Ransomware detection method and detection system

Abstract

This disclosure relates to a ransomware detection method and a detection system. The ransomware detection method is applied to at least one detection system having a semantic extraction module composed of a plurality of semantic extractors, and includes receiving a first file having a first ID, importing the first file into the semantic extraction module and outputting a first semantic feature of the first file by the semantic extraction module, receiving a second file having a second ID, importing the second file into the semantic extraction module and outputting a second semantic feature of the second file by the semantic extraction module, calculating the distance between the first semantic feature and the second semantic feature if it is determined that the first ID and the second ID match, and issuing an alarm if the distance exceeds a threshold.

Description

Technical Field

[0001] The present invention relates to a detection method and a detection system, and particularly to a detection method and a detection system for ransomware.

Background Art

[0002] In recent years, the threat of ransomware has been rapidly increasing in each industrial field. Although there are many cyber security tools and services currently available on the market, the threat of ransomware shows no sign of decreasing. Among them, small and medium-sized enterprises (SMEs) are particularly likely to be the main targets of cyber criminals who use ransomware due to their flat network structure and simple access control policies.

[0003] Generally, small and medium-sized enterprises lack the resources to implement the complex and expensive cyber security solutions used by large enterprises. And in order to protect their own systems, they strongly require simple and affordable means. From this perspective, small and medium-sized enterprises often adopt backup as the ultimate solution. Compared with other more complex and expensive security measures (including advanced firewalls, next-generation antivirus, intrusion detection system, and application whitelisting, etc.), the backup solution is relatively simple and inexpensive, and is a data protection means with direct and high economic effects.

[0004] However, traditional backup solutions cannot determine whether a file has been corrupted by malware when backing it up. Specifically, traditional backup solutions cannot distinguish between uncorrupted files (also called clean files) and corrupted files (also called unclean files). As a result, corrupted files are backed up unintentionally, and backup snapshots end up containing a mix of clean and corrupted files. If there is a limit to the number of backup snapshots, traditional backup solutions typically delete the oldest version (which may be clean) of a file in order to accept a newer version (which may be unclean). This behavior can lead to a situation where a valid backup snapshot is not available when the file eventually needs to be restored.

[0005] Furthermore, even if a backup solution can retain an unlimited number of backup snapshots, when an attack occurs and files need to be restored, the file owner must manually distinguish between clean and unclean files from a large number of backup files. This step alone makes the restoration process a difficult, time-consuming, and painful task.

[0006] Therefore, conventional backup solutions cannot effectively defend against ransomware attacks unless they are used in conjunction with effective ransomware detection methods. [Overview of the project]

[0007] The main objective of the present invention is to provide a ransomware detection method and detection system, which can determine whether a file has been attacked with ransomware, primarily based on whether or not there is a significant change in at least one semantic feature of the file.

[0008] The above semantic features can be used to identify differences in the file contents between one file and another. Several examples of features that can be used as the above semantic features are provided in the following description. These examples are disclosed solely for the purpose of illustrating the scope and do not limit the invention in any way.

[0009] To achieve the above objective, the ransomware detection method of the present invention mainly includes: step a receiving a first file having a first ID; step b importing the first file into a semantic extraction module composed of a plurality of semantic extractors and outputting a first semantic feature of the first file using the semantic extraction module; step c receiving a second file having a second ID; step d importing the second file into the semantic extraction module and outputting a second semantic feature of the second file using the semantic extraction module; step e determining whether the first ID and the second ID match; step f determining that the first file and the second file are different versions of the same file if the first ID and the second ID match, and calculating the distance between the first semantic feature and the second semantic feature; and step g issuing an alarm if the distance exceeds a threshold.

[0010] To achieve the above objective, the ransomware detection system of the present invention includes: a file import module configured to receive a first file having a first ID and a second file having a second ID; a semantic extraction module connected to the file import module and composed of a plurality of semantic extractors, configured to extract a first semantic feature of the first file and a second semantic feature of the second file; a comparison module connected to the semantic extraction module and configured to determine whether the first ID and the second ID match, and if the first ID and the second ID match, to determine that the first file and the second file are different versions of the same file, and to calculate the distance between the first semantic feature and the second semantic feature; and an alarm module connected to the comparison module and configured to issue an alarm when the comparison module determines that the distance exceeds a threshold.

[0011] This invention detects whether ransomware has infiltrated a file by detecting semantic features in previous and subsequent versions of a file and determining whether the file is a clean file (not corrupted) or an unclean file (corrupted) due to a malware attack (such as ransomware). Compared to related technologies, this invention allows the nature (or state) of each backup file in a backup solution to be labeled as clean or unclean, so that the backup solution always retains at least one clean version of the backup file, which can be used when performing the necessary restoration process, and as a result, can effectively defend against ransomware attacks. [Brief explanation of the drawing]

[0012] [Figure 1] This is a schematic diagram of a detection system according to one embodiment of the present invention. [Figure 2] This is a flowchart of a detection method according to one embodiment of the present invention. [Figure 3]This is a flowchart for extracting the semantic features of one embodiment of the present invention. [Figure 4] This is a flowchart for extracting semantic features of other embodiments of the present invention. [Figure 5] This is a schematic diagram illustrating the generation of semantic features in one embodiment of the present invention. [Figure 6] This is a schematic diagram comparing the semantic features of one embodiment of the present invention. [Figure 7] This is a flowchart of a backup according to one embodiment of the present invention. [Modes for carrying out the invention]

[0013] Preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0014] Generally, the technical methods used to detect ransomware can be broadly classified into the following types: (1) methods that monitor abnormal file operations, (2) methods that monitor the entropy of abnormal files, (3) methods that observe file metadata, and (4) combinations of the above methods. However, method (1) cannot detect the attack method in which ransomware slowly infiltrates files. Method (2) is implemented based on file content, but false alarms are likely to occur because some file types inherently have high entropy. Method (3) cannot detect traces of ransomware attacks if the ransomware does not modify or destroy the file metadata.

[0015] The present invention provides a novel method and system for detecting ransomware, including types of ransomware that were difficult or impossible to deal with using conventional solutions. The technical method of the present invention can effectively determine whether a file is a clean file or has been destroyed by ransomware (i.e., an unclean file). This significantly improves the ability of backup solutions or backup systems to retain a clean version of each backup file, thereby reducing the likelihood of being required to pay a ransom after a ransomware attack.

[0016] Statistical results indicate that almost all types of ransomware aim to demand a ransom from victims and restore their files by causing significant semantic changes to the contents of the affected files. As a countermeasure, the method and system according to the present invention compare the semantic changes in the contents of preceding and succeeding versions of a file. This technique can effectively identify the presence of ransomware, regardless of whether or not the ransomware has the potential to evolve.

[0017] First, referring to Figure 1, this is a schematic diagram of a detection system according to one embodiment of the present invention. As shown in Figure 1, the detection system 1 of the present invention mainly includes a file import module 11, a semantic extraction module 12, a comparison module 13, and an alarm module 14. The semantic extraction module 12 is connected to the file import module 11, the comparison module 13 is connected to the semantic extraction module 12, and the alarm module 14 is connected to the comparison module 13.

[0018] In one embodiment, the detection system 1 is implemented as software or firmware and runs on independent hardware. For example, a computing device or server in a computer environment equipped with a processor can run the detection system 1 of the present invention. This allows the computing device to detect whether the files it provides or executes are under ransomware attack, and the server to detect whether the files it backs up are under ransomware attack. In this embodiment, the file import module 11, the semantic extraction module 12, the comparison module 13, and the alarm module 14 are all software modules implemented by software code.

[0019] In one embodiment, the detection system 1 receives a first file 2 via a file import module 11, and the first file 2 has an identifiable first ID. After receiving the first file 2, the detection system 1 analyzes the first file 2 using a semantic extraction module 12 and extracts a first semantic feature of the first file 2.

[0020] In one embodiment, the semantic extraction module 12 is composed of multiple semantic extractors 121. When the semantic extraction module 12 receives a first file 2 from the file import module 11, it inputs the first file 2 into the multiple semantic extractors 121 for analysis, and each of the multiple semantic extractors 121 outputs one analysis result. Finally, the semantic extraction module 12 combines the multiple results from the multiple semantic extractors 121 to obtain a first semantic feature of the first file 2.

[0021] In the present invention, each semantic extractor 121 can be implemented based on various different types of extractors, and these semantic extractors 121 can analyze various files such as text, images, audio, or video (but not limited to these) and extract at least one semantic feature from the file contents (as described later).

[0022] In one embodiment, the detection system 1 further receives a second file 3 having a second ID that can be identified by the file import module 11, analyzes the second file 3 by the semantic extraction module 12, and extracts the second semantic features of the second file 3.

[0023] When the second file 3 and the first file 2 are the previous and subsequent versions of the same file, the detection system 1 of the present invention can determine whether the subsequent version (for example, the second file 3) is damaged by ransomware by comparing the differences in the semantic features between the second file 3 and the first file 2. And before performing the comparison, the detection system 1 first checks whether the second file 3 and the first file 2 are the previous and subsequent versions of the same file.

[0024] In one embodiment, the comparison module 13 first determines whether the first ID of the first file 2 and the second ID of the second file 3 match. When the first ID and the second ID match, the first file 2 and the second file 3 are recognized as the previous and subsequent versions of the same file. Note that since ransomware may or may not change the file name, in the present invention, the above match includes being the same, approximate, conforming to a specific rule, or being different but the difference is less than the threshold.

[0025] The first ID may be the file name or metadata of the first file 2, and the second ID may be the file name or metadata of the second file 3. In one embodiment, the comparison module 13 determines that the first ID and the second ID match when the file names of the first file 2 and the second file 3 are the same. In another embodiment, the comparison module 13 determines that the first ID and the second ID match when the Hamming distance between the file names of the first file 2 and the second file 3 is close. In yet another embodiment, the comparison module 13 determines that the first ID and the second ID match when the metadata of the first file 2 and the second file 3 are close.

[0026] In the above embodiments, the file name may mean a full-path filename, which represents the complete and specific location of a file in the file system. In the Windows operating system, a full-path filename includes the drive letter (e.g., "C:"), directory names, and the filenames themselves. In Unix and similar systems, a full-path filename includes the root character (e.g., " / "), directory names, and the filenames themselves.

[0027] It should be noted that the above describes only a part of the specific embodiments of the present invention, and the detection system 1 is not limited to the above technical means in determining whether the first file 2 and the second file 3 are different versions of the same file.

[0028] After determining that the first ID and the second ID match, the comparison module 13 further calculates the distance between the first semantic feature of the first file 2 and the second semantic feature of the second file 3. At this time, a distance of zero or a small value indicates that the file contents of the first file 2 and the file contents of the second file 3 are identical or have only minor modifications. In other words, it matches the normal editing traces of the user. In this case, the detection system 1 can determine that the subsequent version (i.e., the second file 3) has not been subjected to a ransomware attack.

[0029] If the above distance exceeds a threshold, it means that the contents of the first file 2 and the contents of the second file 3 have undergone a substantial and thus abnormal change. In this case, the detection system 1 determines that the subsequent version (i.e., the second file 3) has been attacked with ransomware. In this invention, when the comparison module 13 determines that the above distance exceeds a predetermined threshold, the detection system 1 issues an alarm to the subsequent version of the file via the alarm module 14.

[0030] In this invention, each version of each file undergoes the above-described analysis by the detection system 1. If a subsequent version of a file is not alerted by the alarm module 14, the detection system 1 (or a subsequent backup server) marks this version as a clean version. Conversely, if a subsequent version of a file is alerted by the alarm module 14, the detection system 1 (or a subsequent backup server) marks this version as an unclean version.

[0031] Referring also to Figure 2, this is a flowchart of a detection method according to one embodiment of the present invention. Figure 2 discloses the detection method of the present invention, which is mainly applied to the detection system 1 shown in Figure 1.

[0032] As shown in Figure 2, the detection method of the present invention first receives a first file 2 having a first ID by the detection system 1 (step S20). Next, the first file 2 is imported into the semantic extraction module 12 (step S21), and a first semantic feature of the first file 2 is output based on the results of multiple semantic extractors 121 in the semantic extraction module 12 (step S22).

[0033] Furthermore, in the detection method of the present invention, the detection system 1 receives a second file 3 having a second ID (step S23), imports the second file 3 into the semantic extraction module 12 (step S24), and outputs a second semantic feature of the second file 3 based on the results of a plurality of semantic extractors 121 in the semantic extraction module 12 (step S25).

[0034] Next, the detection system 1 determines whether the first ID of the first file 2 matches the second ID of the second file 3 (step S26). If the first ID and the second ID do not match, it means that the first file 2 and the second file 3 are not preceding or succeeding versions of the same file, and therefore the detection system 1 does not compare the semantic features of the first file 2 and the second file 3.

[0035] If the first ID and the second ID match, the detection system 1 determines that the first file 2 and the second file 3 are preceding and succeeding versions of the same file, in which case the first file 2 is the preceding version and the second file 3 is the succeeding version. The detection system 1 further calculates the distance between the first semantic feature of the first file 2 and the second semantic feature of the second file 3 (step S27). Then, the detection system 1 determines whether the distance calculated in step S27 exceeds a threshold (step S28), and if the distance exceeds the threshold, it issues an alarm for the second file 3 (step S29).

[0036] In one embodiment, the above alarm is issued to mark the second file 3 as an attacked, unclean file.

[0037] In the present invention, the detection system 1 can perform a distance function using the comparison module 13 to calculate the distance between a first semantic feature and a second semantic feature. In one embodiment, the above semantic features are represented in vector form, and the detection system 1 can calculate an L1-norm, L2-norm, or other approximate metric and output the calculation result as the distance between the first semantic feature and the second semantic feature, but is not limited to this.

[0038] In the present invention, depending on the type or content of the files processed by the detection system 1 (for example, the first file 2 and the second file 3), the detection system 1 can extract comparable semantic features from the files by configuring a semantic extraction module 12 using different semantic extractors 121.

[0039] In one embodiment, the multiple semantic extractors 121 include multiple deep neural networks (DNNs). The semantic extraction module 12 uses the multiple deep neural networks to obtain vector-format semantic features from the contents of the first file 2 and the second file 3, and outputs the obtained features as the first semantic feature of the first file 2 and the second semantic feature of the second file 3. In this case, the semantic extractor 121 using deep neural networks can effectively extract semantic features when the first file 2 and the second file 3 are picture files, video files, or sound files.

[0040] In one embodiment, the semantic extractor 121 may be any type of deep neural network, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), or feedforward neural networks (FNNs). Furthermore, the multiple semantic extractors 121 within the semantic extraction module 12 may be a combination of the above-mentioned multiple types of networks.

[0041] In this invention, the purpose of generating semantic features is to determine whether or not significant changes have occurred in the content of preceding and succeeding versions of the same file. In other words, it is sufficient to be able to evaluate and compare whether or not significant differences have occurred in the content of two files, and the semantic features generated by the detection system 1 do not necessarily need to be interpretable to humans.

[0042] Taking a deep neural network with 50 hidden layers as an example, human-interpretable semantic features in a file may only be obtainable after the file has gone through processing across all 50 layers of this deep neural network. In this deep neural network, even if the output obtained from processing the first 20 layers is difficult for humans to understand, detection system 1 can use this output to evaluate and compare whether significant changes have occurred in the content of previous and subsequent versions of the same file. In some embodiments, the overall processing speed can be improved by reducing the number of layers in the deep neural network used for semantic feature acquisition.

[0043] In one embodiment, the multiple semantic extractors 121 include one or more different language analytical tools. In this embodiment, the semantic extraction module 12 converts the contents of the first file 2 and the second file 3 into text summaries using the multiple language analytical tools, and uses these text summaries as the first semantic feature of the first file 2 and the second semantic feature of the second file 3.

[0044] In one embodiment, the language analysis tool may be, but is not limited to, ChatGPT developed by OpenAI, Bard developed by Google, Stanford CoreNLP, Amazon Comprehend, Natural Language Toolkit (NLTK), or other natural language processing packages.

[0045] For example, the detection system 1 can import the first file 2 and the second file 3, along with a query command, into multiple language analysis tools used by the semantic extraction module 12. The query command is, for example, "Describe the contents of this file using 10 adjectives." In this way, the multiple language analysis tools can analyze the file contents according to the command and generate a text summary. The detection system 1 uses this text summary as the first and second semantic features, and determines whether the second file 3 is an unclean file based on the semantic distance between the first and second semantic features.

[0046] Note that different language analysis tools may generate identical or similar semantic features for the same file, but the semantic features obtained by different language analysis tools may contain multiple synonyms. In this embodiment, when the detection system 1 determines the distance between the first semantic feature and the second semantic feature, it makes a decision based on the number of missing synonyms between the first semantic feature and the second semantic feature.

[0047] For example, if the first semantic feature includes the three words "sad," "serene," and "hopeless," and the second semantic feature includes the three words "glad," "quiet," and "touching," then since no synonyms for "sad" or "despair" are found in the second semantic feature, detection system 1 can determine that the distance between the first and second semantic features is 2 (where "quiet" may be considered a synonym for "serene").

[0048] In one embodiment, the semantic extraction module 12 may implement multiple internal semantic extractors 121 by combining the deep neural network and language analysis tools described above, and is not limited to using a single type of semantic extractor 121.

[0049] In one embodiment, the multiple semantic extractors 121 include multiple file parsers of different types. In this embodiment, the semantic extraction module 12 analyzes the first file 2 and the second file 3 using the multiple file parsers. If the first file 2 can be analyzed by at least one of the multiple file parsers, but the second file 3 cannot be analyzed, the detection system 1 can determine that the second file 3 has been subjected to a ransomware attack and has become an unclean file.

[0050] Referring also to Figure 3, this is a flowchart for extracting semantic features in one embodiment of the present invention. Figure 3 illustrates how the semantic extraction module 12 of the present invention generates semantic features of a file using multiple file parsers of different types.

[0051] It is important to note that methods for determining file types simply by relying on file extensions are unreliable. In contrast, the present invention improves the reliability of acquired semantic features by using a file parser to determine the file type as semantic features. Since each file parser analyzes the file content based on a known file structure, the semantic features obtained in this way are extremely useful for detecting ransomware that destroys both the file content and the file structure.

[0052] As shown in Figure 3, the semantic extraction module 12 imports the file (including the first file 2 and / or the second file 3) into multiple file parsers and then obtains multiple analysis results from the multiple file parsers (step S30). Next, the semantic extraction module 12 determines whether any of the file parsers can correctly analyze this file (step S31). If at least one file parser can correctly analyze this file, the semantic extraction module 12 outputs a first signal as the semantic feature of this file (step S32). If none of the file parsers can correctly analyze this file, the semantic extraction module 12 outputs a second signal as the semantic feature of this file (step S33).

[0053] In one embodiment, the first signal is different from the second signal.

[0054] In one embodiment, the first signal is 1 and the second signal is 0. In another embodiment, the first signal is 0 and the second signal is 1.

[0055] The embodiment in Figure 3 is also applicable to the embodiment in Figure 2. For example, if at least one file parser can correctly parse the first file 2, the semantic extraction module 12 outputs a first signal as the first semantic feature of the first file 2. If none of the file parsers can correctly parse the first file 2, the semantic extraction module 12 outputs a second signal as the first semantic feature of the first file 2. If at least one file parser can correctly parse the second file 3, the semantic extraction module 12 outputs a first signal as the second semantic feature of the second file 3. If none of the file parsers can correctly parse the second file 3, the semantic extraction module 12 outputs a second signal as the second semantic feature of the second file 3.

[0056] In the embodiment shown in Figure 3, the semantic features are directly related to whether the file can be correctly parsed by one or more file parsers.

[0057] Specifically, if a preceding version of a file (e.g., the first file 2) can be parsed by one or more file parsers, but a subsequent version of the same file (e.g., the second file 3) cannot be correctly parsed by any of the file parsers, the detection system 1 can determine that the subsequent version of the file has been attacked with ransomware when it detects a significant change (e.g., a corrupted file structure), and can mark that subsequent version as an unclean version (i.e., a corrupted version).

[0058] In this embodiment, since the semantic extraction module 12 generates only signals of 0 or 1 (i.e., a first signal or a second signal), the above technical means can be employed with low storage capacity.

[0059] Furthermore, by adopting the above embodiment, false alarms can be avoided even if the variety of file parsers still does not cover all possible file types. For example, if the file type of a certain file is not included in the file parser adopted in this invention, then previous and subsequent versions of this file (e.g., the first file 2 and the second file 3) cannot be correctly parsed by either file parser. For this reason, the detection system 1 will not identify a file as an unclean file simply because a file parser is missing.

[0060] In one embodiment, when each file parser is unable to correctly parse a file, it generates a second signal, and the semantic features generated by the semantic extraction module 12 are a set of multiple output signals, for example, {0,0,0,…,0}. When a file parser can correctly parse a file, it generates a first signal, and the semantic features output by the semantic extraction module 12 are, for example, {0,0,1,…,0}. By comparing the sets of output signals as semantic features, the detection system 1 can determine whether a significant change has occurred between two versions of a file.

[0061] In another embodiment, the multiple semantic extractors 121 include multiple file parsers that analyze the contents of an input file to obtain characters. For example, each file parser can analyze characters from a specific type of file, such as Word, Excel, or PowerPoint, but is not limited to this.

[0062] In this embodiment, the semantic extraction module 12 uses multiple file parsers to obtain characters from the contents of the first file 2 and the second file 3, and generates a first semantic feature and a second semantic feature based on the content characters. As a result, the detection system 1 can determine whether or not the second file 3 has been subjected to a ransomware attack based on the first semantic feature and the second semantic feature.

[0063] Referring also to Figure 4, this is a flowchart for extracting semantic features in another embodiment of the present invention. Figure 4 illustrates how the semantic extraction module 12 of the present invention generates semantic features using multiple file parsers that acquire characters from an input file.

[0064] As shown in Figure 4, the semantic extraction module 12 imports the file (including the first file 2 and / or the second file 3) into multiple file parsers, and then obtains multiple unique words from the file from the multiple file parsers (step S40). Next, the semantic extraction module 12 converts the multiple unique words output by each file parser into corresponding mapped values ​​(step S41), and further generates a vector to be used as a semantic feature based on the multiple mapped values ​​(step S42). Here, the above vector has multiple entries, and each element corresponds to the occurrence count of one mapped value.

[0065] Please also refer to Figures 4, 5, and 6. Figure 5 is a schematic diagram showing the generation of semantic features in one embodiment of the present invention, and Figure 6 is a schematic diagram showing a comparison of semantic features in one embodiment of the present invention.

[0066] In the embodiment shown in Figure 5, we will explain how the semantic extraction module 12 generates the first semantic feature, using the first file 2 as an example.

[0067] As shown in Figure 5, after the detection system 1 imports the first file 2 into the semantic extraction module 12, multiple file parsers analyze the contents of the first file 2 and can obtain multiple unique words 41 from the first file 2. If at least one file parser can analyze a file, it can obtain characters from that file, and as a result, the detection system 1 can obtain unique words 41 from the obtained characters.

[0068] In one embodiment, the unique word 41 is a character that appears at least once in the first file 2, and this character is retained only once in the unique word 41. In another embodiment, the unique word 41 excludes stop words, such as "and," "or," and "not." These stop words are common words that are often filtered or ignored when processing natural language text in various character analysis tasks such as search engines, information retrieval, and text mining. Since these words are usually considered to have no value in conveying meaningful information, the unique word 41 of the present invention may exclude these stop words.

[0069] Furthermore, the user can pre-configure the parameter settings for multiple file parsers. When analyzing the contents of the first file 2, the multiple file parsers can either analyze the entire text of the first file 2 or only a portion of its contents (e.g., the title, the first paragraph, or half the length) based on the parameter settings. In the embodiment shown in Figure 5, the system is pre-configured to analyze the characters of the first line of the first file 2, but the analysis performed by the file parsers is not limited to what is shown in Figure 5.

[0070] In one embodiment, the semantic extraction module 12 converts each unique word 41 into a corresponding mapping number 42 based on a hash function, a keyed hash function, a look-up table (LUT), a linear feedback shift register (LFSR), or the modulo sum of the US standard information exchange codes for each character of the unique word 41.

[0071] In the embodiment shown in Figure 5, after multiple file parsers analyze the first file 2, six unique words 41 such as "Bob," "just," "has," "a," "credit," and "card" are obtained. The semantic extraction module 12 then converts these six unique words 41 into corresponding mapping values ​​42, resulting in "1," "0," "3," "1," "1," and "3."

[0072] In one embodiment, the semantic extraction module 12 can reduce the converted mapping numerical value 42, so that the mapping numerical value 42 may be less than or equal to the length of the vector used as a semantic feature.

[0073] Taking hash functions as an example, the semantic extraction module 12 can convert a unique word 41 into a corresponding mapping number 42 using, for example, Secure Hash Algorithm (SHA) technology such as SHA-0, SHA-1, or SHA-256, Cyclic Redundancy Check (CRC) technology such as CRC-32, CRC-16, or CRC-CCITT, or Message Digest technology (e.g., MD5).

[0074] Specifically, in the embodiment shown in Figure 5, the unique word 41 is converted to a simple mapping number 42 (for example, 1, 0, 3, 1, 1, and 3 shown in Figure 5), but the present invention is not limited to the simple mapping number 42 shown in Figure 5. For example, by converting the unique word 41 "HELLO" using SHA technology (for example, SHA-256), a mapping number 42 represented in hexadecimal, "3733cd977ff8eb18b987357e22ced99f46097f31ecb239e878ae63760e83e4d5", can be obtained.

[0075] The above is merely one embodiment of the present invention and is not limited thereto. In one embodiment, the semantic extraction module 12 can reduce the size of the converted mapping number 42 so that the mapping number 42 is less than or equal to the length of the vector used as a semantic feature. For example, if a set of exemplary hexadecimal mapping numbers 42 is "3733cd977ff8eb18b987357e22ced99f46097f31ecb239e878ae63760e83e4d5", treating the entire mapping number 42 as a single value would be very large. Therefore, the semantic extraction module 12 can reduce the size of the mapping number 42 by selecting only the lower 8 bits (i.e., "d5") of the hexadecimal mapping number 42 so that the mapping number 42 is less than or equal to the length of a vector of length 256.

[0076] For example, when using a keyed hash function, the semantic extraction module 12 can convert a unique word 41 into a corresponding mapping number 42 using techniques such as HMAC-SHA-0, HMAC-SHA-1, HMAC-SHA-256, or HMAC-MD5. Since HMAC can associate the same unique word 41 with different hash values ​​based on different keys, if an attacker cannot obtain this key, the semantic features extracted from it can provide a higher level of privacy protection.

[0077] In one embodiment, each unique word 41 can be converted into a corresponding mapping number 42 using the ASCII code of the characters in each unique word 41. For example, the unique word 41 "HELLO" is parsed as "72", "69", "76", "76", and "79", and the semantic extraction module 12 adds these output numbers to obtain the mapping number 42 "372". In one embodiment, the semantic extraction module 12 performs a modulo operation on the mapping number 42 "372" using the modulo rule of 256, obtaining the result "116", and ensuring that this operation result falls within the range of a 256 tuple vector. The modulo sum obtained in this way can be used as the mapping number 42.

[0078] As shown in Figure 5, after obtaining the mapping numerical value 42 for each unique word 41, the semantic extraction module 12 further generates a vector 43. This vector 43 contains multiple elements 431, and the numerical content of each element 431 corresponds to the number of occurrences of one mapping numerical value 42.

[0079] In the embodiment shown in Figure 5, the mapping numerical value 42 contains one "0", three "1", zero "2", and two "3". The multiple elements 431 of the vector 43 generated by the semantic extraction module 12 are as follows: the first element (representing 0) has a numerical value of 1, the second element (representing 1) has a numerical value of 3, the third element (representing 2) has a numerical value of 0 (indicated by a white frame in the figure as an empty element), and the fourth element (representing 3) has a numerical value of 2. By using this vector 43 as the first semantic feature of the first file 2, the detection system 1 can compare the contents of the first file 2 with the contents of the second file 3 received thereafter and determine whether or not a significant change has occurred in the contents of the second file 3.

[0080] In the embodiment shown in Figure 6, the content of the second file 3 has a different meaning due to editing, but it is a successor version of the first file 2, with only one unique word 41 "defaulted" added to the content of the second file 3. After the semantic extraction module 12 converts the unique word 41 of the second file 3 into a mapping value 42 to generate a vector 43, the comparison module 13 calculates the distance D between the vector 43(1,3,0,2) corresponding to the first file 2 and the vector 43(1,3,1,2) corresponding to the second file 3, and the result is only 1. In this case, the detection system 1 can determine that this difference belongs to the normal editing traces of the second file 3 by the user, and can therefore mark the second file 3 as a clean file.

[0081] In one embodiment, it is assumed that the third file 31 is a successor version of the second file 3 and is an unclean file destroyed by ransomware. In this embodiment, the file structure of the third file 31 is not intentionally destroyed by the ransomware, but its text content has been altered, which is why a ransom is demanded. As shown in the embodiment of Figure 6, the content of the third file 31 is significantly different from the content of the second file 3. After the semantic extraction module 12 converts the unique word 41 of the third file 31 into a mapping numerical value 42 to generate a vector 43, the comparison module 13 calculates the distance D between the vector 43(1,3,1,2) corresponding to the second file 3 and the vector 43(0,2,3,2) corresponding to the third file 31, and the result is a high value of 4 (relatively high in this embodiment). In this case, the detection system 1 determines that the third file 31 has undergone significant changes compared to the second file 3 and can mark the third file 31 as an unclean file.

[0082] For a clearer explanation, the embodiments in Figures 5 and 6 illustrate a 4-tuple vector 43. However, to improve accuracy, the detection system 1 is not limited to 4-tuples and can employ vectors 43 with more tuples. By increasing the length of vector 43, the semantic extraction module 12 can utilize more mapping values ​​42 when performing the transformation process, thereby improving the accuracy of subsequent comparison operations.

[0083] Furthermore, if ransomware simply encrypts the entire file without altering its contents, multiple file parsers will be unable to analyze the file and will not be able to obtain any unique words 41 from it. In this case, all mapping values ​​42 generated by the semantic extraction module 12 will be "0", and all elements 431 of the generated vector 43 will also be 0. According to the above-described technical means of the present invention, since all elements 431 of the subsequent version of the vector 43 are 0, a significant difference arises from the contents of the preceding version of the vector 43. Therefore, the detection system 1 can determine, based on the distance between the vectors, that the subsequent version is an unclean file that has been attacked by ransomware.

[0084] The embodiment shown in Figure 4 above is also applicable to the embodiment shown in Figure 2. For example, when a first file 2 is imported into a semantic extraction module 12 equipped with multiple file parsers, the semantic extraction module 12 obtains multiple unique words 41 contained in the first file 2 from the analysis results of the multiple file parsers. After converting each of the multiple unique words 41 into their corresponding mapping numbers 42, the semantic extraction module 12 generates a first vector, which is a first semantic feature, based on the multiple mapping numbers 42. The first vector has multiple elements, each element corresponding to the number of occurrences of one mapping number 42. Similarly, when a second file 3 is imported into a semantic extraction module 12 equipped with multiple file parsers, the semantic extraction module 12 obtains multiple unique words 41 contained in the second file 3 from the analysis results of the multiple file parsers. After converting each of the multiple unique words 41 into their corresponding mapping numbers 42, the semantic extraction module 12 generates a second vector, which is a second semantic feature, based on the multiple mapping numbers 42. The second vector has multiple elements, each element corresponding to the number of occurrences of one mapping number 42.

[0085] As a result of the above-described technical means, even when ransomware attacks file contents without destroying the file format, the detection system 1 of the present invention can detect ransomware attack events.

[0086] The detection system of the present invention can be executed on an independent computer device or on an existing backup server. The detection system and method of the present invention can help a user detect each version of a file and mark each as clean or unclean. This allows the backup server to prevent the user from using the unclean version of the file instead of the clean version during system restoration, even if the backup server has backed up the unclean version of the file. As a result, effective system restoration can be achieved. The detection method of the present invention described above can also be applied to an independent computer device. Files on such a computer device can be protected without the assistance of a backup server.

[0087] In one embodiment, when the computing device generates a subsequent version of a file, the detection system 1 can immediately verify whether this subsequent version is a clean version generated based on normal editing or an unclean version generated under attack. This allows the computing device to decide whether or not to back up the subsequent version.

[0088] Referring to Figure 7, we see a flowchart of a backup according to one embodiment of the present invention. As shown in Figure 7, the arithmetic unit receives a file when it is opened (step S70), then generates a first copy of the file, and locks the first copy (step S71). The first copy cannot be edited after it is locked. In this embodiment, the first copy corresponds to the first file 2 in the previously described embodiment.

[0089] Next, when the same file is opened again and modified, the arithmetic unit receives the subsequent version of this file (step S72) and generates a second copy of the subsequent version of this file (step S73). In this embodiment, the second copy corresponds to the second file 3 in the previously described embodiment.

[0090] In this embodiment, the arithmetic unit inspects the first copy and the second copy using the detection system 1 and determines whether the second copy passed detection (step S74). If the second copy did not pass detection (i.e., the second copy was alarmed by the alarm module 14 of the detection system 1), subsequent versions of this file are detected as unclean versions, and these unclean versions may have been generated as a result of an attack. In this case, the arithmetic unit instructs the user to restore the file based on the first copy (step S75).

[0091] If the second copy passes detection (i.e., the second copy is not alarmed by the alarm module 14 of the detection system 1), it means that subsequent versions of this file are still clean versions. In this case, since the second copy is new and the first copy is old, the arithmetic unit deletes the first copy (step S76) and locks the second copy (step S77).

[0092] If this file is opened again and modified, the computing unit can generate a third copy of the subsequent version of this file and perform detection through the operations described above. The detection system and detection method of the present invention ensure that for each file, the computing unit always has at least one clean version that can be restored as needed.

[0093] The above description is merely a preferred example of the present invention and does not limit the scope of the claims of the present invention. Therefore, any equivalent modifications utilizing the content of the present invention are all included within the scope of the present invention. [Explanation of symbols]

[0094] 1…Detection system 11…File Import Module 12…Semantic Extraction Module 121...Semantic extractor 13...Comparison Module 14… Alarm module 2…First file 3…Second file 31…The third file 41... Unique word 42…Mapping value 43... Feature vectors 431... elements D... Distance S20~S29...Detection Steps S30-S33, S40-S42... Extraction steps S70~S77...Backup Steps

Claims

1. Step a, receiving a first file having a first ID, Step b includes importing the first file into a semantic extraction module composed of multiple semantic extractors, and outputting a first semantic feature of the first file using the semantic extraction module, Step c involves receiving a second file having a second ID, Step d involves importing the second file into the semantic extraction module and outputting the second semantic feature of the second file using the semantic extraction module. Step e, which determines whether the first ID and the second ID match, Step f, when the first ID and the second ID match, determines that the first file and the second file are different versions of the same file, and calculates the distance between the first semantic feature and the second semantic feature. A method for detecting ransomware, comprising step g, which involves issuing an alarm when the distance exceeds a threshold.

2. The first ID and the second ID are the filenames or metadata of the first file and the second file, The aforementioned step e is, If the filenames of the first file and the second file are the same, it is determined that the first ID and the second ID match. If the Hamming distance between the filenames of the first file and the second file is close, it is determined that the first ID and the second ID match. When the metadata of the first file and the second file are similar, it is determined that the first ID and the second ID match, and A ransomware detection method according to claim 1, comprising determining that the first ID and the second ID match when the first file and the second file are located in the same directory and the filenames of the first file and the second file are similar, or a combination thereof.

3. The ransomware detection method according to claim 1, wherein step f includes calculating the distance between the first semantic feature and the second semantic feature using a distance function.

4. The aforementioned multiple semantic extractors comprise multiple deep neural networks that are different from each other. The ransomware detection method according to claim 1, wherein in step b and step d, the plurality of deep neural networks obtain features from the first file and the second file, output a plurality of features in vector format, and define the first semantic feature and the second semantic feature, respectively.

5. The aforementioned multiple semantic extractors are equipped with multiple language analysis tools that differ from each other. The ransomware detection method according to claim 1, wherein in step b and step d, the contents of the first file and the second file are converted into text summaries by the plurality of language analysis tools, and these summaries are used as the first semantic feature and the second semantic feature.

6. The aforementioned multiple semantic extractors include multiple file parsers of different types, Step b above is, Step b1 involves importing the first file into the multiple file parsers, Step b2, when at least one of the plurality of file parsers is capable of analyzing the first file, outputs a first signal as the first semantic feature, Step b3 includes outputting a second signal different from the first signal as the first semantic feature if all of the aforementioned file parsers are unable to parse the first file, The aforementioned step d is, Step d1 involves importing the second file into the multiple file parsers, Step d2, when at least one of the plurality of file parsers is capable of analyzing the second file, outputs the first signal as the second semantic feature, A ransomware detection method according to claim 1, comprising step d3, which outputs the second signal as the second semantic feature when all of the plurality of file parsers are unable to parse the second file.

7. The aforementioned multiple semantic extractors include multiple file parsers of different types for extracting characters from a file, Step b above is, Step b1 involves importing the first file into the multiple file parsers, Step b2 involves obtaining multiple unique words in the first file based on the analysis results of the multiple file parsers, Step b3, which converts each of the aforementioned unique words into a corresponding mapping value, The process includes step b4, which generates a first vector as the first semantic feature based on a plurality of the aforementioned mapping values, The first vector has multiple elements, each of which corresponds to the number of occurrences of one of the mapping values. The aforementioned step d is, Step d1 involves importing the second file into the multiple file parsers, Step d2 involves obtaining multiple unique words in the second file based on the analysis results of the multiple file parsers, Step d3 converts each of the aforementioned unique words into a corresponding mapping value, The process includes step d4, which generates a second vector as the second semantic feature based on a plurality of the aforementioned mapping values, The ransomware detection method according to claim 1, wherein the second vector has a plurality of elements, each of which corresponds to the number of occurrences of one of the mapping values.

8. The ransomware detection method according to claim 7, wherein step b3 and step d3 convert each of the unique words into a corresponding mapping numerical value based on one or a combination thereof of a hash function, a keyed hash function, a lookup table, a linear feedback shift register, and the modulo sum of the information exchange US standard codes for each character of each of the unique words.

9. Step l: When the file is opened by the computing unit, receive the file and generate a first copy of the file. Step m of locking the first copy, Step n: When the file is opened again, the arithmetic unit receives a subsequent version of the file and generates a second copy of the subsequent version of the file. Step o, instructing the arithmetic unit to perform a restoration based on the first copy if the second copy is alarmed in step g, The ransomware detection method according to claim 1, further comprising step p, if the second copy was not alarmed in step g, the computing device deletes the first copy and locks the second copy.

10. A file import module configured to receive a first file having a first ID and a second file having a second ID, A semantic extraction module connected to the aforementioned file import module, comprising a plurality of semantic extractors, and configured to extract a first semantic feature from the first file and a second semantic feature from the second file, A comparison module connected to the semantic extraction module is configured to determine whether the first ID and the second ID match, and if the first ID and the second ID match, to determine that the first file and the second file are different versions of the same file, and to calculate the distance between the first semantic feature and the second semantic feature. A ransomware detection system including an alarm module connected to the comparison module and configured to issue an alarm when the comparison module determines that the distance exceeds a threshold.

11. The first ID and the second ID are the filenames or metadata of the first file and the second file, The aforementioned comparison module is If the filenames of the first file and the second file are the same, If the Hamming distance between the filenames of the first file and the second file is small, When the metadata of the first file and the second file are similar, and The ransomware detection system according to claim 10, configured to determine that the first ID and the second ID match when one or a combination of the following occurs: the first file and the second file are located in the same directory and the filenames of the first file and the second file are similar.

12. The ransomware detection system according to claim 10, wherein the comparison module is configured to calculate the distance between the first semantic feature and the second semantic feature using a distance function.

13. The aforementioned multiple semantic extractors include multiple deep neural networks, The ransomware detection system according to claim 10, wherein the semantic extraction module is configured to acquire features from the first file and the second file using the plurality of deep neural networks, output a plurality of features in vector format, and use these as the first semantic feature and the second semantic feature, respectively.

14. The aforementioned multiple semantic extractors are equipped with multiple language analysis tools that differ from each other. The ransomware detection system according to claim 10, wherein the semantic extraction module is configured to convert the contents of the first file and the second file into text summaries using the plurality of language analysis tools, and to obtain the first semantic features and the second semantic features.

15. The aforementioned multiple semantic extractors include multiple file parsers of different types, The aforementioned semantic extraction module, If at least one of the plurality of file parsers is able to analyze the first file, a first signal is output as the first semantic feature; if all of the plurality of file parsers are unable to analyze the first file, a second signal different from the first signal is output as the first semantic feature. The ransomware detection system according to claim 10, configured to extract the first and second semantic features by outputting the first signal as the second semantic feature when at least one of the plurality of file parsers is able to analyze the second file, and by outputting the second signal as the second semantic feature when all of the plurality of file parsers are unable to analyze the second file.

16. The aforementioned multiple semantic extractors include multiple file parsers for extracting characters from a file, The aforementioned semantic extraction module, Based on the analysis results of the aforementioned multiple file parsers, multiple unique words in the first file are obtained. Each of the aforementioned unique words is converted into its corresponding mapping value, A first vector is generated as the first semantic feature based on a plurality of the aforementioned mapping values, the first vector having a plurality of elements, each of which corresponds to the number of occurrences of one of the aforementioned mapping values, Based on the analysis results of the aforementioned multiple file parsers, multiple unique words in the second file are obtained, Each of the aforementioned unique words is converted into its corresponding mapping value, The ransomware detection system according to claim 10, wherein a second vector is generated as a second semantic feature based on a plurality of mapping values, and the second vector has a plurality of elements, and each element performs an operation corresponding to the number of occurrences of one of the mapping values, thereby extracting the first semantic feature and the second semantic feature.

17. The ransomware detection system according to claim 16, wherein the semantic extraction module is configured to convert each of the unique words into a corresponding mapping numerical value based on one or a combination thereof of a hash function, a keyed hash function, a lookup table, a linear feedback shift register, and the modulo sum of the information exchange US standard codes for each character of each of the unique words.

18. The system further includes a computing device connected to the aforementioned detection system, The aforementioned computing device is When the file is opened, the system receives the file, generates a first copy of the file, locks the first copy, When the aforementioned file is opened again, the subsequent version of the aforementioned file is received, and a second copy of the subsequent version of the aforementioned file is generated. If the second copy is alarmed by the alarm module, instruct it to restore it based on the first copy. The ransomware detection system according to claim 10, configured to delete the first copy and lock the second copy if the second copy is not alarmed by the alarm module.

Images