A ransomware early identification and blocking method based on two-stage ransom text detection

CN122333445APending Publication Date: 2026-07-03GUIZHOU UNIV

View PDF 0 Cites 0 Cited by

Patent Information

Application Number: CN202610461998.8
Authority / Receiving Office: CN · China
Patent Type: Applications(China)
Current Assignee / Owner
Filing Date: 2026-04-09
Publication Date: 2026-07-03

AI Technical Summary

Technical Problem

Existing technologies struggle to achieve high-accuracy detection before ransomware is launched or before the ransom note is written, making it impossible to identify unknown ransomware and failing to balance real-time detection with timely blocking.

Method used

By extracting executable file information before process creation, performing text string extraction and semantic discrimination, using the LTCABT model for candidate text classification, and monitoring the first file write behavior and memory image during process execution, a process tree is constructed for dual discrimination and blocking.

Benefits of technology

It enables intervention before ransomware acts destructively, improves the ability to identify unknown ransomware, reduces false alarm rates, enhances the real-time nature of detection and the thoroughness of blocking, and reduces system resource consumption.

✦ Generated by Eureka AI based on patent content.

Smart Images

Figure CN122333445A_ABST

Patent Text Reader

Abstract

This invention relates to a two-stage ransomware text detection method for early identification and blocking, belonging to the fields of network and information security and malware detection technology. Addressing the limitations of existing technologies in achieving high-accuracy detection before ransomware startup or ransomware letter writing, and inability to simultaneously achieve real-time blocking, this method proposes a pre-startup detection mechanism. This involves obtaining the executable file and extracting text strings to form candidate texts before process creation, obtaining pre-startup detection results based on semantic discrimination, and then executing blocking or allowing the process. After allowing the process to run, a process tree is constructed and the first file write behavior is monitored. This triggers the runtime phase, obtaining the memory image and extracting runtime candidate texts, performing semantic discrimination again, and terminating the process tree or resuming the process based on the results. This forms a detection and blocking mechanism that links the pre-startup and runtime phases, applicable to scenarios such as endpoint security protection, intrusion detection, and real-time system defense.

Need to check novelty before this filing date? Find Prior Art