Terminal data self-recovery protection method applied to ransomware

Abstract

The application discloses a terminal data self-recovery protection method applied to ransomware, and particularly relates to the technical field of network security. The application constructs a multi-dimensional terminal state evaluation system containing a self-recovery file success rate, a file repair rate, a hash check pass rate and a total score of malicious process danger, designs a quantitative calculation method of a file self-recovery coefficient and a self-recovery state evaluation value, realizes the judgment of the terminal self-recovery state, solves the problem of single evaluation index of the self-recovery effect of the traditional protection method, avoids the secondary attack risk caused by the residual malicious process, and guarantees the completeness of the terminal data recovery and the data credibility.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method for self-healing protection of endpoint data applied to ransomware. Background Technology

[0002] With the widespread adoption of digital offices and enterprise intranets, endpoints have become the primary target of ransomware attacks. These viruses can quickly encrypt and tamper with endpoint data, and spread laterally across the intranet, causing widespread infection, business interruption, data leaks, and significant economic losses. Meanwhile, the evolution of network attack techniques has made ransomware attacks increasingly sophisticated, allowing them to persist through process privilege escalation and system persistence, and adapt to different endpoint environments, further increasing the difficulty of protection. Endpoint data security has become crucial for enterprise network security.

[0003] However, existing technologies still have the following shortcomings in their application:

[0004] First, the data self-healing process after a terminal is attacked by ransomware lacks a scientific quantitative evaluation system. Judging the recovery effect based on simple indicators cannot comprehensively consider key dimensions such as the integrity of file recovery, data reliability, and the presence of malicious process residues in the system. This can easily lead to the presence of malicious process residues and pose a risk of secondary attacks.

[0005] Secondly, there is a lack of standardized and structured methods for extracting attack signatures of ransomware, making it impossible to comprehensively quantify and characterize attack behavior from multiple dimensions such as processes, files, networks, and systems, which makes it difficult to serve as an effective basis for matching and generating immune rules.

[0006] Finally, the existing immune rule base can only match known ransomware attacks. There are no corresponding rules available when facing new or variant attacks. Furthermore, the internal network protection lacks a lateral spread risk assessment mechanism and cannot classify and protect other terminals based on the characteristics of the attacked terminals. This can easily lead to the rapid spread of ransomware in the internal network and expand the impact of the attack.

[0007] Therefore, a self-healing protection method for endpoint data used in ransomware was introduced. Summary of the Invention

[0008] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a terminal data self-healing protection method for ransomware.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] Endpoint data self-healing protection methods applied to ransomware include the following steps:

[0011] Confirm self-healing status: After the terminal completes self-healing, extract the terminal status data for comprehensive analysis to obtain the healing status estimate, preset the healing status estimate threshold, and execute the corresponding subsequent processing steps based on the comparison result between the healing status estimate and the threshold.

[0012] The terminal status data includes the self-healing file success rate, file repair rate, proportion of unrecovered files, hash verification pass rate, and total malicious process risk score.

[0013] Attack feature extraction: Collect multi-dimensional behavioral data during the ransomware attack process, and generate standardized attack feature vectors for immune rule matching and threat identification after comprehensive processing of various types of data;

[0014] The extracted multidimensional behavioral data includes process privilege escalation behavior characteristics, file batch operation characteristics, file entropy increase characteristics, external network abnormal communication characteristics, and system persistence characteristics.

[0015] Generate immune rules: Match the attack feature vector with the known attack feature vectors stored in the historical immune database based on similarity, and determine the immune rules for the corresponding attack feature vectors based on the matching results;

[0016] The historical immunization database stores standard feature vectors, immunization rule content, applicable terminal types, and rule validity identifiers for different attacks.

[0017] Suppressing the risk of lateral spread: Based on the generated target immunity rules, the basic status parameters of all non-problem terminals in the intranet are collected through endpoint security protection software, the risk similarity value between each non-problem terminal and the problem terminal is calculated, and the risk level of the non-problem terminal is determined according to the risk similarity value.

[0018] Specifically, the process of analyzing terminal status data is as follows:

[0019] The file self-healing coefficient is obtained by comprehensively processing the file self-healing success rate, file repair rate, and proportion of unrecovered files.

[0020] Read the original file hash baseline value stored in the trusted backup area before self-healing, recalculate the hash value of each recovered file after self-healing and compare it with the baseline value;

[0021] The hash verification pass rate is calculated by comparing the number of files with consistent hashes with the total number of files participating in the verification.

[0022] It iterates through all running user-mode processes, background processes, and hidden processes on the current terminal, and compares the process path, process fingerprint, and behavioral characteristics of each process with the local malicious process signature database one by one.

[0023] The local malicious process signature database contains a set of risk scores corresponding to different types of malicious processes;

[0024] If a process successfully matches a malicious process in the signature database, the danger score corresponding to the malicious process is extracted, and the danger scores of all successfully matched malicious processes are summed to obtain the total danger score of the malicious process.

[0025] The ideal values ​​corresponding to the preset file self-healing coefficient and hash verification pass rate;

[0026] The healing status estimate is obtained by comprehensively processing the file self-healing coefficient, hash verification pass rate, and total malicious process danger score.

[0027] Specifically, the process of obtaining the file's self-healing coefficient is as follows:

[0028] Traverse the attacked directory and the self-healing recovery directory, collect the total number of files that need to self-heal and the total number of files that have successfully self-healed, and calculate the self-healing success rate by the ratio of the two.

[0029] All files involved in self-healing are divided into fully recovered files, partially recovered files, and unrecovered files. The total number of files in each category is calculated by summing the results.

[0030] The number of files recovered is obtained by multiplying the number of fully recovered files and the number of partially recovered files by the corresponding preset weight factors. The file repair rate is then calculated by comparing the number of recovered files with the total number of files that need to self-heal.

[0031] After the self-healing process is completed, the number of files that are still encrypted, cannot be opened, have missing data, or have corrupted formats is taken as the number of unrecovered files. The ratio of the number of unrecovered files to the total number of files that need to be self-healed is used to calculate the proportion of unrecovered files.

[0032] The file self-healing coefficient is obtained by comprehensively processing the success rate of self-healing files, the file repair rate, and the proportion of unrecovered files.

[0033] Specifically, the process of performing corresponding steps based on the comparison results is as follows:

[0034] A threshold for the pre-defined ...

[0035] When the self-healing value is greater than or equal to the corresponding threshold, the terminal is deemed to be in a qualified self-healing state, the data is fully restored, and the system environment is secure.

[0036] When the self-healing status estimate is less than the corresponding threshold, it is determined that the terminal's self-healing status does not meet the security requirements, and there are problems such as insufficient data recovery, insufficient data credibility, or malicious process residue. The self-healing status confirmation is then re-executed.

[0037] Specifically, the process of generating attack feature vectors from multi-dimensional behavioral data is as follows:

[0038] Collect the process path, process creation parameters, and privilege call behavior initiated during the attack to determine whether privilege escalation behavior exists and generate process privilege escalation feature values;

[0039] The number of files that are traversed, renamed, or have their suffixes modified within a unit of time and the frequency of such operations are statistically analyzed to obtain the characteristic values ​​of batch file operations.

[0040] The entropy change of the attacked file is calculated to obtain the characteristic value of the file entropy increase.

[0041] Collect the external network connection address, communication port, data transmission direction and connection frequency of the attack to obtain the abnormal communication characteristic value of the external network;

[0042] During the attack, the system detects modifications to system startup items, scheduled tasks, registry startup items, and system services, counts the number of abnormal configuration items, and obtains the system's persistent characteristic values.

[0043] After normalizing the process privilege escalation feature values, file batch operation feature values, file entropy increase feature values, external network abnormal communication feature values, and system persistence feature values, they are combined to form a fixed-dimensional attack feature vector.

[0044] Specifically, determine the immunity rules for the corresponding attack feature vectors:

[0045] Calculate the cosine similarity between the current attack feature vector and each standard feature vector in the historical immune database to obtain the feature similarity value;

[0046] A preset feature similarity threshold is used, and the calculated feature similarity value is compared with the corresponding threshold.

[0047] When the feature similarity value is greater than or equal to the corresponding threshold, the immune rule is extracted and adapted according to the current terminal's system version and service type, and then loaded into the terminal protection strategy;

[0048] When the feature similarity value is less than the matching threshold, it is determined that there is no corresponding immunization rule in the historical immunization database. The immunization rule with the highest feature similarity value is selected from the historical immunization database as the basic immunization template and sent to the technician's terminal.

[0049] Specifically, the process for calculating risk similarity values ​​is as follows:

[0050] Terminals that have been attacked by ransomware, have completed self-healing status confirmation and attack signature extraction are considered problematic terminals, while other online terminals in the intranet that have not experienced the current attack are considered non-problematic terminals.

[0051] The basic status parameters of each non-problem terminal on the intranet include the number of overlapping bits in the network segment, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled.

[0052] After normalizing the number of overlapping bits in network segments, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled, a diffusion risk feature vector is constructed.

[0053] Based on the problematic terminal, construct a baseline risk vector for the problematic terminal;

[0054] Construct a corresponding risk vector for each non-problem terminal on the internal network;

[0055] The risk similarity value is obtained by calculating the similarity between the risk vector of each non-problem terminal and the baseline risk vector of the problem terminal using cosine similarity.

[0056] Specifically, the process for determining the risk level of non-problem terminals is as follows:

[0057] Three risk similarity value ranges are preset, and each risk similarity value range corresponds to a risk level. The risk similarity value is matched with the corresponding range to determine the risk level of non-problem terminals.

[0058] The risk levels are categorized as high risk, medium risk, and low risk.

[0059] The technical effects and advantages of this invention are as follows:

[0060] (1) This invention constructs a multi-dimensional terminal status evaluation system that includes self-healing file success rate, file repair rate, hash verification pass rate and total malicious process danger score, and designs a quantitative calculation method for file self-healing coefficient and healing status estimate. This enables the judgment of terminal self-healing status, solves the problem of single self-healing effect evaluation index of traditional protection methods, avoids the risk of secondary attack caused by malicious process residue, and ensures the completeness and reliability of terminal data recovery.

[0061] (2) This invention extracts attack behavior data such as process privilege escalation, batch file operations, and file entropy increase changes, and generates standardized attack feature vectors through quantification and structuring. It combines cosine similarity to complete rule matching with historical immune database. At the same time, it designs a formulating excellence value calculation method based on the technical personnel feature information to realize customized generation of immune rules for new attacks. It realizes the comprehensive quantitative characterization of ransomware attack features and intelligent adaptation generation of immune rules, solves the technical defects of traditional protection attack feature extraction without standards and new attacks without corresponding protection rules, and improves the terminal's protection capability against known and variant ransomware.

[0062] (3) This invention collects basic status parameters of intranet terminals such as the number of overlapping network segments and the number of open ports, constructs a diffusion risk feature vector, and calculates the similarity with the problematic terminal to achieve risk level classification. It realizes accurate identification and graded protection of the horizontal diffusion risk of ransomware in the intranet, solves the problem that traditional intranet protection lacks a diffusion risk assessment mechanism and is prone to large-scale virus spread. Combined with the rapid deployment of immune rules, it forms a full-process protection system from single terminal self-healing protection to intranet full-domain risk prevention and control, which greatly reduces the overall attack impact of ransomware on intranet terminals. Attached Figure Description

[0063] Figure 1 This is a flowchart of the terminal data self-healing protection method of the present invention applied to ransomware. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] like Figure 1 As shown, the steps of the endpoint data self-healing protection method applied to ransomware are as follows:

[0066] Confirm self-healing status: After the terminal prompts self-healing, extract the terminal status data and perform comprehensive analysis to obtain the healing status estimate. Preset the healing status estimate threshold corresponding to the healing status estimate, and execute the corresponding steps based on the comparison results.

[0067] The terminal status data includes the self-healing file success rate, file repair rate, proportion of unrecovered files, hash verification pass rate, and total risk score of malicious processes.

[0068] Specifically:

[0069] By using endpoint security software, the attacked and self-healing directories are traversed to collect the total number of files requiring self-healing and the total number of files that have successfully healed. The self-healing success rate is calculated by dividing the number of successfully healed files by the total number of files requiring self-healing, using the total number of files that have successfully healed as the numerator and the total number of files that require self-healing as the denominator. ;

[0070] Additional notes: The self-healing file success rate reflects the completeness of the recovery of the terminal's core data; the higher the value, the better the file recovery effect.

[0071] All files involved in self-healing are divided into fully recovered files, partially recovered files, and unrecovered files. The total number of files in each category is calculated by summing the results.

[0072] The number of fully recovered files and the number of partially recovered files are multiplied by their respective preset weighting factors to obtain the total number of recovered files. The file repair rate is then calculated by dividing the number of recovered files by the total number of files requiring self-healing. ;

[0073] Additional notes: The file repair rate reflects the overall repair coverage of the file and is used to supplement the evaluation of the repair effect of files that are not fully recovered but are still usable.

[0074] Through endpoint security protection statistics, the number of files that remain encrypted, cannot be opened, have missing data, or are corrupted after the self-healing process is completed is counted as the number of unrecovered files; the ratio of the number of unrecovered files to the total number of files requiring self-healing is calculated to obtain the unrecovered file ratio. ;

[0075] Additional notes: A higher percentage of unrecovered files indicates a more severe self-healing omission and lower terminal data availability.

[0076] After normalizing the success rate of self-healing files, the file repair rate, and the proportion of unrecovered files, the formula was used. The file self-healing coefficient is obtained after weighted calculation. ,in , , These are the corresponding preset weighting factors;

[0077] For example, after an office terminal is attacked by ransomware and completes self-healing, a preset weight factor is used. =0.4、 =0.4、 =0.2, the weight of a fully recovered file is 1, and the weight of a partially recovered file is 0.5;

[0078] The attack generated a total of 100 files that needed to be self-healed, of which 70 were fully recoverable, 20 were partially recoverable, and 10 were not recovered.

[0079] The success rate of self-healing files =70 / 100=0.7, file repair rate =(70×1+20×0.5) / 100=0.8, the proportion of files not recovered. =10 / 100=0.1;

[0080] After normalizing each parameter and substituting it into the formula, we obtain... =30;

[0081] Using endpoint security protection software, the original file hash base value stored in the trusted backup area before self-healing is read, and the hash value of each recovered file after self-healing is recalculated and compared with the base value.

[0082] The hash verification pass rate is calculated by comparing the number of files with consistent hashes with the total number of files participating in the verification. ;

[0083] In addition, the hash verification pass rate can reflect whether the recovered data has been tampered with, replaced or abnormally rewritten, and is a key positive indicator of data credibility.

[0084] By using endpoint security protection software, all currently running user-mode processes, background resident processes, and hidden processes on the current endpoint are traversed, and the process path, process fingerprint, and behavioral characteristics of each process are compared with the local malicious process feature database one by one.

[0085] The local malicious process signature database contains a set of risk scores corresponding to different types of malicious processes;

[0086] If a process successfully matches a malicious process in the signature database, the corresponding danger score for that malicious process is extracted. The danger scores of all successfully matched malicious processes are then summed to obtain the total danger score of the malicious process. ;

[0087] Additional notes: The total risk score for malicious processes is a reverse indicator. A value greater than zero indicates that the attack source has not been completely eliminated, and there is a risk of secondary intrusion and further data corruption.

[0088] For example, the local malicious process signature database has a preset danger score:

[0089] Ransomware encryption process: danger score 10, remote control Trojan process: danger score 8, malicious scanning process: danger score 5;

[0090] The endpoint security software detected: 1 ransomware encryption process and 1 remote control Trojan process.

[0091] The total danger score for malicious processes is as follows: =10+8=18;

[0092] Based on the terminal's historical self-healing statistics, the ideal values ​​corresponding to the preset file self-healing coefficient and hash verification pass rate are marked as follows: , , ;

[0093] After normalizing the file self-healing coefficient, hash verification pass rate, and total malicious process risk score, the formula is used. The weighted calculation yields the estimated value. ,in , , These are the corresponding preset weighting factors;

[0094] To elaborate further, the self-healing value can determine the security status and recovery quality of the terminal after self-healing. The higher the value, the more complete the terminal data recovery, the higher the data credibility, the cleaner the environment, and the closer the self-healing effect is to the ideal security status.

[0095] The lower the value, the more likely the file recovery is insufficient, the data is at risk of being tampered with, or there are still residual threats in the system, and the self-healing state does not meet the requirements for safe operation.

[0096] For example, using the aforementioned office terminal scenario, a preset ideal value for the file self-healing coefficient is established. =30, Ideal value for hash verification pass rate =1, weighting factor =0.4、 =0.4、 =0.2;

[0097] The terminal calculates the file self-healing coefficient. =30, Hash Verification Pass Rate =0.98, Malicious Process Risk Score =0, normalize the parameters and substitute them into the formula. ≈0.97, the larger the self-healing valuation, the more likely the terminal has reached a near-ideal self-healing state;

[0098] A threshold for the pre-defined ...

[0099] When the self-healing value is greater than or equal to the corresponding threshold, the terminal is deemed to be in a qualified self-healing state, the data is fully restored, and the system environment is secure.

[0100] When the self-healing status estimate is less than the corresponding threshold, it is determined that the terminal's self-healing status does not meet the security requirements, and there are problems such as insufficient data recovery, insufficient data credibility, or malicious process residue. The self-healing status confirmation is then re-executed.

[0101] Attack signature extraction: Through endpoint security protection software, multi-dimensional behavioral data of this ransomware attack were collected. Various types of data were quantified, normalized and structured to generate standardized attack signature vectors for immune rule matching and threat identification.

[0102] The extracted multidimensional behavioral data includes process privilege escalation behavior characteristics, file batch operation characteristics, file entropy increase characteristics, external network abnormal communication characteristics, and system persistence characteristics.

[0103] By monitoring the processes of endpoint security software, the system collects the process paths, process creation parameters, and privilege escalation behaviors initiated during the attack, determines whether privilege escalation behavior exists, and generates process privilege escalation signature values. ;

[0104] Additional explanation: Process privilege escalation signatures are used to characterize the malicious behavior of attack programs in gaining control of the system, and are key process-type features for identifying ransomware.

[0105] By monitoring file behavior through endpoint security software, the number and frequency of files that are traversed, renamed, or have their extensions modified within a unit of time are statistically analyzed to obtain batch file operation characteristic values. ;

[0106] Additional notes: Batch file operation characteristic values ​​are used to characterize the typical behavior of ransomware in encrypting and destroying files in batches, and are an important basis for distinguishing normal operations from malicious attacks;

[0107] By using endpoint security software, the entropy change of the attacked file is calculated to obtain the characteristic value of the file entropy increase. ;

[0108] Additional explanation: The characteristic value of file entropy increase is used to characterize the degree of malice in the encryption and rewriting of the file, and is a core data feature for identifying cryptographic ransomware attacks;

[0109] By using endpoint security software, the external network connection address, communication port, data transmission direction, and connection frequency of the attack were collected to obtain abnormal external network communication characteristics. ;

[0110] Additional explanation: External network abnormal communication characteristic values ​​are used to characterize the communication behavior between the attack program and the external control terminal, and can identify the network command acquisition and data return behavior of ransomware.

[0111] By using endpoint security software, modifications made to system startup items, scheduled tasks, registry startup items, and system services during the attack are detected, the number of abnormal configuration items is counted, and the system persistent characteristics are obtained. ;

[0112] In addition, persistent system characteristics are used to characterize the behavior of ransomware residing in the system and achieving long-term control, and are important system characteristics for determining the risk of attack residue.

[0113] After normalizing the characteristics of process privilege escalation, batch file operations, file entropy increase, abnormal external network communication, and system persistence, a fixed-dimensional attack feature vector is formed. ;

[0114] In addition, this attack feature vector comprehensively quantifies the ransomware attack from five dimensions: process behavior, file operation, data change, network communication, and system residency. It has uniqueness, distinguishability, and matchability, and can serve as a unified quantitative basis for subsequent rule retrieval, similarity matching, and adaptive immune rule generation in the historical immune database, providing a feature basis for immune protection of terminals and similar terminals in the intranet.

[0115] Generate immune rules: Match the attack feature vector with the known attack feature vectors stored in the historical immune database based on similarity, and determine the immune rules for the corresponding attack feature vectors based on the matching results;

[0116] The historical immunization database stores standard feature vectors, immunization rule content, applicable terminal types, and rule validity identifiers for different attacks.

[0117] Specifically:

[0118] Calculate the cosine similarity between the current attack feature vector and each standard feature vector in the historical immune database to obtain the feature similarity value;

[0119] Additional explanation: Feature similarity value is used to measure the degree of similarity between this attack and known historical threats. The higher the value, the closer the attack behavior and attack pattern are to historical threats.

[0120] A preset feature similarity threshold is used, and the calculated feature similarity value is compared with the corresponding threshold.

[0121] When the feature similarity value is greater than or equal to the corresponding threshold, the immune rule is extracted and adapted according to the current terminal's system version and service type, and then loaded into the terminal protection strategy;

[0122] In addition, the generated immune rules are used to detect and intercept malicious processes, batch file encryption behaviors, abnormal external network connections, and system persistence operations that match the attack feature vector in real time, so as to prevent the terminal from being invaded by the same attack again.

[0123] When the feature similarity value is less than the matching threshold, it is determined that there is no corresponding immunization rule in the historical immunization database. The immunization rule with the highest feature similarity value is selected from the historical immunization database as the basic immunization template, and the rule formulation instruction is triggered. The technicians in the idle state are marked as candidates for formulation personnel. After comprehensive analysis of the feature information of each candidate for formulation personnel, the formulation optimization value is obtained. The formulation personnel are determined based on the sorting order of the formulation optimization values.

[0124] Among them, the characteristic information of each candidate personnel includes the success rate of handling, the average preparation time, and the success rate of reproducing similar threats;

[0125] By analyzing the personnel's historical response database, the total number of successful responses and the total number of responses against the current ransomware family were extracted for each candidate personnel. The ratio of the total number of successful responses to the total number of responses was used to calculate the personnel's success rate in dealing with the current ransomware family. ;

[0126] As a supplementary explanation, a higher success rate indicates that the personnel have more mature experience in dealing with this type of ransomware and that the handling effect is more stable.

[0127] By using the rule-making record database, the time taken to formulate each individual immunization rule in the history of each candidate rule-maker was extracted, and the average rule-making time was calculated. ;

[0128] As a supplementary explanation, the shorter the average rule-making time, the higher the efficiency of the rule-making personnel and the faster the emergency response speed.

[0129] By using the threat verification record database, extract the historical number of successful reproductions and the total number of reproductions for each candidate personnel against the same type of threat;

[0130] The success rate of reproducing the same type of threat is calculated by comparing the number of successful reproductions with the total number of reproductions. ;

[0131] As a supplementary explanation, the higher the success rate of reproduction, the more accurate the person's understanding of the characteristics and behaviors of similar attacks, and the higher the reliability of the rules formulated.

[0132] After normalizing the success rate of handling, the average formulation time, and the success rate of reproducing similar threats, they were entered into the formula. The specified excellence value is obtained after normalization. ,in , , These are the corresponding preset weighting factors;

[0133] The formulation merit values ​​of each candidate formulation personnel are sorted from smallest to largest, and the formulation personnel with the highest formulation merit value are selected as the formulation personnel. Based on the immunization rule template, appropriate immunization rules are further formulated.

[0134] For example, if an intranet terminal is attacked by the LockBit ransomware, and the similarity between the attack characteristics and the historical database is below the threshold, the system selects the most similar rule as the template and filters out 3 security personnel who are not in use.

[0135] Person A

[0136] The success rate for dealing with the current ransomware family is 0.95, the historical average processing time is 10 minutes, and the success rate for reproducing similar threats is 0.92.

[0137] According to calculations, the optimal value set by personnel A is 0.768;

[0138] Personnel B

[0139] The success rate for dealing with the current ransomware family is 0.88%, the historical average deployment time is 8 minutes, and the success rate for reproducing similar threats is 0.90.

[0140] According to calculations, the optimal value set by personnel B is 0.737;

[0141] Personnel C

[0142] The success rate for dealing with the current ransomware family is 0.75%, the historical average processing time is 15 minutes, and the success rate for reproducing similar threats is 0.70.

[0143] According to calculations, the optimal value determined by personnel C is approximately 0.593.

[0144] Sort by merit value from largest to smallest:

[0145] Personnel A > Personnel B > Personnel C, and Personnel A was ultimately selected to complete the formulation of the immunization rules.

[0146] Suppressing the risk of lateral spread: Based on the generated target immunity rules, the basic status parameters of all non-problem terminals in the intranet are collected through endpoint security protection software, the risk similarity value between each non-problem terminal and the problem terminal is calculated, and the risk level of the non-problem terminal is determined according to the risk similarity value.

[0147] Terminals that have been attacked by ransomware, have completed self-healing status confirmation and attack signature extraction are considered problematic terminals, while other online terminals in the intranet that have not experienced the current attack are considered non-problematic terminals.

[0148] The basic status parameters of each non-problem terminal on the intranet include the number of overlapping bits in the network segment, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled.

[0149] After normalizing the number of overlapping bits in network segments, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled, a diffusion risk feature vector is constructed.

[0150] Based on the problematic terminal, construct a baseline risk vector for the problematic terminal. ;

[0151] For each non-problem terminal on the internal network, construct a corresponding risk vector for that non-problem terminal. Where i is the corresponding non-problem terminal number;

[0152] The risk similarity value is obtained by calculating the similarity between the risk vector of each non-problem terminal and the baseline risk vector of the problem terminal using cosine similarity. ;

[0153] Additional explanation: the closer the risk similarity is to 1, the closer the environment of the non-problem terminal is to that of the problem terminal, the higher the risk of being attacked by lateral spread, and the higher the corresponding risk level.

[0154] For example, there is a problematic terminal A in the intranet that has been attacked by ransomware and has completed self-healing status confirmation, attack feature extraction and adaptive immune rule generation, which is used as the baseline terminal.

[0155] There were three online terminals, B, C, and D, on the internal network that were not affected by this attack;

[0156] Using problematic terminal A as a baseline, five quantifiable parameters were collected: the number of overlapping network segments, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled. After normalization, a baseline risk vector was constructed.

[0157] ={1.0,0.6,0.4,0.8,0.4}

[0158] The same parameter quantization, normalization, and vector construction were performed on the three non-problem terminals respectively, and the results were calculated. cosine similarity The preset similarity threshold is 0.7.

[0159] Non-problem terminal B

[0160] vector: ={1.0,0.8,0.6,0.7,0.6}, similarity: =0.96, matching the high-risk range ( A value ≥0.9 is considered high-risk.

[0161] Non-problem terminal C

[0162] vector: ={1.0,0.9,0.8,0.9,0.7}, Similarity: =0.92, matching the high-risk range ( A value ≥0.9 is considered high-risk.

[0163] Non-problem terminal D

[0164] vector: ={0.2,0.1,0.1,0.1,0.1}, similarity: =0.25, matching the low-risk range ( If the value is ≤0.7, it is considered low risk.

[0165] The above formulas are all dimensionless calculations. Dimensionless calculations can be performed using various methods such as standardization, which will not be elaborated here. The formulas are derived from software simulations based on a large amount of collected data, and the preset parameters in the formulas can be set by those skilled in the art according to the actual situation.

[0166] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, ATA hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state ATA hard disk.

[0167] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0168] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0169] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0170] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0171] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0172] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable ATA hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0173] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A terminal data self-healing protection method applied to ransomware, characterized in that, Includes the following steps: Confirm self-healing status: After the terminal completes self-healing, extract the terminal status data for comprehensive analysis to obtain the healing status estimate, preset the healing status estimate threshold, and execute the corresponding subsequent processing steps based on the comparison result of the healing status estimate and the threshold. The terminal status data includes the self-healing file success rate, file repair rate, proportion of unrecovered files, hash verification pass rate, and total malicious process risk score. Attack feature extraction: Collect multi-dimensional behavioral data during the ransomware attack process, and generate standardized attack feature vectors for immune rule matching and threat identification after comprehensive processing of various types of data; The extracted multidimensional behavioral data includes process privilege escalation behavior characteristics, file batch operation characteristics, file entropy increase characteristics, external network abnormal communication characteristics, and system persistence characteristics. Generate immune rules: Match the attack feature vector with the known attack feature vectors stored in the historical immune database based on similarity, and determine the immune rules for the corresponding attack feature vectors based on the matching results; The historical immunization database stores standard feature vectors, immunization rule content, applicable terminal types, and rule validity identifiers for different attacks. Suppressing the risk of lateral spread: Based on the generated target immunity rules, the basic status parameters of all non-problem terminals in the intranet are collected through endpoint security protection software, the risk similarity value between each non-problem terminal and the problem terminal is calculated, and the risk level of the non-problem terminal is determined according to the risk similarity value.

2. The terminal data self-healing protection method for ransomware according to claim 1, characterized in that, The specific process for analyzing terminal status data is as follows: The file self-healing coefficient is obtained by comprehensively processing the file self-healing success rate, file repair rate, and proportion of unrecovered files. Read the original file hash baseline value stored in the trusted backup area before self-healing, recalculate the hash value of each recovered file after self-healing and compare it with the baseline value; The hash verification pass rate is calculated by comparing the number of files with consistent hashes with the total number of files participating in the verification. It iterates through all running user-mode processes, background processes, and hidden processes on the current terminal, and compares the process path, process fingerprint, and behavioral characteristics of each process with the local malicious process signature database one by one. The local malicious process signature database contains a set of risk scores corresponding to different types of malicious processes; If a process successfully matches a malicious process in the signature database, extract the danger score corresponding to the malicious process, and sum up the danger scores of all successfully matched malicious processes to obtain the total danger score of the malicious process. The ideal values ​​corresponding to the preset file self-healing coefficient and hash verification pass rate; The healing status estimate is obtained by comprehensively processing the file self-healing coefficient, hash verification pass rate, and total malicious process danger score.

3. The terminal data self-healing protection method for ransomware according to claim 2, characterized in that, The specific process for obtaining the file's self-healing coefficient is as follows: Traverse the attacked directory and the self-healing recovery directory, collect the total number of files that need to self-heal and the total number of files that have successfully self-healed, and calculate the self-healing success rate by the ratio of the two. All files involved in self-healing are divided into fully recovered files, partially recovered files, and unrecovered files. The total number of files in each category is calculated by summing the results. The number of files recovered is obtained by multiplying the number of fully recovered files and the number of partially recovered files by the corresponding preset weight factors. The file repair rate is then calculated by comparing the number of recovered files with the total number of files that need to self-heal. After the self-healing process is completed, the number of files that are still encrypted, cannot be opened, have missing data, or have corrupted formats is taken as the number of unrecovered files. The ratio of the number of unrecovered files to the total number of files that need to be self-healed is used to calculate the proportion of unrecovered files. The file self-healing coefficient is obtained by comprehensively processing the success rate of self-healing files, the file repair rate, and the proportion of unrecovered files.

4. The terminal data self-healing protection method for ransomware according to claim 1, characterized in that, The specific process for performing the corresponding steps based on the comparison results is as follows: A threshold for the pre-defined ... When the self-healing value is greater than or equal to the corresponding threshold, the terminal is deemed to be in a qualified self-healing state, the data is fully restored, and the system environment is secure. When the self-healing status estimate is less than the corresponding threshold, it is determined that the terminal's self-healing status does not meet the security requirements, and there are problems such as insufficient data recovery, insufficient data credibility, or malicious process residue. The self-healing status confirmation is then re-executed.

5. The terminal data self-healing protection method for ransomware according to claim 1, characterized in that, The specific process of generating attack feature vectors from multidimensional behavioral data is as follows: Collect the process path, process creation parameters, and privilege call behavior initiated during the attack to determine whether privilege escalation behavior exists and generate process privilege escalation feature values; The number of files that are traversed, renamed, or have their suffixes modified within a unit of time and the frequency of such operations are statistically analyzed to obtain the characteristic values ​​of batch file operations. The entropy change of the attacked file is calculated to obtain the characteristic value of the file entropy increase. Collect the external network connection address, communication port, data transmission direction and connection frequency of the attack to obtain the abnormal communication characteristic value of the external network; During the attack, the system detects modifications to system startup items, scheduled tasks, registry startup items, and system services, counts the number of abnormal configuration items, and obtains the system's persistent characteristic values. After normalizing the process privilege escalation feature values, file batch operation feature values, file entropy increase feature values, external network abnormal communication feature values, and system persistence feature values, they are combined to form a fixed-dimensional attack feature vector.

6. The terminal data self-healing protection method for ransomware according to claim 1, characterized in that, Determine the immunity rules for the corresponding attack feature vectors: Calculate the cosine similarity between the current attack feature vector and each standard feature vector in the historical immune database to obtain the feature similarity value; A preset feature similarity threshold is used, and the calculated feature similarity value is compared with the corresponding threshold. When the feature similarity value is greater than or equal to the corresponding threshold, the immune rule is extracted and adapted according to the current terminal's system version and service type, and then loaded into the terminal protection strategy; When the feature similarity value is less than the matching threshold, it is determined that there is no corresponding immunization rule in the historical immunization database. The immunization rule with the highest feature similarity value is selected from the historical immunization database as the basic immunization template and sent to the technician's terminal.

7. The terminal data self-healing protection method for ransomware according to claim 1, characterized in that, The specific process for calculating risk similarity values ​​is as follows: Terminals that have been attacked by ransomware, have completed self-healing status confirmation and attack signature extraction are considered problematic terminals, while other online terminals in the intranet that have not experienced the current attack are considered non-problematic terminals. The basic status parameters of each non-problem terminal on the intranet include the number of overlapping bits in the network segment, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled. After normalizing the number of overlapping bits in network segments, the number of open ports, the number of shared directories, the frequency of intranet communication, and the number of remote services enabled, a diffusion risk feature vector is constructed. Based on the problematic terminal, construct a baseline risk vector for the problematic terminal; Construct a corresponding risk vector for each non-problem terminal on the internal network; The risk similarity value is obtained by calculating the similarity between the risk vector of each non-problem terminal and the baseline risk vector of the problem terminal using cosine similarity.

8. The terminal data self-healing protection method for ransomware according to claim 1, characterized in that, The specific process for determining the risk level of non-problem terminals is as follows: Three sets of risk similarity value ranges are preset, and each set of risk similarity value ranges corresponds to a risk level. The risk similarity values ​​are matched with the corresponding ranges to determine the risk level of non-problem terminals. The risk levels are categorized as high risk, medium risk, and low risk.

Images