Ransom task processing method and device, equipment and storage medium

Abstract

The application discloses a ransom task prevention processing method and device, equipment and a storage medium, and relates to the technical field of information security. The method comprises the following steps: obtaining input information and decision assistance information of a ransom task for a target device; obtaining an execution strategy of the ransom task according to the input information and the decision assistance information; and executing the ransom task based on the execution strategy. The method supports autonomous decision-making and takeover of end-to-end ransom tasks, is less prone to errors compared to a mode based on manual experience intervention, and is more accurate. The input information indicates the demand of a user for the ransom task, the decision assistance information comprises at least one of business information corresponding to the target device or resource information of the target device, the execution strategy of the ransom task is obtained by not only referring to the demand of the user but also being adapted to the business information corresponding to the target device and the resource information, and the dynamic adaptive capability of the ransom function is supported, so that the flexibility is higher than that of a mode of executing the ransom task according to a fixed task strategy.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to methods, apparatus, equipment and storage media for handling ransomware prevention tasks. Background Technology

[0002] With the increasing number of ransomware attacks, the security of data on target devices can be improved by performing ransomware protection tasks.

[0003] Taking storage devices as an example, related technologies rely on manual intervention or fixed execution strategies to perform ransomware protection tasks on these devices. Manual intervention, limited by the decision-maker's experience, is prone to errors, resulting in low reliability and accuracy of the ransomware protection strategy, thus compromising the security of the data on the storage device. Conversely, executing ransomware protection tasks according to fixed strategies lacks flexibility, leading to low accuracy and again compromising the security of the data on the storage device. Summary of the Invention

[0004] This application provides a method, apparatus, equipment, and storage medium for processing ransomware attacks, in order to improve the reliability and accuracy of ransomware attack execution strategies, thereby improving data security.

[0005] Firstly, a method for processing ransomware prevention tasks is provided. This method includes: acquiring input information and decision support information for a ransomware prevention task targeting a target device, wherein the input information indicates the user's requirements for the ransomware prevention task, and the decision support information includes at least one of business information corresponding to the target device or resource information of the target device. Then, based on the input information and decision support information, a first execution strategy for the ransomware prevention task is acquired; and the ransomware prevention task is executed based on the first execution strategy.

[0006] The business information corresponding to the target device includes, but is not limited to, at least one of the following: the business type and parameters of the business running on the target device itself, or the business type and parameters of the business running on the upper-layer device corresponding to the target device. Taking a storage device as an example, the upper-layer device corresponding to the target device is the host corresponding to the storage device, and the business information of the storage device includes, at least one of the following: the business type and parameters of the business running on the storage device, or the business type and parameters of the business running on the host.

[0007] The resource information of the target device includes, but is not limited to, at least one of the following: resource utilization rate, resource occupancy, or capacity occupancy. For example, if the resources of the target device include CPU, memory, and persistent storage media, the resource information of the target device includes CPU utilization rate, memory occupancy, or persistent storage media occupancy.

[0008] The method provided in this application obtains a first execution strategy for the ransomware prevention task and executes the task based on this strategy. This supports autonomous decision-making and takeover of the end-to-end ransomware prevention task. Compared to methods where each stage relies on human experience, the ransomware prevention task processing method provided in this application is less prone to errors and has higher accuracy. Furthermore, when obtaining the first execution strategy for the ransomware prevention task based on input information and decision support information, user needs are taken into account, and the business information and resource information of the storage device can also be adapted. This not only ensures the accuracy of the obtained first execution strategy but also supports the dynamic adaptability of the ransomware prevention function. Compared to executing the ransomware prevention task according to a fixed execution strategy, the method provided in this application is more flexible, resulting in higher security for the data on the target device. The data on the target device includes, but is not limited to, at least one of the following: data stored on the target device, data included in the business of the target device, or user-specified data.

[0009] In one possible implementation, the input information indicates a first type of ransomware task, and the first execution strategy indicates at least one sub-task included in the first type of ransomware task. This method uses input information to indicate the type of ransomware task the user wants to execute, thereby determining the sub-tasks indicating that type of ransomware task, making the obtained execution strategy more aligned with the user's needs and improving the user experience.

[0010] In one possible implementation, the first type includes at least one of data type identification, ransomware protection configuration, ransomware attack detection, or data recovery after a ransomware attack. Thus, this method is applicable to a variety of first-type ransomware protection tasks, broadening its scope of application.

[0011] Optionally, for different situations of the first type, the anti-ransomware tasks indicated by the first execution strategy include, but are not limited to, the following situations.

[0012] In the case where the first type includes data type identification, the first execution strategy instructs the anti-ransomware task to include one or more of the following: marking the identified sensitive or important data, and protecting the identified sensitive or important data according to the protection strategy. This approach enables the protection of sensitive or important data.

[0013] In the first type, where anti-ransomware configuration is included, the first execution policy instructs the anti-ransomware task to include configuring at least one anti-ransomware function, and configuring the anti-ransomware function includes configuring parameters for that function. This configuration allows for the provision of anti-ransomware functions that meet user needs, thus improving the user experience.

[0014] In the case where the first type includes ransomware attack detection, the first execution strategy instructs the ransomware protection task to include executing at least one response strategy on data detected as being under ransomware attack. In this scenario, a timely response is possible upon detection of a ransomware attack, ensuring prompt protection of the data affected by the attack.

[0015] In the first type, which includes data recovery following a ransomware attack, the first execution policy instructs the ransomware defense task to include implementing at least one recovery strategy on the ransomware-affected data. In this case, a recovery strategy is implemented on the ransomware-affected data to mitigate the impact of the ransomware attack.

[0016] In one possible implementation, obtaining a first execution strategy for the ransomware prevention task based on input information and decision support information includes: inputting the input information and decision support information into an artificial intelligence model, and obtaining the first execution strategy based on a data security knowledge base. By employing an artificial intelligence model combined with a data security knowledge base to obtain the first execution strategy, the obtained first execution strategy becomes more accurate.

[0017] The data security knowledge base includes, but is not limited to, at least one of the following: security knowledge entities identified based on input information, relationships or events between security knowledge entities, or first information; wherein, the first information includes input information of historical anti-ransomware tasks, decision support information of historical anti-ransomware tasks, and execution strategies of historical anti-ransomware tasks. The data security knowledge base in this method is comprehensive, and the execution strategies determined accordingly are more accurate.

[0018] In one possible implementation, the method further includes optimizing the data security knowledge base based on user feedback on the execution results of historical ransomware prevention tasks. The user feedback on the execution results of historical ransomware prevention tasks reflects the calibration of the execution results; optimizing the data security knowledge base using this feedback makes its content more accurate.

[0019] In one possible implementation, optimizing the data security knowledge base based on user feedback on the execution results of historical ransomware prevention tasks includes: constructing a security event knowledge graph based on first information and user feedback on the execution results of ransomware prevention tasks in the first information; performing knowledge reasoning based on the security event knowledge graph; and updating the data security knowledge base based on the results of the knowledge reasoning.

[0020] Since the first piece of information includes input information from historical ransomware prevention tasks, decision support information from historical ransomware prevention tasks, and execution strategies from historical ransomware prevention tasks, a security event knowledge graph is summarized based on the situation of historical ransomware prevention tasks and the feedback information of the execution results of the current ransomware prevention task. The results of knowledge reasoning based on this security event knowledge graph are more accurate. The data security knowledge base is updated according to the results of this knowledge reasoning, making the content of the data security knowledge base more comprehensive and accurate. The execution strategies for ransomware prevention tasks determined based on this data security knowledge base are also more accurate.

[0021] In one possible implementation, performing an anti-ransomware task based on a first execution strategy includes: orchestrating at least one subtask of the anti-ransomware task indicated by the first execution strategy to obtain an orchestration strategy, which indicates the execution order of the at least one subtask; and executing the at least one subtask according to the orchestration strategy. Since the orchestration strategy indicates the execution order of the subtasks, executing the subtasks according to the orchestration strategy makes the execution of the anti-ransomware task more orderly and improves the reliability of the execution result.

[0022] In one possible implementation, the orchestration strategy is derived based on at least one of the priorities among at least one subtask or the resource information of the target device. Determining the orchestration strategy based on the priorities among subtasks makes the execution order of the subtasks indicated by the orchestration strategy more accurate, while determining the orchestration strategy based on the resource information of the target device makes the orchestration strategy more adaptable to the resource situation of the target device.

[0023] In one possible implementation, the target device includes multiple storage devices, and the orchestration strategy is derived based on the device types and corresponding service types of the multiple storage devices. This method is applicable to scenarios such as data centers that include multiple storage devices, and by determining the orchestration strategy based on the device types and corresponding service types of the multiple storage devices, the determined orchestration strategy can consider the global situation and more accurately indicate the execution order of subtasks.

[0024] In one possible implementation, the method further includes: identifying user intent based on input information to obtain an intent identification result, wherein the intent identification result indicates the user's need for the ransomware prevention task; and obtaining a first execution strategy for the ransomware prevention task based on the input information and decision support information, including: obtaining the first execution strategy for the ransomware prevention task based on the intent identification result, the input information, and the decision support information. By identifying user intent, the obtained first execution strategy is made to conform to the user intent, thereby improving the user experience.

[0025] In one possible implementation, the target device includes multiple storage devices, the business information corresponding to the target device includes the business information corresponding to the multiple storage devices, and the resource information of the target device includes the resource information of the multiple storage devices. This method is applicable to scenarios such as data centers that include multiple storage devices, and the obtained business information corresponding to the target device is more comprehensive, taking into account the global situation, making the determined execution strategy more accurate. It also supports unified coordination and takeover of the execution strategies for anti-ransomware tasks across multiple storage devices.

[0026] Secondly, an anti-ransomware task processing device is provided, which is used to execute any of the methods provided in the first aspect. This application can divide the anti-ransomware task processing device into functional modules according to any of the methods provided in the first aspect. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. For example, this application can divide the anti-ransomware task processing device into a first acquisition module, a second acquisition module, a third acquisition module, and an execution module, etc., according to their functions.

[0027] The first acquisition module is used to acquire input information for the anti-ransomware task targeting the target device. The input information indicates the user's requirements for the anti-ransomware task.

[0028] The second acquisition module is used to acquire decision support information for the anti-ransomware task. The decision support information includes at least one of the business information corresponding to the target device or the resource information of the target device.

[0029] The third acquisition module is used to acquire the first execution strategy for the anti-ransomware task based on the input information and decision support information;

[0030] The execution module is used to perform anti-ransomware tasks based on the first execution strategy.

[0031] In one possible implementation, the input information indicates a first type of ransomware task; the first execution strategy indicates at least one sub-task included in the first type of ransomware task.

[0032] In one possible implementation, the first type includes at least one of data type identification, ransomware protection configuration, ransomware attack detection, or data recovery after a ransomware attack.

[0033] In one possible implementation, when the first type includes the identification of data types, the first execution strategy instructs the anti-ransomware task to include one or more of the following: marking the identified sensitive or important data, and protecting the identified sensitive or important data according to the protection strategy.

[0034] In the case where the first type includes an anti-ransomware feature configuration, the first execution strategy indicates that the anti-ransomware task includes configuring at least one anti-ransomware feature, and configuring the anti-ransomware feature includes configuring parameters for the anti-ransomware feature;

[0035] In the case where the first type includes ransomware attack detection, the first execution strategy instructs the ransomware prevention task to include executing at least one response strategy on data that has been detected as being under a ransomware attack.

[0036] In the case where the first type includes data recovery after a ransomware attack, the first execution strategy instructs the ransomware attack prevention task to include performing at least one recovery strategy on the data that has been subjected to a ransomware attack.

[0037] In one possible implementation, the third acquisition module is used to input the input information and decision-aid information into the artificial intelligence model, and obtain the first execution strategy based on the data security knowledge base.

[0038] In one possible implementation, the data security knowledge base includes at least one of security knowledge entities identified based on input information, relationships or events between security knowledge entities, or first information;

[0039] The first information includes input information for historical anti-ransomware missions, decision support information for historical anti-ransomware missions, and execution strategies for historical anti-ransomware missions.

[0040] In one possible implementation, the third acquisition module is also used to optimize the data security knowledge base based on user feedback information on the execution results of historical anti-ransomware tasks.

[0041] In one possible implementation, the third acquisition module is used to construct a security event knowledge graph based on the first information and user feedback information on the execution results of the anti-ransomware task in the first information; perform knowledge reasoning based on the security event knowledge graph; and update the data security knowledge base according to the results of the knowledge reasoning.

[0042] In one possible implementation, the execution module is configured to orchestrate at least one subtask of the anti-ransomware task indicated by the first execution strategy to obtain an orchestration strategy, the orchestration strategy being used to indicate the execution order of at least one subtask; and to execute at least one subtask according to the orchestration strategy.

[0043] In one possible implementation, the orchestration strategy is derived based on at least one of the priorities among at least one subtask or the resource information of the target device.

[0044] In one possible implementation, the target device includes multiple storage devices, and the orchestration strategy is derived based on the device type of the multiple storage devices and the corresponding service type of the multiple storage devices.

[0045] Thirdly, a computer device is provided, the computer device including a processor and a memory coupled together, the memory for storing at least one instruction, and the processor for loading and executing the at least one instruction to cause the computer device to perform any of the methods in the first aspect above.

[0046] In one possible implementation, the computer device includes a memory.

[0047] Fourthly, a computer-readable storage medium is provided, wherein at least one instruction is stored therein, the instruction being loaded and executed by a processor to implement any of the methods in the first aspect above.

[0048] Fifthly, a computer program (product) is provided, comprising computer programs / instructions, which are executed by a processor to enable a computer to perform any of the methods described in the first aspect above.

[0049] A sixth aspect provides a computer device comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory stores instructions, and the processor executes the instructions stored in the memory to control the transceiver to receive and transmit signals. When the processor executes the instructions stored in the memory, it causes the processor to perform any of the methods described in the first aspect.

[0050] Optionally, there may be one or more processors and one or more memories.

[0051] Alternatively, the memory can be integrated with the processor, or the memory can be set separately from the processor.

[0052] In the specific implementation process, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. This application does not limit the type of memory or the way the memory and processor are set.

[0053] In a seventh aspect, a chip is provided, including a processor for retrieving and executing program instructions or code stored in a memory, such that a computer device having the chip installed performs any of the methods described in the first aspect above.

[0054] Eighthly, another chip is provided, comprising: an input interface, an output interface, a processor, and a memory, wherein the input interface, the output interface, the processor, and the memory are connected via an internal connection path, the processor being used to execute code in the memory, and when the code is executed, the processor being used to execute any of the methods in the first aspect above.

[0055] Ninthly, a computer system is provided, comprising a plurality of computer devices and a processing device for any of the ransomware prevention tasks provided in the second aspect above, the processing device for ransomware prevention tasks being used to coordinate and take over the ransomware prevention functions of the plurality of computer devices.

[0056] It should be understood that the beneficial effects of the technical solutions and corresponding possible implementations of the second to ninth aspects of this application can be found in the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0057] Figure 1 A schematic diagram illustrating the implementation environment of a method for handling anti-ransomware tasks provided in this application embodiment;

[0058] Figure 2 A schematic diagram illustrating the implementation environment of another method for handling anti-ransomware tasks provided in this application embodiment;

[0059] Figure 3 A schematic diagram illustrating the implementation environment of another method for handling anti-ransomware tasks provided in this application embodiment;

[0060] Figure 4 A flowchart illustrating a method for handling ransomware prevention tasks, provided as an embodiment of this application;

[0061] Figure 5 A schematic diagram illustrating the process of obtaining an anti-ransomware task execution strategy, provided as an embodiment of this application;

[0062] Figure 6 This application provides a schematic diagram illustrating the process of executing an anti-ransomware task based on an execution strategy, as executor of this application.

[0063] Figure 7 A schematic diagram illustrating the process of coordinating and taking over anti-ransomware tasks across multiple storage devices, provided in an embodiment of this application;

[0064] Figure 8 A schematic diagram of a processing device for an anti-ransomware task provided in an embodiment of this application;

[0065] Figure 9 A schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0066] Figure 10 This is a schematic diagram of the structure of a computer system provided in an embodiment of this application. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0068] With the development and updates of ransomware, ransomware attacks are gradually increasing. Ransomware, also known as ransomware virus, is a type of malicious program. It spreads through Trojan viruses, emails, software vulnerabilities, and other means, rendering user data assets or computing resources—including user data, documents, emails, databases, source code, images, compressed files, etc.—unusable, and then demands money from the user. In response, ransomware protection tasks have emerged. Target devices execute these tasks to improve the security of the data on that device. Taking a storage device as an example, the data on that storage device includes data stored on the device, data from services running on the device, or user-specified data.

[0069] In related technologies, the following two methods are commonly used to perform ransomware prevention tasks.

[0070] Method 1: Rely on human intervention to perform ransomware prevention tasks.

[0071] In this first method, the user or administrator makes the decisions and operates the ransomware protection task on the storage device themselves. For example, manual intervention can be used to decide when to enable the ransomware protection function, which storage object to enable the ransomware protection function for, and which ransomware protection function to enable. Enabling the ransomware protection function includes, but is not limited to, setting the parameters that implement the ransomware protection function.

[0072] Because Method 1 involves multiple stages of ransomware protection that require human intervention for decision-making, the accuracy of decisions cannot be guaranteed due to the limitations of the decision-makers' experience, thus compromising the security of the data on the storage devices. Furthermore, the need for human intervention means that multiple stages typically require manual configuration and operation. Errors during manual operation can accumulate, posing a significant risk and again failing to guarantee the security of the data on the storage devices.

[0073] Method 2: The storage device performs the ransomware prevention task according to a fixed execution strategy.

[0074] In this second approach, the existing ransomware protection features on the storage device are typically fixed once enabled, or can only be adjusted according to some preset rules. For example, after configuring a practice document for the storage device to indicate a fixed execution strategy, the ransomware protection task is performed according to the fixed execution strategy indicated in the practice document. Because the execution strategy is fixed and unchanging, it cannot support the dynamic adaptability of the ransomware protection function, resulting in low flexibility and low accuracy of the execution strategy for the ransomware protection task, which in turn leads to low security of the data on the storage device.

[0075] Furthermore, because the execution strategy in Method 2 is fixed, the anti-ransomware function enabled on the storage device cannot be adjusted in a timely manner according to changes in the business being connected to it. For example, when the storage device's business information indicates that the business on the storage device is switching from regular file storage to high-concurrency database service, the original anti-ransomware function still uses a low-frequency detection strategy, which cannot accurately identify the database business being encrypted by ransomware, making the anti-ransomware function unsuitable for the current business.

[0076] Furthermore, because the execution strategy is fixed, it's impossible to adjust the anti-ransomware task execution strategy in a timely manner based on the resource information of the storage device. This resource information includes, but is not limited to, the current storage capacity (or storage space) and central processing unit (CPU) utilization rate. For example, when CPU utilization is low and CPU resources are sufficient, real-time anti-ransomware detection cannot be automatically activated, preventing further optimization of the anti-ransomware function and consequently hindering the improvement of data security on the storage device.

[0077] In addition to the two ransomware prevention methods mentioned above, related technologies also involve an auxiliary approach to ransomware prevention. This auxiliary approach collects information from storage devices via user commands and provides ransomware prevention suggestions based on the collected information. However, this method relies on the user to operate and take over the ransomware prevention task based on these suggestions, lacking autonomous decision-making and execution capabilities, and it cannot continuously learn and adapt to the storage environment.

[0078] This application provides a method for processing ransomware prevention tasks. The method obtains input information and decision support information for the ransomware prevention task targeting a target device. Based on the input information and decision support information, a first execution strategy for the ransomware prevention task is obtained. Then, the ransomware prevention task is executed based on the first execution strategy to obtain the task execution result. This method, by executing the ransomware prevention task based on the first execution strategy, supports end-to-end autonomous decision-making and takeover of ransomware prevention tasks. Furthermore, since this method does not require complete manual intervention, it avoids the problems associated with the aforementioned manual intervention methods. In addition, the input information indicates the user's requirements for the ransomware prevention task, and the decision support information includes at least one of the business information or resource information corresponding to the target device. Therefore, when obtaining the first execution strategy for the ransomware prevention task based on the input information and decision support information, it not only considers user requirements but also adapts to the business information and resource information corresponding to the storage device. This not only ensures the accuracy of the obtained first execution strategy but also supports the dynamic adaptability of the ransomware prevention function. Compared to executing ransomware prevention tasks according to a fixed execution strategy, the method provided in this application is more flexible, resulting in higher security for the data corresponding to the target device.

[0079] Taking the ransomware processing device executing the ransomware processing method provided in this application embodiment as an example, and the target device being a storage device, the implementation environment of the ransomware processing method provided in this application embodiment is as follows: Figure 1 As shown. Figure 1 The storage device is equipped with a ransomware task processing unit. For example, the ransomware task processing unit is a ransomware agent, which is an entity capable of autonomously perceiving, making decisions, and acting to achieve its goals. The ransomware task processing unit includes an interaction module 101, a ransomware task decision module 102, and a ransomware task takeover module 103.

[0080] The interaction module 101 is used to receive input information from the user regarding the ransomware prevention task for the storage device, the input information indicating the user's requirements for the ransomware prevention task. The interaction module 101 is also used to send the input information to the ransomware prevention task decision module 102.

[0081] In addition to receiving input information from the interaction module 101, the anti-ransomware task decision module 102 also acquires decision support information for the anti-ransomware task. This decision support information includes at least one of the following: business information corresponding to the storage device or resource information of the storage device. The business information corresponding to the storage device includes at least one of the business information of the business running on the storage device itself or the business information of the business running on the upper-level device corresponding to the storage device. Whether it is the business running on the storage device itself or the business running on the upper-level device corresponding to the storage device, the business information includes, but is not limited to, at least one of the following: business type or business parameters. After acquiring the user's input information and decision support information, the anti-ransomware task decision module 102 uses this information to obtain a first execution strategy for the anti-ransomware task and sends this first execution strategy to the anti-ransomware task takeover module 103. The method by which the anti-ransomware task decision module 102 obtains the first execution strategy based on the input information and decision support information is described below. Figure 4 The relevant description of step 403 shown will not be repeated here.

[0082] The ransomware task takeover module 103 receives a first execution strategy sent by the ransomware task decision module 102 and executes the ransomware task based on the first execution strategy. The method by which the ransomware task takeover module 103 executes the ransomware task based on the first execution strategy is described below. Figure 4 The relevant description of step 404 shown will not be repeated here.

[0083] See Figure 2 The implementation environment provided in this application embodiment also includes a data security knowledge base 104. The data security knowledge base 104 includes at least one of the following: security knowledge entities identified based on input information, relationships or events between security knowledge entities, or first information; wherein the first information includes, but is not limited to, input information of historical anti-ransomware tasks, decision support information of historical anti-ransomware tasks, and execution strategies of historical anti-ransomware tasks. Figure 2 In the implementation environment shown, after the interaction module 101 obtains the user's input information, it can also perform security knowledge entity recognition on the input information to obtain at least one of the security knowledge entities, the relationship between security knowledge entities, or events, and add the security knowledge entities, the relationship between security knowledge entities, or events to the data security knowledge base 104.

[0084] The anti-ransomware task decision module 102 is used to obtain a first execution strategy for the anti-ransomware task based on input information, decision support information, and the data security knowledge base 104. For example, the anti-ransomware task decision module 102 inputs the input information and decision support information into an artificial intelligence model and obtains the first execution strategy based on the data security knowledge base 104.

[0085] See Figure 3 The implementation environment provided in this application embodiment also includes an optimization module 105. The optimization module 105 is used to optimize the data security knowledge base 104 based on the feedback information of the execution results obtained by the anti-ransomware task takeover module 103 in executing historical anti-ransomware tasks (for example, the user may provide some feedback information on the execution results obtained by the anti-ransomware task takeover module 103 in executing historical anti-ransomware tasks). For example, the optimization module 105 constructs a security event knowledge graph based on the first information and the user's feedback information on the execution results of the anti-ransomware tasks in the first information, performs knowledge reasoning based on the security event knowledge graph, and then updates the data security knowledge base 104 according to the results of the knowledge reasoning.

[0086] The above implementation environment is for illustrative purposes only. The methods by which each module performs its corresponding operations within the implementation environment can be found below. Figure 4 The steps in the method shown will not be described in detail. Furthermore, the method provided in this application embodiment can also be applied to other implementation environments, and this application does not limit it. Regardless of the implementation environment, the target device can be any device besides a storage device, such as another device with ransomware protection requirements; this application embodiment does not limit the type of target device.

[0087] Combination Figures 1 to 3 The implementation environment shown in this application embodiment provides a method for processing ransomware tasks. Taking the execution of this method by a ransomware task processing device as an example, see [link to relevant documentation]. Figure 4 The method includes the following steps 401-404.

[0088] Step 401: Obtain input information for the anti-ransomware task targeting the device. The input information indicates the user's requirements for the anti-ransomware task.

[0089] This application does not limit the content of the input information. The input information may be user instructions indicating the user's requirements for the ransomware prevention task, or it may be documents indicating the user's requirements for the ransomware prevention task. For example, the input information includes, but is not limited to, storage manuals, ransomware prevention function configuration manuals, function description documents, etc.

[0090] In this embodiment, regardless of the content of the input information, the input information can indicate to the user what type of ransomware protection task they want to perform. This method uses input information to indicate the type of ransomware protection task the user wants to perform, thereby making the subsequently obtained execution strategy more aligned with the user's needs and improving the user experience. For example, the input information indicates a first type of ransomware protection task. The first type includes, but is not limited to, at least one of data type identification, ransomware protection function configuration, ransomware attack detection, or data recovery after a ransomware attack. Thus, this method can be applied to processing various first-type ransomware protection tasks, broadening its application scope.

[0091] Furthermore, the embodiments of this application do not limit the way in which the processing device for the anti-ransomware task obtains input information. For example, the processing device for the anti-ransomware task is configured on the target device, which provides an interface for interacting with the user and receives the user's input information based on the interface.

[0092] Step 402: Obtain decision support information for the anti-ransomware task. The decision support information includes at least one of the business information or resource information of the target device.

[0093] The business information corresponding to the target device includes, but is not limited to, at least one of the business types and parameters of the services running on the target device, or the business types and parameters of the services running on the upper-layer device corresponding to the target device. Taking a storage device as an example, the upper-layer device corresponding to the target device is the host corresponding to the storage device, and the business information corresponding to the target device includes, at least one of the business types and parameters of the services running on the storage device, or the business types and parameters of the services running on the host.

[0094] For example, business types include database services, and business parameters include business subtypes, input / output operations per second (IOPS) characteristics, or bandwidth usage. Business subtypes include, for example, Oracle and MySQL.

[0095] For example, business types include file system services, and business parameters include file read / write program types, IOPS characteristics, or bandwidth usage within the file system. File read / write program types include Word, PowerPoint, Excel, etc.

[0096] The resource information of the target device includes, but is not limited to, one or more of the following: resource utilization rate, resource occupancy, or capacity occupancy. For example, if the resources of the target device include CPU, memory, and persistent storage media, the resource information of the target device includes CPU utilization rate, memory occupancy, or persistent storage media occupancy.

[0097] This application does not limit the method of obtaining decision support information. For example, the state sensor of the storage device can be used to analyze the business information of the services running on the storage device or the business information of the services running on the upper layer devices of the storage device, and collect the resource information of the storage device.

[0098] Furthermore, this method is applicable not only to single-device scenarios but also to multi-device scenarios. For example, in multi-device scenarios such as data centers, the target device may include multiple storage devices. In this case, the business information corresponding to the target device includes the business information corresponding to multiple storage devices, and the resource information of the target device includes the resource information of multiple storage devices. Thus, the obtained business and resource information corresponding to the target device is more comprehensive, taking into account the global situation, making the determined execution strategy more accurate, and also supporting unified coordination and takeover of the execution strategies for ransomware prevention tasks across multiple storage devices.

[0099] Step 403: Based on the input information and decision support information, obtain the first execution strategy for the anti-ransomware task.

[0100] In one possible implementation, obtaining a first execution strategy for the ransomware prevention task based on input information and decision support information includes: inputting the input information and decision support information into an artificial intelligence (AI) model, and obtaining the first execution strategy based on a data security knowledge base. This process can be as follows: Figure 5 As shown, by using an artificial intelligence model combined with a data security knowledge base to obtain the first execution strategy, the obtained first execution strategy is more accurate.

[0101] The data security knowledge base includes, but is not limited to, at least one of the following: security knowledge entities identified based on input information, relationships or events between security knowledge entities, or first information. The first information includes input information from historical ransomware prevention tasks, decision support information from historical ransomware prevention tasks, and execution strategies from historical ransomware prevention tasks. In this embodiment, the data security knowledge base includes more comprehensive content, and the execution strategies determined accordingly are more accurate. Historical ransomware prevention tasks can be those completed before the current ransomware prevention task; for example, historical ransomware prevention tasks can include any ransomware prevention task completed before step 401.

[0102] In some embodiments, the method further includes optimizing the data security knowledge base based on user feedback information regarding the execution results of historical ransomware prevention tasks. In this case, after executing a historical ransomware prevention task and obtaining its execution result, the execution result is calibrated by collecting feedback information on the execution result of the historical ransomware prevention task (user feedback information on the execution result of the historical ransomware prevention task). That is, user feedback information on the execution result of the historical ransomware prevention task can reflect the calibration status of the user's execution strategy for the historical ransomware prevention task. Optimizing the data security knowledge base using user feedback information on the execution result of the historical ransomware prevention task makes the content of the data security knowledge base more accurate, i.e., makes the execution strategies for historical ransomware prevention tasks included in the data security knowledge base more accurate. For example, for the ransomware prevention detection function, the feedback information on the execution result of the historical ransomware prevention task can be used to autonomously analyze false negatives and false positives, thereby optimizing the data security knowledge base.

[0103] For example, optimizing the data security knowledge base based on user feedback on the execution results of historical ransomware prevention tasks includes: constructing a security event knowledge graph based on first information and user feedback on the execution results of ransomware prevention tasks in the first information; performing knowledge reasoning based on the security event knowledge graph; and updating the data security knowledge base based on the results of knowledge reasoning.

[0104] Because the first piece of information includes input information from historical ransomware prevention tasks, decision support information from historical ransomware prevention tasks, and execution strategies from historical ransomware prevention tasks, the security event knowledge graph constructed based on the situation of historical ransomware prevention tasks and the feedback information from the execution results of the current ransomware prevention task is more consistent with the actual situation. The constructed security event knowledge graph is more accurate, and the results of knowledge reasoning based on this security event knowledge graph are more comprehensive and accurate. After updating the data security knowledge base based on the results of this knowledge reasoning, the content of the data security knowledge base becomes more comprehensive and accurate, and the execution strategies for ransomware prevention tasks determined based on this data security knowledge base are also more accurate.

[0105] As described in step 401 above, if the input information indicates a first type of ransomware task, then the first execution strategy obtained in step 403 indicates at least one sub-task included in the first type of ransomware task. Next, for the first type of ransomware task indicated by the input information, examples of the ransomware task indicated by the first execution strategy will be provided, including but not limited to one or more of the following situations.

[0106] In Scenario 1, where the first type includes data type identification, the first execution strategy instructs the anti-ransomware task to include one or more of the following: marking the identified sensitive or important data, or protecting the identified sensitive or important data according to the protection strategy.

[0107] The first type of ransomware prevention task in Scenario 1 includes identifying the type of target data. Target data includes, but is not limited to, data stored on the target device, or data contained in the business corresponding to the target device, or data specified by the user. The type of target data includes sensitivity level or importance level, etc.

[0108] Taking the acquisition of the first execution strategy for ransomware prevention tasks through an AI model as an example, the AI ​​model determines the first type of the ransomware prevention task as data type identification based on the input information, and then performs data type identification to obtain the identification result. This identification result indicates the identified sensitive or important data. The first execution strategy determined based on decision support information, etc., includes one or more of the following: marking the identified sensitive or important data, and protecting the identified sensitive or important data according to a protection strategy.

[0109] The first execution strategy specifies the type and parameters of the subtasks included in the ransomware prevention task, which identifies the type of data. For example, the subtask type is "marking," and its parameter is an identifier for marking important or sensitive data. Another example is the subtask type is "protection," where the parameters are an identifier for important or sensitive data, and the corresponding protection strategy for each type of data.

[0110] Case 2: In the case where the first type includes an anti-ransomware feature configuration, the first execution policy instructs the anti-ransomware task to include configuring at least one anti-ransomware feature, and configuring the anti-ransomware feature includes configuring parameters for the anti-ransomware feature.

[0111] In scenario 2, the type of subtask indicated by the first execution strategy can be: configuring at least one anti-ransomware function, where the parameters can be parameters for each anti-ransomware function. For example, for a periodic anti-ransomware detection function, the parameters indicate the specific period.

[0112] Taking the example of obtaining the first execution strategy for an anti-ransomware task through an AI model, the AI ​​model determines the type of the anti-ransomware task—configuring anti-ransomware features—based on user input information. It then determines at least one anti-ransomware feature that needs to be configured based on decision support information, and outputs the first execution strategy. This first execution strategy includes configuring at least one anti-ransomware feature and the parameters of that feature. In this scenario 2, because the configuration of the anti-ransomware feature is determined based on user input information, the configured feature is the one the user desires, meeting user needs and improving user experience.

[0113] For example, if the user information indicates that the user's requirement for the ransomware protection task is to configure periodic ransomware protection functionality, then the first execution policy instructs to enable the post-event periodic ransomware protection detection function and configure the parameters of the post-event periodic ransomware protection function. Alternatively, if the user information indicates that the user's requirement for the ransomware protection task is to configure real-time ransomware protection functionality, then the first execution policy instructs to enable the real-time ransomware protection function and configure the parameters of the real-time ransomware protection function. Alternatively, if the user information indicates that the user's requirement for the ransomware protection task is to configure and enable ransomware protection functionality without affecting front-end services, then the first execution policy instructs to enable the post-event periodic ransomware protection detection function and configure the parameters of the post-event periodic ransomware protection detection function.

[0114] For example, for file system A, where the data is highly important and the IO concurrency is relatively low, the primary strategy is to recommend enabling pre-, during-, and post-ransomware detection simultaneously, with the optimal configuration parameter being XX. For file system B, where the data volume is large and the IO concurrency is high, the primary strategy is to recommend enabling only the post-ransomware detection function, without affecting front-end business operations, with the configuration parameter being YY. Files A and B are merely examples, and XX and YY are only illustrative examples of parameters and are not limited to specific parameters.

[0115] For example, for the C file system, where data changes rapidly, the first execution strategy is to recommend setting the snapshot interval to once every hour; for the D file system, where data changes more slowly, the first execution strategy is to recommend setting the snapshot interval to once a day.

[0116] In scenario 3, where the first type includes ransomware attack detection, the first execution strategy instructs the ransomware prevention task to include executing at least one response strategy on data detected as being under ransomware attack.

[0117] In scenario 3, the first type of ransomware prevention task refers to performing ransomware detection on target data and implementing response strategies for data detected as being under ransomware attack. Target data includes, but is not limited to, data stored on the target device, or data included in the services corresponding to the target device; the target data can also be specified by the user.

[0118] Taking the acquisition of the first execution strategy for ransomware prevention tasks through an AI model as an example, the AI ​​model determines the type of ransomware prevention task based on user input information, and performs ransomware attack detection on the target data based on user input information, decision support information, etc., to determine whether any data is under ransomware attack. If data is under ransomware attack, the model determines the scope or degree of the attacked data and provides a response strategy. For example, the sub-task type indicated by the first execution strategy is to execute at least one response strategy on the ransomware-attacked data. The response strategy is equivalent to the parameters of the sub-task, which include, but are not limited to, alerts, attack blocking (e.g., terminating the process corresponding to the ransomware attack), or taking a snapshot of the ransomware-attacked data, to prevent the destruction of a large amount of normal data.

[0119] Case 4: In the case where the first type includes data recovery after a ransomware attack, the first execution strategy instructs the ransomware attack prevention task to include performing at least one recovery strategy on the data that has been ransomware attacked.

[0120] In scenario 4, the first type of ransomware protection task refers to the recovery of target data. Target data includes, but is not limited to, data stored on the target device, or data included in the services corresponding to the target device; this target data can also be specified by the user.

[0121] Taking the example of obtaining the first execution strategy for ransomware prevention tasks through an AI model, the AI ​​model determines the type of ransomware prevention task based on the user's input information and determines the recovery strategy corresponding to the data under ransomware attack based on decision support information. For example, the recovery strategy indicates the target data to be recovered, the target time point to be recovered, and the recovery drills for restoring the target data to the target time point.

[0122] In scenario 4, the first execution strategy instructs that at least one subtask included in this first type of ransomware protection task includes a subtask type and subtask parameters. The subtask type is: executing at least one recovery strategy on data subjected to a ransomware attack, where the recovery strategy is a parameter of the subtask. In this scenario, upon detecting a ransomware attack, the execution of the recovery strategy enables a timely response and protection of the data subjected to the ransomware attack.

[0123] In one possible implementation, the method further includes adding the input information of the ransomware prevention task, the decision support information of the ransomware prevention task, and the first execution strategy of the ransomware prevention task to the data security knowledge base. This further optimizes the data security knowledge base, which can then be used to determine the execution strategy for subsequent ransomware prevention tasks, making the determined execution strategy more accurate.

[0124] Optionally, the method further includes: identifying user intent based on input information to obtain an intent identification result, wherein the intent identification result indicates the user's need for the anti-ransomware task; and obtaining a first execution strategy for the anti-ransomware task based on the input information and decision support information, including: obtaining the first execution strategy for the anti-ransomware task based on the intent identification result, the input information, and the decision support information. This application does not limit the method of identifying user intent. For example, the user's input information can be input into an intent discriminator, and the intent discriminator can identify the user intent to obtain an intent identification result. The intent discriminator includes, but is not limited to, multi-classification models or algorithms. By identifying user intent, the obtained first execution strategy conforms to the user intent, thus improving the user experience.

[0125] In one possible implementation of this application, when identifying user intent based on input information, the input information can be processed first, and then the user intent can be identified from the processed input information. This application does not limit the method of data processing; for example, it may perform word segmentation on the input information or filter out invalid information, thereby improving the accuracy and efficiency of intent recognition.

[0126] Step 404: Execute the anti-ransomware task based on the first execution strategy.

[0127] For example, executing an anti-ransomware task based on a first execution strategy includes: orchestrating at least one subtask of the anti-ransomware task indicated by the first execution strategy to obtain an orchestration strategy, the orchestration strategy being used to indicate the execution order of at least one subtask; and executing at least one subtask according to the orchestration strategy. For instance, by invoking the storage device's toolchain, the anti-ransomware task is executed according to the orchestration strategy, and the execution result is output and fed back after autonomous execution. The process of executing the anti-ransomware task can obtain the corresponding interface function of the anti-ransomware task, pass in the corresponding parameters, and execute the anti-ransomware task.

[0128] For example, the process of performing an anti-ransomware task based on the first execution strategy can be found in [reference needed]. Figure 6 As shown, the first execution strategy indicates multiple subtasks, including subtask 1, subtask 2, and subtask N, where N is a positive integer greater than 2. Since the orchestration strategy indicates the execution order of the subtasks, executing the subtasks according to the orchestration strategy makes the execution of the ransomware prevention task more orderly and improves the reliability of the execution results.

[0129] Furthermore, since the orchestration strategy indicates the execution order of at least one subtask, when the ransomware prevention task includes multiple subtasks, the execution order of these subtasks can be different for each subtask, meaning each subtask is executed sequentially. Optionally, two or more subtasks may have the same execution order; subtasks with the same execution order can be understood as being executed in parallel, meaning two or more subtasks are executed concurrently. This application does not limit the execution order of the subtasks indicated by the orchestration strategy; it can be determined based on the application and the specific circumstances of the ransomware prevention task.

[0130] For example, the orchestration strategy is derived based on at least one of the priorities among at least one subtask or the resource information of the target device. This application does not limit the method for determining the priorities among subtasks; for example, the user can specify the priorities of the subtasks, or the priorities of the subtasks can be determined based on their importance. By determining the orchestration strategy based on the priorities among subtasks, the execution order of the subtasks indicated by the orchestration strategy is more accurate. By determining the orchestration strategy based on the resource information of the target device, the orchestration strategy is more adaptable to the resource situation of the target device.

[0131] In some embodiments, the target device includes multiple storage devices, and the orchestration strategy is derived based on the device types of the multiple storage devices and the corresponding service types. For the processing procedure of anti-ransomware tasks in scenarios with multiple storage devices, please refer to [link to relevant documentation]. Figure 7 , Figure 7 Taking multiple storage devices, including storage device 1, storage device 2 and storage device N, as an example, where N is a positive integer greater than 2. Figure 7 The relevant details can be found in the descriptions of the steps above, and will not be repeated here. This method is applicable to scenarios such as data centers that include multiple storage devices. It determines the orchestration strategy based on the device types of multiple storage devices and the corresponding service types, ensuring that the determined orchestration strategy considers the global situation and indicates a more accurate execution order for subtasks.

[0132] It should be noted that this application uses the first execution strategy of the ransomware prevention task as an example for illustration. In actual implementation, the ransomware prevention task may also include other execution strategies different from the first execution strategy. The embodiments of this application do not limit the number of execution strategies of the ransomware prevention task. For example, the ransomware prevention task also includes a second execution strategy. The method for obtaining the second execution strategy can refer to the method for obtaining the first execution strategy, and will not be repeated here.

[0133] The method provided in this application obtains a first execution strategy for the ransomware prevention task and executes the task based on this strategy. This supports autonomous decision-making and takeover of the end-to-end ransomware prevention task. Compared to methods where each stage relies on human experience, the ransomware prevention task processing method provided in this application is less prone to errors and has higher accuracy. Furthermore, when obtaining the first execution strategy for the ransomware prevention task based on input information and decision support information, user needs are taken into account, and the business information and resource information of the storage device can also be adapted. This not only ensures the accuracy of the obtained first execution strategy but also supports the dynamic adaptability of the ransomware prevention function. Compared to executing the ransomware prevention task according to a fixed task strategy, the method provided in this application is more flexible, resulting in higher security for the data on the target device.

[0134] The above describes the method for processing anti-ransomware tasks according to embodiments of this application. Corresponding to the above method, embodiments of this application also provide an apparatus for processing anti-ransomware tasks. Figure 8 This is a schematic diagram of the structure of the anti-ransomware task processing device provided in the embodiments of this application. The anti-ransomware task processing device can be... Figures 1-3 The ransomware processing device shown in the implementation environment is used to perform ransomware tasks. Figures 4-7 Any of the methods described. Based on Figure 8 The following modules are shown. Figure 8 The processing device for the anti-ransomware task shown is capable of performing... Figures 4-7 All or part of the operations performed by the ransomware processing device in any of the methods described. It should be understood that the ransomware processing device may include, but is not limited to, the operations performed by the ransomware processing device. Figure 8 The embodiments of this application do not limit the number of additional modules shown or omit some of the modules shown. See also Figure 8 The ransomware processing device includes a first acquisition module 801, a second acquisition module 802, a third acquisition module 803, and an execution module 804. The first acquisition module 801 executes... Figures 1-3 The functions of any of the interaction modules 101, the second acquisition module 802 and the third acquisition module 803 are executed. Figures 1-3 The execution module 804 performs the function of the anti-ransomware task decision module 102 as described above. Figures 1-3 The functions of the anti-ransomware task takeover module 103 described in any of the above. Furthermore, the third acquisition module 803 is also used to perform... Figure 3 The function of the optimization module 105 described herein.

[0135] The first acquisition module 801 is used to acquire input information for the anti-ransomware task of the target device. The input information indicates the user's requirements for the anti-ransomware task.

[0136] The second acquisition module 802 is used to acquire decision support information for the anti-ransomware task. The decision support information includes at least one of the business information corresponding to the target device or the resource information of the target device.

[0137] The third acquisition module 803 is used to acquire the first execution strategy of the anti-ransomware task based on the input information and decision support information;

[0138] Execution module 804 is used to perform anti-ransomware tasks based on the first execution strategy.

[0139] In one possible implementation, the input information indicates a first type of ransomware task; the first execution strategy indicates at least one sub-task included in the first type of ransomware task.

[0140] In one possible implementation, the first type includes at least one of data type identification, ransomware protection configuration, ransomware attack detection, or data recovery after a ransomware attack.

[0141] In one possible implementation, when the first type includes the identification of data types, the first execution strategy instructs the anti-ransomware task to include one or more of the following: marking the identified sensitive or important data, and protecting the identified sensitive or important data according to the protection strategy.

[0142] In the case where the first type includes an anti-ransomware function configuration, the first execution strategy indicates that the anti-ransomware task includes configuring at least one anti-ransomware function, and configuring the anti-ransomware function includes configuring parameters for the anti-ransomware function;

[0143] In the case where the first type includes ransomware attack detection, the first execution strategy instructs the ransomware prevention task to include executing at least one response strategy on data that has been detected as being under a ransomware attack.

[0144] In the case where the first type includes data recovery after a ransomware attack, the first execution strategy instructs the ransomware attack prevention task to include performing at least one recovery strategy on the data that has been subjected to a ransomware attack.

[0145] In one possible implementation, the third acquisition module 803 is used to input the input information and decision support information into the artificial intelligence model, and obtain the first execution strategy based on the data security knowledge base.

[0146] In one possible implementation, the data security knowledge base includes at least one of security knowledge entities identified based on input information, relationships or events between security knowledge entities, or first information;

[0147] The first information includes input information for historical anti-ransomware missions, decision support information for historical anti-ransomware missions, and execution strategies for historical anti-ransomware missions.

[0148] In one possible implementation, the third acquisition module 803 is also used to optimize the data security knowledge base based on user feedback information on the execution results of historical anti-ransomware tasks.

[0149] In one possible implementation, the third acquisition module 803 is used to construct a security event knowledge graph based on the first information and the user's feedback information on the execution result of the anti-ransomware task in the first information; perform knowledge reasoning based on the security event knowledge graph, and update the data security knowledge base according to the result of the knowledge reasoning.

[0150] In one possible implementation, the execution module 804 is configured to orchestrate at least one subtask of the anti-ransomware task indicated by the first execution strategy to obtain an orchestration strategy, the orchestration strategy being used to indicate the execution order of at least one subtask; and to execute at least one subtask according to the orchestration strategy.

[0151] In one possible implementation, the orchestration strategy is derived based on at least one of the priorities among at least one subtask or the resource information of the target device.

[0152] In one possible implementation, the target device includes multiple storage devices, and the orchestration strategy is derived based on the device type of the multiple storage devices and the corresponding service type of the multiple storage devices.

[0153] It should be understood that the above Figure 8 The provided anti-ransomware task processing device is illustrated only by the above-described division of functional modules. In practical applications, the functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the anti-ransomware task processing device and the anti-ransomware task processing method embodiments provided in the above embodiments belong to the same concept. For details on their specific implementation process and beneficial effects, please refer to the method embodiments, which will not be repeated here.

[0154] It should be noted that the anti-ransomware task processing device mentioned in the embodiments of this application can be the target device, or a first part of the component on the target device, such as a chip on the target device, or a functional module on the target device, or an intelligent agent used to implement the method of this application. The embodiments of this application do not make specific limitations.

[0155] This application also provides a computer device, for example... Figure 9 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application. For example... Figure 9 As shown, the computer device 900 includes a processor 901 and a memory 902, and the memory 901 and memory 902 are connected via a bus 903. Figure 9 The processor 901 and memory 902 are described independently. Alternatively, the processor 901 and memory 902 may be integrated together. The computer device 900 may be, for example, a storage device.

[0156] The memory 902 is used to store computer programs, including the operating system and program code. The memory 902 can be various types of storage media, such as read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), flash memory, optical storage, registers, optical disc storage, disk storage, or other magnetic storage devices.

[0157] The processor 901 is either a general-purpose processor or a special-purpose processor. The processor 901 may be a single-core processor or a multi-core processor. The processor 901 includes at least one circuit to perform the functions described in the embodiments of this application. Figure 4 The method for handling ransomware attacks is shown.

[0158] Optionally, the computer device 900 also includes a network interface 904, which is connected to the processor 901 and the memory 902 via a bus 903. The network interface 904 enables the computer device 900 to communicate with other devices.

[0159] Optionally, the computer device 900 also includes an input / output (I / O) interface 905, which is connected to the processor 901 and the memory 902 via a bus 903. The processor 901 can receive input commands or data through the I / O interface 905. The I / O interface 905 is used to connect input devices to the computer device 900, such as a keyboard and mouse. Optionally, in some possible scenarios, the network interface 904 and the I / O interface 905 described above are collectively referred to as a communication interface.

[0160] Optionally, the computer device 900 also includes a display 906, which is connected to the processor 901 and the memory 902 via a bus 903. The display 906 can be used to display intermediate and / or final results generated by the processor 901 executing the above methods, such as displaying alarm prompts. In one possible implementation, the display 906 is a touch screen to provide a human-computer interaction interface.

[0161] Wherein, bus 903 can be any type of communication bus used to interconnect internal devices of computer device 900, such as a system bus. This embodiment of the application illustrates the interconnection of the aforementioned devices within computer device 900 via bus 903 as an example. Optionally, the aforementioned devices within computer device 900 may communicate with each other using connection methods other than bus 903, such as interconnecting through internal logical interfaces of computer device 900.

[0162] The aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether to dispose of the devices independently on different chips or integrate them on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices.

[0163] Figure 9 The computer device 900 shown is merely an example. In the implementation process, the computer device 900 may also include other components, which will not be listed one by one in this article. Figure 9 The computer device 900 shown can perform the anti-ransomware task by executing all or part of the steps of the method provided in the above embodiments.

[0164] This application also provides a computer system. For example, Figure 10 This is a schematic diagram of the structure of a computer system provided in an embodiment of this application. For example... Figure 10 As shown, the computer system 1000 includes: multiple computer devices 1001 and a ransomware task processing device 1002. The ransomware task processing device 1002 is used to coordinate and take over the ransomware functions of the multiple computer devices 1001.

[0165] This application also provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the above-described functionality. Figure 4 The method for handling ransomware attacks is shown.

[0166] This application also provides a computer program (product), including a computer program that, when executed by a processor, implements the above-described functionality. Figure 4The method for handling ransomware attacks is shown.

[0167] This application also provides a chip, including a processor, for calling and executing instructions stored in a memory, causing a communication device with the chip installed to perform the above-described operations. Figure 4 The method for handling the aforementioned anti-ransomware task.

[0168] This application embodiment also provides another chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through internal connection paths. The processor is used to execute code in the memory. When the code is executed, the processor is used to perform the above-described actions. Figure 4 The method for handling ransomware attacks is shown.

[0169] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to this application are generated, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk), etc.

[0170] Those skilled in the art will recognize that the method steps and modules described in conjunction with the embodiments disclosed herein can be implemented in software, hardware, firmware, or any combination thereof. To clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0171] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items with essentially the same function. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor are there any restrictions on quantity or execution order.

[0172] It should also be understood that although the following description uses terms such as first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.

[0173] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0174] In this application, the term "at least one" means one or more, and the term "multiple" means two or more.

[0175] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0176] It should also be understood that the term "comprising" (also referred to as "includes," "including," "comprises," and / or "comprising"), when used in this specification, specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0177] It should also be understood that the phrases "an embodiment" and "a possible implementation" used throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment or implementation is included in at least one embodiment of this application. Therefore, "in an embodiment" or "a possible implementation" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0178] The above description is only an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for handling ransomware prevention tasks, characterized in that, The method includes: Obtain input information for an anti-ransomware task targeting the target device, wherein the input information indicates the user's requirements for the anti-ransomware task; Obtain decision support information for the anti-ransomware task, wherein the decision support information includes at least one of the business information corresponding to the target device or the resource information of the target device; Based on the input information and the decision support information, obtain the first execution strategy for the anti-ransomware task; The anti-ransomware task is executed based on the first execution strategy.

2. The method according to claim 1, characterized in that, The input information indicates a first type of the anti-ransomware task; the first execution strategy indicates at least one sub-task included in the first type of anti-ransomware task.

3. The method according to claim 2, characterized in that, The first type includes at least one of the following: data type identification, ransomware protection configuration, ransomware attack detection, or data recovery after a ransomware attack.

4. The method according to claim 3, characterized in that, When the first type includes the identification of the data type, the first execution strategy instructs the anti-ransomware task to include one or more of the following: marking the identified sensitive or important data, and protecting the identified sensitive or important data according to the protection strategy. When the first type includes the anti-ransomware configuration, the first execution policy indicates that the anti-ransomware task includes configuring at least one anti-ransomware function, and configuring the anti-ransomware function includes configuring parameters for the anti-ransomware function; In the case where the first type includes the ransomware attack detection, the first execution policy instructs the anti-ransomware task to include executing at least one response policy on data that has been detected as being under a ransomware attack. In the case where the first type includes data recovery after the ransomware attack, the first execution policy instructs the ransomware attack prevention task to include performing at least one recovery strategy on the data that has been subjected to the ransomware attack.

5. The method according to any one of claims 1-4, characterized in that, The step of obtaining the first execution strategy for the anti-ransomware task based on the input information and the decision support information includes: The input information and the decision support information are input into the artificial intelligence model, and the first execution strategy is obtained based on the data security knowledge base.

6. The method according to claim 5, characterized in that, The data security knowledge base includes at least one of the following: security knowledge entities identified based on the input information, relationships or events between the security knowledge entities, or first information; The first information includes input information for historical anti-ransomware tasks, decision support information for historical anti-ransomware tasks, and execution strategies for historical anti-ransomware tasks.

7. The method according to claim 6, characterized in that, The method further includes optimizing the data security knowledge base based on user feedback on the execution results of the historical anti-ransomware tasks.

8. The method according to claim 7, characterized in that, The optimization of the data security knowledge base based on user feedback on the execution results of the historical ransomware prevention tasks includes: Based on the first information and the user's feedback on the execution results of the anti-ransomware task in the first information, a security event knowledge graph is constructed. Knowledge reasoning is performed based on the security event knowledge graph, and the data security knowledge base is updated based on the results of the knowledge reasoning.

9. The method according to any one of claims 2-8, characterized in that, The execution of the anti-ransomware task based on the first execution strategy includes: Orchestrate at least one subtask of the anti-ransomware task indicated by the first execution strategy to obtain an orchestration strategy, the orchestration strategy being used to indicate the execution order of the at least one subtask; The at least one subtask is executed according to the orchestration strategy.

10. The method according to claim 9, characterized in that, The orchestration strategy is derived based on at least one of the priorities among the at least one subtask or the resource information of the target device.

11. The method according to claim 9 or 10, characterized in that, The target device includes multiple storage devices, and the orchestration strategy is obtained based on the device type of the multiple storage devices and the corresponding service type of the multiple storage devices.

12. A processing device for an anti-extortion task, characterized in that, The device includes: The first acquisition module is used to acquire input information for the anti-ransomware task targeting the target device, wherein the input information indicates the user's requirements for the anti-ransomware task; The second acquisition module is used to acquire decision support information for the anti-ransomware task, wherein the decision support information includes at least one of the business information corresponding to the target device or the resource information of the target device; The third acquisition module is used to acquire the first execution strategy of the anti-ransomware task based on the input information and the decision support information; An execution module is used to execute the anti-ransomware task based on the first execution strategy.

13. The apparatus according to claim 12, characterized in that, The input information indicates a first type of the anti-ransomware task; the first execution strategy indicates at least one sub-task included in the first type of anti-ransomware task.

14. The apparatus according to claim 13, characterized in that, The first type includes at least one of the following: data type identification, ransomware protection configuration, ransomware attack detection, or data recovery after a ransomware attack.

15. The apparatus according to claim 14, characterized in that, When the first type includes the identification of the data type, the first execution strategy instructs the anti-ransomware task to include one or more of the following: marking the identified sensitive or important data, and protecting the identified sensitive or important data according to the protection strategy. When the first type includes the anti-ransomware configuration, the first execution policy indicates that the anti-ransomware task includes configuring at least one anti-ransomware function, and configuring the anti-ransomware function includes configuring parameters for the anti-ransomware function; In the case where the first type includes the ransomware attack detection, the first execution policy instructs the anti-ransomware task to include executing at least one response policy on data that has been detected as being under a ransomware attack. In the case where the first type includes data recovery after the ransomware attack, the first execution policy instructs the ransomware attack prevention task to include performing at least one recovery strategy on the data that has been subjected to the ransomware attack.

16. The apparatus according to any one of claims 12-15, characterized in that, The third acquisition module is used to input the input information and the decision support information into the artificial intelligence model, and obtain the first execution strategy based on the data security knowledge base.

17. The apparatus according to claim 16, characterized in that, The data security knowledge base includes at least one of the following: security knowledge entities identified based on the input information, relationships or events between the security knowledge entities, or first information; The first information includes input information for historical anti-ransomware tasks, decision support information for historical anti-ransomware tasks, and execution strategies for historical anti-ransomware tasks.

18. The apparatus according to claim 17, characterized in that, The third acquisition module is also used to optimize the data security knowledge base based on user feedback information on the execution results of the historical anti-ransomware tasks.

19. The apparatus according to claim 18, characterized in that, The third acquisition module is used to construct a security event knowledge graph based on the first information and the user's feedback information on the execution result of the anti-ransomware task in the first information. Knowledge reasoning is performed based on the security event knowledge graph, and the data security knowledge base is updated based on the results of the knowledge reasoning.

20. The apparatus according to any one of claims 13-19, characterized in that, The execution module is configured to orchestrate at least one subtask of the anti-ransomware task indicated by the first execution strategy to obtain an orchestration strategy, wherein the orchestration strategy is used to indicate the execution order of the at least one subtask. The at least one subtask is executed according to the orchestration strategy.

21. The apparatus according to claim 20, characterized in that, The orchestration strategy is derived based on at least one of the priorities among the at least one subtask or the resource information of the target device.

22. The apparatus according to claim 20 or 21, characterized in that, The target device includes multiple storage devices, and the orchestration strategy is obtained based on the device type of the multiple storage devices and the corresponding service type of the multiple storage devices.

23. A computer device, characterized in that, The computer device includes: a processor coupled to a memory; The memory is used to store at least one program instruction; The processor is configured to load and execute the at least one program instruction to cause the computer device to implement the method of any one of claims 1-11.

24. A computer-readable storage medium, characterized in that, The computer storage medium stores at least one instruction, which is loaded and executed by a processor to enable the computer to perform the method as described in any one of claims 1-11.

25. A computer program product, characterized in that, The computer program product includes: computer program code, which is loaded and executed by a computer to enable the computer to implement the method described in any one of claims 1-11.

26. A computer system, characterized in that, The computer system includes multiple computer devices and a processing device for anti-ransomware tasks as described in any one of claims 12-22, wherein the processing device for anti-ransomware tasks is used to coordinate and take over the anti-ransomware functions of the multiple computer devices.

Images