecode with a different file header, it means that the file write request may correspond to ransomware, and the probability of ransomware included in the file write request is relatively high. At this time, the probability information can be determined as the first probability, and then the file write request can be further analyzed and processed. If the file header corresponding to the requested file has not changed, it means that the file write request is unlikely to correspond to ransomware, and the probability information can be determined as the second probability.

[0105] Step 5: After the probability information is greater than or equal to the preset threshold, it can be identified whether the file write request clearly corresponds to ransomware. If it corresponds to ransomware, the request file corresponding to the file write request is copied to the preset protected directory, which is located in the kernel.

[0106] Among them, a protected directory is pre-configured and deployed at the kernel level. This protected directory is used to store the request files corresponding to the file write requests that correspond to ransomware attacks, so as to prevent the request files from being illegally extorted by ransomware attacks. It should be noted that the protected directory not only includes the request files that need to be protected, but may also include the configuration files of the active file backup device, so as to enable active file backup operations.

[0107] After the protected directory is deployed and configured, it can be identified whether a file write request explicitly corresponds to ransomware. At this time, it can be identified whether the feature information corresponding to the file write request corresponds to ransomware. If the feature information corresponding to the file write request corresponds to ransomware, then it is determined that the file write request explicitly corresponds to ransomware; if the feature information corresponding to the file write request does not correspond to ransomware, then it is determined that the file write request does not correspond to ransomware.

[0108] If a file write request is suspected of being related to ransomware, the requested file is immediately copied at the kernel level to a protected directory configured as described above. Since the protected directory is located in the kernel while other software resides in the user layer, this protected directory provides file protection capabilities and prevents it from being modified by other software. It is important to note that for backup files in the protected directory, file read operations are allowed, but file write operations are prohibited, thus ensuring that the backup files are not further infected.

[0109] Step 6: If it is determined that the file write request clearly corresponds to ransomware, then terminate the ransomware. After terminating the ransomware, restore the file version before encryption from the protected directory to minimize data loss.

[0110] The technical solution provided in this application embodiment has the advantages of immediate responsiveness and high resource utilization, taking action only when necessary, effectively reducing storage and performance pressure, while providing rapid defense and recovery capabilities against ransomware attacks; specifically, this technical solution can achieve the following functions:

[0111] (1) Rapid response: The timely backup mechanism ensures that it can intervene quickly at the beginning stage of ransomware encrypting files, reducing data loss. It is more timely than traditional methods that rely on behavior judgment. Specifically, if potential ransomware behavior is detected in the file write request, the file backup process can be started automatically before the ransomware behavior is officially marked as a threat, that is, in the initial stage of its attempt to encrypt user files. That is, the request file corresponding to the file write request can be backed up. This effectively reduces the risk of data damage before large-scale ransomware damage, protects files from encryption, ensures data recoverability, and fundamentally enhances the defense efficiency and data protection capabilities against ransomware attacks.

[0112] (2) Resource efficiency: Since this solution only needs to perform backup operations on the request file corresponding to the file write request, while performing full backup operations on other unnecessary files, it greatly reduces the consumption of storage resources and improves resource utilization.

[0113] (3) Precise defense: By intelligently analyzing file header changes and writing patterns, the accuracy of ransomware detection is improved, the false alarm rate is reduced, and backup operations are made more precise;

[0114] (4) Independent execution: It does not rely on external servers, which reduces the dependence on networks and additional hardware, simplifies the implementation process, and improves the stability and reliability of the system;

[0115] (5) Fine-grained detection and intelligent analysis: By utilizing the underlying technology of the operating system, deep detection of file operations is achieved. Combined with intelligent algorithms to analyze features such as changes in file headers, the accuracy of ransomware behavior identification is improved, and the practicality of the method is further enhanced.

[0116] Figure 5 This is a schematic diagram of a file backup device provided in an embodiment of the present invention; see attached diagram. Figure 5 As shown, this embodiment provides a file backup device, which is used to perform the above-described... Figure 2 The file backup method shown may include:

[0117] The first acquisition module 11 is used to acquire file write requests;

[0118] The first determining module 12 is used to determine the probability information that the file write request corresponds to ransomware behavior when the file write request is a file modification request;

[0119] The first processing module 13 is used to copy the request file corresponding to the file write request to a preset protected directory before performing a write operation based on the file write request if the probability information is greater than or equal to a preset threshold. The protected directory is located in the kernel.

[0120] In some instances, after obtaining the file write request, the first determining module 12 and the first processing module 13 in this embodiment are used to perform the following steps:

[0121] The first determining module 12 is used to determine the request file corresponding to the file write request;

[0122] The first processing module 13 is used to identify whether the requested file already exists and obtain a first identification result; based on the first identification result, it determines the request type of the file write request, wherein the request type includes any one of the following: file modification request, file creation request.

[0123] In some instances, when the first processing module 13 determines the request type of the file write request based on the first identification result, the first processing module 13 is used to perform the following: if the first identification result indicates that the requested file is an existing file, then the file write request is determined to be a file modification request; if the first identification result indicates that the requested file is not an existing file, then the file write request is determined to be a file creation request.

[0124] In some instances, when the first determining module 12 determines the probability information that a file write request corresponds to ransomware behavior, the first determining module 12 is used to perform the following: before performing a write operation based on the file write request, identify whether the file format of the requested file has been changed, and obtain a second identification result; based on the second identification result, determine the probability information that a file write request corresponds to ransomware behavior.

[0125] In some instances, when the first determining module 12 identifies whether the file format of the requested file has been changed, the first determining module 12 is used to perform the following: based on the file write request, obtain the pre-write header before the file write operation on the requested file; determine the reference header corresponding to the file type of the requested file; and identify whether the file format of the requested file has been changed based on the pre-write header and the reference header.

[0126] In some instances, when the first determining module 12 identifies whether the file format of the requested file has been changed based on the pre-write header and the reference header, the first determining module 12 is used to perform the following: if the pre-write header and the reference header are the same, determine that the file format of the requested file has not been changed; if the pre-write header and the reference header are different, determine that the file format of the requested file has been changed.

[0127] In some instances, when the first determining module 12 determines the probability information corresponding to the file write request as ransomware based on the second identification result, the first determining module 12 is used to perform the following: if the second identification result indicates that the file format of the requested file has not been changed, determine the probability information as a first probability less than a preset threshold; if the second identification result indicates that the file format of the requested file has been changed, determine the probability information as a second probability greater than or equal to a preset threshold.

[0128] In some instances, when the first determining module 12 determines the reference header of the request file, the first determining module 12 is used to perform: obtaining the file type of the request file; and determining the reference header of the request file based on the file type.

[0129] In some instances, when the first determining module 12 obtains the pre-write header of the requested file based on the file write request, the first determining module 12 is used to perform the following: determining a system callback function based on the file write request; determining write operation information corresponding to the file write request based on the system callback function; and determining the pre-write header of the requested file based on the write operation information.

[0130] In some instances, access permissions for the protected directory take precedence over those for file write requests.

[0131] In some instances, after copying the request file corresponding to the file write request to a preset protected directory, the first acquisition module 11, the first determination module 12, and the first processing module 13 in this embodiment are used to perform the following steps:

[0132] The first acquisition module 11 is used to acquire the write behavior characteristics corresponding to the file write request;

[0133] The first determining module 12 is used to determine the standard behavioral characteristics corresponding to the extortion behavior;

[0134] The first processing module 13 is used to determine that a file write request corresponds to ransomware if the write behavior characteristics include standard behavior characteristics, and to determine that a file write request does not correspond to ransomware if the write behavior characteristics do not include standard behavior characteristics.

[0135] In some instances, after determining that a file write request corresponds to ransomware, the first processing module 13 in this embodiment performs the following steps: terminate the ransomware; and perform file recovery operations on the requested file corresponding to the ransomware based on the protected directory.

[0136] Figure 5 The device shown can perform Figures 2-4 For the methods shown in the embodiments, the parts not described in detail in this embodiment can be referred to the following: Figures 2-4The relevant descriptions of the illustrated embodiments are provided below. For the execution process and technical effects of this technical solution, please refer to [link / reference]. Figures 2-4 The descriptions in the illustrated embodiments will not be repeated here.

[0137] In one possible design, Figure 5 The structure of the file backup device shown can be implemented as an electronic device, which can be a controller, personal computer, server, or other similar devices. Figure 6 As shown, the electronic device may include a first processor 21 and a first memory 22. The first memory 22 is used to store data executed by the corresponding electronic device. Figures 2-4 In the file backup method program provided in the illustrated embodiment, the first processor 21 is configured to execute the program stored in the first memory 22.

[0138] The program includes one or more computer instructions, wherein when the one or more computer instructions are executed by the first processor 21, they can perform the following steps: obtain a file write request; if the file write request is a file modification request, determine the probability information that the file write request corresponds to ransomware behavior; if the probability information is greater than or equal to a preset threshold, copy the request file corresponding to the file write request to a preset protected directory before performing the write operation based on the file write request, wherein the protected directory is located in the kernel.

[0139] Furthermore, the first processor 21 is also used to perform the aforementioned Figures 2-4 All or part of the steps in the illustrated embodiments.

[0140] The structure of the electronic device may also include a first communication interface 23 for communication between the electronic device and other devices or communication networks.

[0141] In addition, embodiments of the present invention provide a computer storage medium for storing computer software instructions used by an electronic device, which includes instructions for executing the above-described... Figures 2-4 The program involved in the file backup method in the illustrated embodiment.

[0142] Furthermore, embodiments of the present invention provide a computer program product, comprising: a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the aforementioned... Figures 2-4 The steps in the file backup method shown in the embodiment are illustrated.

[0143] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0144] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. The present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0146] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0147] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory. Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0148] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A file backup method, characterized in that, include: Get file write request; In the case that the file write request is a file modification request, determine the probability information that the file write request corresponds to ransomware behavior; If the probability information is greater than or equal to a preset threshold, then before performing a write operation based on the file write request, the request file corresponding to the file write request is copied to a preset protected directory, wherein the protected directory is located in the kernel.

2. The method according to claim 1, characterized in that, After obtaining the file write request, the method further includes: Determine the request file corresponding to the file write request; Identify whether the requested file already exists and obtain a first identification result; Based on the first identification result, the request type of the file write request is determined, and the request type includes any one of the following: file modification request, file creation request.

3. The method according to claim 2, characterized in that, Based on the first identification result, the request type of the file write request is determined, including: If the first identification result indicates that the requested file is an existing file, then the file write request is determined to be a file modification request; If the first identification result indicates that the requested file is not an existing file, then the file write request is determined to be a file creation request.

4. The method according to claim 1, characterized in that, Determining the probability information that the file write request corresponds to ransomware behavior includes: Before performing a write operation based on the file write request, it is determined whether the file format of the requested file has been changed, and a second identification result is obtained; Based on the second identification result, the probability information of ransomware behavior corresponding to the file write request is determined.

5. The method according to claim 4, characterized in that, Identifying whether the file format of the requested file has been changed includes: Based on the file write request, obtain the file header before the file write operation is performed on the requested file; Determine the reference file header corresponding to the file type of the requested file; Based on the pre-write header and the reference header, it is determined whether the file format of the requested file has been changed.

6. The method according to claim 5, characterized in that, Based on the pre-write header and the reference header, identifying whether the file format of the requested file has been changed includes: If the file header before writing and the reference file header are the same, it is determined that the file format of the requested file has not been changed; If the file header before writing and the reference file header are different, it is determined that the file format of the requested file has been changed.

7. The method according to claim 5, characterized in that, Determining the reference header of the request file includes: Obtain the file type of the requested file; Based on the file type, determine the reference file header of the requested file.

8. The method according to claim 4, characterized in that, Based on the second identification result, the probability information of ransomware behavior corresponding to the file write request is determined, including: If the second identification result indicates that the file format of the requested file has not been changed, the probability information is determined to be a first probability less than a preset threshold. If the second identification result indicates that the file format of the requested file has been changed, the probability information is determined to be a second probability greater than or equal to a preset threshold.

9. The method according to claim 5, characterized in that, Based on the file write request, obtain the file header before the file write operation is performed on the requested file, including: Based on the file write request, determine the system callback function; Based on the system callback function, determine the write operation information corresponding to the file write request; Based on the write operation information, the file header before writing the requested file is determined.

10. The method according to any one of claims 1-9, characterized in that, After copying the request file corresponding to the file write request to a preset protected directory, the method further includes: Obtain the write behavior characteristics corresponding to the file write request; Determine the standard behavioral characteristics corresponding to extortion; If the standard behavior characteristics are included in the write behavior characteristics, then the file write request is determined to correspond to ransomware behavior. If the standard behavior feature is not included in the write behavior features, then it is determined that the file write request does not correspond to ransomware behavior.

11. The method according to claim 10, characterized in that, After determining that the file write request corresponds to ransomware, the method further includes: Terminate the extortion attempt; Based on the protected directory, file recovery operations are performed on the request files corresponding to the ransomware attack.

12. A file backup device, characterized in that, include: The first acquisition module is used to acquire file write requests; The first determining module is used to determine the probability information that the file write request corresponds to ransomware behavior when the file write request is a file modification request; The first processing module is configured to, when the probability information is greater than or equal to a preset threshold, copy the request file corresponding to the file write request to a preset protected directory before performing a write operation based on the file write request, wherein the protected directory is located in the kernel.

13. An electronic device, characterized in that, include: A memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the method of any one of claims 1-11.

14. A computer storage medium, characterized in that, Used to store a computer program that, when executed by a computer, implements the method of any one of claims 1-11.

15. A computer program product, characterized in that, include: A computer program, when executed by a processor of an electronic device, causes the processor to perform the steps of the method of any one of claims 1-11.

Images