Ransomware detection device and detection method, and detection system

Abstract

To provide a technique capable of detecting ransomware with high accuracy while suppressing false detection.SOLUTION: In a detection method for a ransomware detection device that performs unauthorized modification of data in a storage medium of a target computer and prevents access thereto, file name acquisition means includes a file name acquisition step of acquiring file names of data stored in a storage medium of a computer. The ransomware detection device includes a whitelist database that stores a set of proper character strings included in a known state where the data has not been modified by ransomware, for predetermined portions of file names. File name checking means includes a file name checking step of comparing the file names acquired in the file name acquisition step with the whitelist database to check whether proper character strings are included. Notification means includes a notification step of generating a notification when proper character strings are not included.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a detection device, a detection method, and a detection system for ransomware, which makes unauthorized changes to data on the storage media of a targeted computer, making it impossible to access. [Background technology]

[0002] Ransomware is a type of malware that spreads infection through networks and other means. Once infected, it encrypts stored files so they cannot be restored, and causes unauthorized behavior such as rendering the device unable to boot or operate. As the name ransom suggests, a typical example is to take server equipment or computer devices hostage and demand virtual currency or other payment.

[0003] Well-known ransomware include Cryptolocker, which became a global epidemic in 2013; Cryptowall, which was confirmed to be active in 2014 and caused problems such as intrusions into corporate terminals; TeslaCrypt, also known as the "vvv virus" because the extension used when encrypting is ".vvv"; Locky, which is known for sending large amounts of spam emails and targeting Japan; and WannaCry, a ransomware that caused widespread damage worldwide in 2017, which spread its influence by self-replicating and infecting those around it.

[0004] Ransomware often encrypts files and changes their extensions. Cryptowall rewrites files to ".cryptwall," ".vault," or ".exx," while Locky rewrites files to ".locky," "zepto," or "odin," and WannaCry rewrites files to ".wnry," ".wcry," or ".wncry." Based on this phenomenon, technologies have been proposed to detect ransomware infections by detecting file extension rewrites.

[0005] Patent Document 1 describes that in order to detect ransomware, file information including known file extensions is stored as a signature table, and if the file extension differs from the extension included in the signature table, the file is identified, and then if the condition that the header of the identified file has been changed is met, the computer is determined to be infected with ransomware.

[0006] Patent document 2 describes how, in detecting malware such as ransomware, suspicious entries in a change set are identified by comparing the entries in the change set with the naming conventions (e.g., file names, file extensions, etc.) of known malware (ransomware).

[0007] Patent document 3 discloses identifying malicious code running in the memory of a computer that overwrites files stored in a computer storage device by encrypting the contents of the files with ransomware, and discloses that analysis can be performed by detecting attempts to rename files and / or change the file extensions (or execution of instructions to rename and / or change the extensions). [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Japanese Patent Application Publication No. 2019-095882 [Patent Document 2] Special Publication No. 2020-501209 [Patent Document 3] Special Publication No. 2020-502648 Summary of the Invention [Problem to be solved by the invention]

[0009] As mentioned above, technology for detecting ransomware based on file extension changes is well known, but extensions are defined in various ways depending on the applications running on the system, and there is a problem that if a detection process is performed every time an unknown extension is found, there will be too many false positives.

[0010] The present invention was created in consideration of the problems with the above-mentioned conventional technology, and aims to provide a technology that detects ransomware with high accuracy while suppressing false positives. [Means for solving the problem]

[0011] In order to solve the above problems, the present invention provides the following ransomware detection device. That is, according to a first embodiment of the present invention, there is provided a ransomware detection device that makes unauthorized changes to data on the storage medium of a targeted computer, making it impossible to access, characterized in that it comprises a file name acquisition means for acquiring the file name of data stored on the computer's storage medium, a whitelist database that stores a set of valid character strings that are contained in a specified part of the file name when the data is in a known state where it has not been changed by ransomware, a file name check means that compares the file name acquired by the file name acquisition means with the whitelist database to check whether the valid character string is contained, and a notification means that issues a notification when the valid character string is not contained.

[0012] According to a second embodiment of the present invention, the ransomware detection device may be configured to include a blacklist database that stores a set of malicious character strings that are contained in a specified portion of a file name when the data is in a known state where it has been modified by ransomware, a file name checking means that compares the file name acquired by the file name acquisition means with the blacklist database to check whether the file name contains an malicious character string, and a notification means that issues a notification when the malicious character string is contained.

[0013] According to a third embodiment of the present invention, the predetermined portion may be an extension indicating the type of file name.

[0014] According to a fourth embodiment of the present invention, the file name checking means may be configured to issue a notification only if the file name does not contain the appropriate character string a predetermined number of times or more consecutively when the file name checking means compares the file name with the whitelist database to check whether the appropriate character string is included.

[0015] According to a fifth embodiment of the present invention, in a ransomware detection device, a file name acquisition means acquires a file name consisting of an extension and its remaining portion at a predetermined timing and stores it in chronological order in a storage means, and when a file name check means discovers a file name that does not contain a valid character string, if a file name that has the same remaining portion as the file name and contains a valid character string has been stored in the past, a notification means may be configured to issue a notification.

[0016] According to a sixth embodiment of the present invention, the file name checking means may be configured to issue a notification only if the file name does not contain a valid character string two or more times in succession when the file name checking means compares the file name with a whitelist database to check whether the valid character string is included.

[0017] According to a seventh embodiment of the present invention, in a ransomware detection device, a predetermined timing may be configured to detect a request to a file system at the kernel level of an operating system, and a file name checking means may perform a check at the time of the request.

[0018] According to the eighth embodiment of the present invention, the following ransomware detection method can be provided. That is, the method for detecting ransomware in a detection device makes unauthorized changes to data on the storage medium of a targeted computer, making it impossible to access, is characterized by comprising: a file name acquisition step in which a file name acquisition means acquires the file name of data stored on the storage medium of the computer; a file name check step in which a file name check means compares the file name acquired in the file name acquisition step with the whitelist database to check whether the file name contains a valid character string; and a notification step in which a notification means issues a notification when the valid character string is not included.

[0019] According to a ninth embodiment of the present invention, the ransomware detection device may further include a blacklist database in advance that stores a set of malicious character strings that are contained in a predetermined part of a file name when the data is in a known state where it has been modified by ransomware, and in the file name check step, the file name check means compares the file name acquired by the file name acquisition means with the blacklist database to check whether an malicious character string is contained, and in the notification step, the notification means may issue a notification when an malicious character string is contained.

[0020] According to a tenth embodiment of the present invention, the predetermined portion may be an extension indicating the type of file name.

[0021] According to an eleventh embodiment of the present invention, in the file name check step, the file name check means may be configured to issue a notification only if the file name does not contain the appropriate character string a predetermined number of times or more in succession when the file name check means compares the file name with the whitelist database to check whether the appropriate character string is included.

[0022] According to a twelfth embodiment of the present invention, in the file name acquisition step, the file name acquisition means acquires a file name consisting of an extension and its remaining portion at a predetermined timing and stores it in chronological order in the storage means, and in the file name check step, when the file name check means discovers a file name that does not contain a proper character string, if a file name that has the same remaining portion as the file name and contains a proper character string has been stored in the past, the notification means may issue a notification in the notification step.

[0023] According to a thirteenth embodiment of the present invention, in the file name check step, the file name check means compares the file name with a whitelist database to check whether it contains a valid character string, and only if the valid character string is not included two or more times in succession, the notification means may be configured to issue a notification in the notification step.

[0024] According to a fourteenth embodiment of the present invention, in the file name checking step, the predetermined timing may be configured to detect a request to a file system at the kernel level of the operating system, and the file name checking means may perform a check at the time of the request.

[0025] Furthermore, according to a fifteenth embodiment of the present invention, it is possible to provide a ransomware detection system comprising the above-mentioned detection device and a computer connected via a communication network. [Effects of the Invention]

[0026] By adopting the above-described configuration, the present invention can provide a ransomware detection device, a ransomware detection method, and a system therefor that can detect ransomware with high accuracy while suppressing false detections. [Brief explanation of the drawings]

[0027] [Figure 1] FIG. 1 is a block diagram of a ransomware detection device according to the present invention. [Figure 2] 1 is a flowchart of a ransomware detection method according to the present invention. [Figure 3] 1 is a flowchart showing a specific detection method according to a first embodiment. [Figure 4] 10 is a flowchart showing a specific detection method according to a second embodiment. [Figure 5] 10 is a flowchart showing a specific detection method according to a third embodiment. [Figure 6] 1 is an overall view of a ransomware detection system according to the present invention. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0028] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the accompanying drawings. The present invention is not limited to the following examples, but can be practiced within the scope of the claims. Figure 1 is a block diagram of a ransomware detection device (hereinafter referred to as the detection device) according to the present invention. The detection device (1) detects ransomware that makes unauthorized changes to data on the storage media of a targeted computer, making it inaccessible, and is implemented in a known personal computer or server device.

[0029] The CPU (10) includes a file name acquisition unit (100), a file name check processing unit (101), and a notification unit (102). The CPU (10) is connected to a communication unit (11) that communicates with an external network and a storage unit (12) that is configured from an external storage device or the like. The specific hardware is well known and therefore will not be described here.

[0030] FIG. 2 is a flowchart of the ransomware detection method of the present invention. The file name acquisition unit (100) performs a process of acquiring the file name of data stored in a storage medium such as the storage unit (12). (S1: File name acquisition process)

[0031] The file name check processing unit (101) checks a specific part of a file name, such as the extension, against a white list database (120) and a black list database (121) stored in the storage unit (12) to check the character string (S2: File name check processing).

[0032] Then, if a predetermined condition is met based on the collation result, the notification unit (102) issues a notification (S3: Notification process).

[0033] The whitelist database stores a set of legal strings that are included when data is in a known state that has not been altered by ransomware. For example, extensions such as ".doc" and ".pdf" are stored in the whitelist database as legal strings. If the file name acquired by the file name acquisition unit (100) is aaa.doc, it is determined to be normal since the whitelist contains ".doc".

[0034] On the other hand, if the extension is not stored in the whitelist database, it can be determined that the above is the case and notified. The notification can be made in any manner, such as by displaying a screen to the user or administrator of the personal computer or server device, by notifying another terminal via an external network from the communication unit (11), or by outputting a log of the detected abnormality to a storage medium.

[0035] In the embodiment, the "predetermined portion of the file name" according to the present invention is the extension, but the present invention is not limited to this. For example, if XX is added to the beginning of a file name "aaaaaa.doc" to make it "XXaaaaaa.doc," this beginning portion can be processed as the predetermined portion. In this way, any ransomware that changes a portion of a file name with a certain regularity can be included in the present invention.

[0036] By providing a whitelist database and using a method of determining that a file has a known extension, it is possible to reduce false positives compared to the prior art, which detects that an extension has been changed. However, if all unknown files are determined to be abnormal by comparing them with the whitelist, there will still be many false positives, so the present invention can further perform the following determination process.

[0037] FIG. 3 is a flowchart showing a first embodiment of the detection method of the present invention. As in the above, the file name acquisition process (S1) is performed, and the following processes (S20) to (S23) are performed as the file name check process (S2). First, in the extension separation process (S20), the acquired file name is separated into the extension and the remaining part. Then, the extension is checked (S21) to see if it is stored in the whitelist database (120), and if it is a valid character string registered in the whitelist, it is determined to be normal (S24).

[0038] On the other hand, if the file is not on the whitelist, the blacklist database (121) in the storage unit (12) is referenced to check whether the extension is registered on the blacklist as an illegal character string (S22). For example, if the file name is "aaa.locky," the extension ".locky," which is modified by locky, a known ransomware, is registered on the blacklist, so it is determined to be abnormal (S25) and a notification is sent.

[0039] If the file is not registered on the blacklist, the notification unit (102) inquires the user about whether or not to register the file on the whitelist (S23). That is, the user can check the file extension and determine for themselves whether it is harmless and whether it is an extension that can be registered on the whitelist. If the user inputs that they want to register, they are registered in the whitelist database (120). If no registration is made, it may be determined that there is an abnormality (S27), or the process may end with an inquiry.

[0040] The order of the whitelist checking process (S21) and the blacklist checking process (S22) may be reversed. Also, the inquiry as to whether or not to register on the whitelist may not be performed.

[0041] FIG. 4 is a flowchart showing a second embodiment of the detection method according to the present invention. In the second embodiment, even if the result of the whitelist matching process (S21) shows that the extension is not registered in the whitelist, it is not immediately judged to be abnormal, but is only judged to be abnormal if it is detected consecutively a predetermined number of times or more.

[0042] Specifically, if the whitelist matching process (S21) does not find a registration in the whitelist database (120), the system searches to see if the result of the previous whitelist matching process (S21) was "Yes" (normal) or "No" (candidate for abnormality). Therefore, if the collation result is normal or there is no record, the result of "first unknown" is stored as the first time that an unknown extension has been detected (S31).

[0043] In other words, the first time an unknown extension is detected, no notification is made. Because various extensions are assigned depending on the application, if a notification is made when only one unknown extension is found, there is a risk of excessive false positives. Therefore, it is preferable to make an abnormality determination (S32) only when, for example, an unknown extension is detected twice in a row. The number of consecutive detections required to determine an abnormality is arbitrary, and may be, for example, three or four times.

[0044] Here, it is also possible to arbitrarily select whether to determine an abnormality (S32) when the same unknown extension appears consecutively in the previous comparison result, or whether to determine an abnormality (S32) when different unknown extensions appear consecutively. For example, in the former case, when an unknown extension "lekey" is detected for the first time from the file name "aaa.lecky", the result is stored as "lecky 1st time" (S31), and when "lekey" is next extracted from the file name "bbb.lecky", an abnormality is determined as the second time the same unknown extension "lecky" has been detected. Typically, when a ransomware infection occurs, multiple files are modified to have the same extension, so a method of determining whether a file has been infected when a certain number of times has occurred is effective.

[0045] On the other hand, as an example of the latter, when an unknown extension "lekey" is detected the first time from the file name "aaa.lecky", the result is stored as "unknown 1" (S31), and then even if "lakey" is extracted from the file name "bbb.lacky", it is determined to be an abnormality as "unknown 2". This method can also handle cases where ransomware modifies files to different extensions, so it is effective depending on the behavior of the ransomware being detected.

[0046] When file name acquisition (scanning) is performed periodically, if unknown extensions are found consecutively during one execution, for example, if five or more are found consecutively, an abnormality may be determined.

[0047] The condition for making the abnormality determination (S32) may be a more complicated conditional expression. For example, when a file name is acquired, the occurrence rate of unknown extensions that are not stored in the whitelist may be measured, and if unknown extensions occur at a rate above a predetermined threshold, for example, 30%, it may be determined to be abnormal. Furthermore, the time information checked may be added to the result memory (S31) to make a judgment based on the number of times or the ratio of detections within a predetermined time. Because ransomware modifications are often made in a concentrated manner, for example, an abnormality may be judged if an unknown extension is detected two or more times within five minutes.

[0048] FIG. 5 is a flowchart showing a third embodiment of the detection method according to the present invention. In the third embodiment, in the file name acquisition process (S1), a file name consisting of an extension and its remaining portion is acquired at a predetermined timing and stored in a memory unit (12) in chronological order, and in the file name check process (S2), when a file name that does not contain a proper character string is found, if a file name that has the same remaining portion as the file name and also contains the proper character string has been stored in the past, it is determined to be abnormal.

[0049] Specifically, the file name "aa.doc" is acquired (S10) and stored in the storage unit 12. Even if the file name has an extension stored in the whitelist, the file name is repeatedly stored each time. Next, when a file name "aa.xxx" with an unknown extension is acquired (S12), if the whitelist matching process (S21) detects that the extension is unknown, the memory unit (12) is referenced to search for a file name with a matching "aa" part in the past (S40).

[0050] Since "aa.doc" is stored, when "aa" is found, the extension ".doc" is subsequently searched to see if it is a valid character string stored in the whitelist (S41). If ".doc" is stored in the whitelist, there is a high probability that "aa.xxx" has been modified by ransomware, so an abnormality determination is made (S43).

[0051] On the other hand, if the extension is not stored in the whitelist, it is treated as an unknown extension, and the notification unit (102) inquires of the user whether or not to register it on the whitelist (S42). In this case, the processing is the same as above.

[0052] In the present invention, the file name check process may be performed at any timing. For example, the changed file names may be obtained and checked by screening the storage medium such as a hard disk at predetermined intervals. It is more preferable that a request to a file system is detected at the kernel level of the operating system, and the file name check processing unit (101) performs a check at the time of the request.

[0053] FIG. 6 is an overall diagram of a ransomware detection system according to the present invention. In the detection device (1) of the above embodiment, a configuration was shown in which the file names in the storage unit (12) of the device itself were checked, but in another embodiment, it is possible to detect ransomware in a user terminal (4) that has been attacked by an attacker terminal (5). The detection device (1') of this embodiment can check the file names in the storage media of one or more user terminals (4) via the Internet (2).

[0054] When a change in a file name is detected in the operating system of the user terminal (4), the file name is sent to the detection device (1') and ransomware can be detected by referring to the whitelist database (120) and blacklist database (121). In this case, the notification unit (102) notifies the user terminal (4) via the Internet (2).

[0055] In this embodiment, the whitelist database (120) and blacklist database (121) can be shared across the entire system, allowing for rapid registration of malicious character strings and enhancing the whitelist without requiring each user to register them individually, which is expected to improve detection accuracy and reduce false positives.

[0056] The whitelist database (120) and the blacklist database (121) may be stored in an external database server (3) connected to the Internet (2). The detection device (1) of the above embodiment may refer to the database server (3) for the whitelist database, or may be used in combination with the detection device (1') of another embodiment.

[0057] By separating the database server (3), for example, a company that provides a malware detection method as software can provide the latest whitelist database (120) and blacklist database (121), and a system can be realized in which the file name check processing unit (101) of the user terminal (4) can refer to them. [Explanation of symbols]

[0058] 1. Detection device 2. Internet 3 Database Server 4. User terminal 5. Attacker's terminal 10 CPU 11 Communications Department 12 Storage section 100 File name acquisition section 101 File name check processing section 102 Notification Department 120 Whitelist Database 121 Blacklist Database

Claims

1. A ransomware detection device that makes unauthorized changes to data on a storage medium of a targeted computer, making it impossible to access, a file name acquisition means for acquiring a file name of the data stored in the storage medium of the computer; A whitelist database that stores a set of valid character strings that are included in a predetermined portion of a file name when the data is in a known state that has not been modified by ransomware; a file name check means for checking whether the file name acquired by the file name acquisition means includes the appropriate character string by comparing the file name with the whitelist database; notification means for issuing a notification when the appropriate character string is not included; A ransomware detection device comprising:

2. In the ransomware detection device, A blacklist database is provided which stores a set of invalid character strings that are included in a predetermined part of a file name when the data is in a known state where it has been modified by ransomware; the file name check means compares the file name acquired by the file name acquisition means with the blacklist database to check whether the invalid character string is included; The notification means issues a notification when the invalid character string is included. The ransomware detection device according to claim 1 .

3. The predetermined part is an extension indicating the type of file name. The ransomware detection device according to claim 2.

4. The file name checking means When the file name is compared with the whitelist database to check whether the appropriate character string is included, The notification means issues a notification only if the pattern is not included consecutively a predetermined number of times or more. The ransomware detection device according to claim 3.

5. In the ransomware detection device, the file name acquisition means acquires the file name consisting of the extension and the remaining portion at a predetermined timing and stores it in chronological order in the storage means; When the file name check means finds a file name that does not contain the proper character string, if a file name that has the same remainder as the file name and that contains the proper character string has been stored in the past, the notification means issues a notification. The ransomware detection device according to claim 3.

6. The file name checking means When the file name is compared with the whitelist database to check whether the appropriate character string is included, The notification means issues a notification only if the item is not included two or more times in succession. The ransomware detection device according to claim 5.

7. In the ransomware detection device, The predetermined timing is to detect a request to a file system at the kernel level of an operating system, and the file name check means checks the file name at the time of the request. The ransomware detection device according to claim 5.

8. A method for detecting ransomware in a detection device that makes unauthorized changes to data on a storage medium of a targeted computer, making it impossible to access the data, comprising: a file name acquisition step in which a file name acquisition means acquires a file name of the data stored in the storage medium of the computer; A whitelist database is provided in advance, which stores a set of appropriate character strings that are included in a predetermined portion of a file name when the data is in a known state and has not been modified by ransomware, a file name check step in which a file name check means compares the file name acquired in the file name acquisition step with the whitelist database to check whether the appropriate character string is included; a notification step in which a notification means issues a notification when the proper character string is not included; A ransomware detection method comprising:

9. The ransomware detection device further includes a blacklist database in advance that stores a set of fraudulent character strings that are included when the data is in a known state of having been modified by ransomware, with respect to a predetermined portion of a file name; In the file name checking step, the file name checking means compares the file name acquired by the file name acquisition means with the blacklist database to check whether the invalid character string is included; In the notification step, the notification means issues a notification when the invalid character string is included. The ransomware detection method according to claim 8.

10. The predetermined part is an extension indicating the type of file name. The ransomware detection method according to claim 9.

11. In the file name checking step, the file name checking means When the file name is compared with the whitelist database to check whether the appropriate character string is included, The notification means issues a notification only if the pattern is not included consecutively a predetermined number of times or more. The method for detecting ransomware according to claim 10.

12. In the file name acquisition step, the file name acquisition means acquires a file name consisting of the extension and the remaining portion at a predetermined timing and stores the file name in chronological order in a storage means; In the file name check step, when the file name check means finds a file name that does not contain the proper character string, if a file name that has the same remainder as the file name and that contains the proper character string has been stored in the past, In the notification step, the notification means generates a notification. The method for detecting ransomware according to claim 10.

13. In the file name checking step, when the file name checking means checks whether the file name includes the appropriate character string by comparing the file name with the whitelist database, Only if it is not included more than twice in a row In the notification step, the notification means generates a notification. The method for detecting ransomware according to claim 12.

14. In the file name checking step, The predetermined timing is to detect a request to a file system at the kernel level of an operating system, and the file name check means checks the file name at the time of the request. The method for detecting ransomware according to claim 12.

15. A ransomware detection system comprising the detection device according to claim 3 and the computer connected via a communication network.

Images