Ransomware attack detection method and related device

Abstract

A ransomware attack detection method and a related device. The method comprises: determining a target fingerprint according to a target input-output (IO) sequence (S310); according to an attack fingerprint library and the target fingerprint, determining the similarities between attack fingerprints in the attack fingerprint library and the target fingerprint (S320); and according to the similarities between the target fingerprint and the attack fingerprints, determining that the target IO sequence is a normal IO sequence or a ransomware attack IO sequence (S330). By means of determining a target fingerprint corresponding to an IO sequence in real time and comparing the target fingerprint with attack fingerprints in an attack fingerprint library, whether the IO sequence is normal can be determined more quickly, without the need to calculate and detect data content corresponding to the IO sequence, and thus a ransomware attack detection speed can be increased.

Description

A method and related equipment for detecting ransomware attacks This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office of China on June 13, 2023, with application number 202310697994.6 and application name “A method for processing ransomware virus”, and the priority of the Chinese patent application filed with the State Intellectual Property Office of China on August 3, 2023, with application number 202310976546.X and application name “A method for detecting ransomware attacks and related equipment”, the entire contents of which are incorporated by reference in this application. Technical Field The present application relates to the field of computers, and more specifically, to a method for detecting a ransomware attack, a computing device, a computing equipment, a chip system, and a computer-readable storage medium. Background Art The explosive growth of data volume has brought about data storage problems. Storage device manufacturers and storage users have to face data security issues brought about by the explosive growth of data scale, such as ransomware attacks. Attackers in ransomware attacks can access users' storage devices and encrypt, modify, or delete data stored in the storage devices, making it impossible for users to normally access or read and write data stored in the storage devices. Instead, they must use the decryption key provided by the attacker to restore or access the data. Current methods for detecting ransomware attacks generally require determining the data corresponding to the input-output (IO) sequence through the IO sequence, and then calculating and detecting the content of the data to determine whether a ransomware attack has occurred. This method takes a long time to detect a ransomware attack and cannot issue an alarm in a timely manner. Therefore, how to improve the detection speed of ransomware attacks has become an urgent problem to be solved. Summary of the invention The present application provides a method for detecting a ransomware attack, a computing device, a computing equipment, a chip system, and a computer-readable storage medium, which can improve the detection speed of a ransomware attack. In a first aspect, a method for detecting a ransomware attack is provided, the method comprising: determining a target fingerprint according to a target input / output (IO) sequence, the target IO sequence being used to access target data; determining a similarity between an attack fingerprint in the attack fingerprint library and the target fingerprint according to an attack fingerprint library and the target fingerprint, the attack fingerprint library comprising at least one attack fingerprint, the attack fingerprint being determined according to an attack IO sequence in a historical ransomware attack; determining, according to the similarity between the target fingerprint and the attack fingerprint, whether the target IO sequence is a normal IO sequence or a ransomware attack IO sequence. In the embodiment of the present application, the target fingerprint corresponding to the IO sequence can be determined in real time, and the target fingerprint can be compared with the attack fingerprint in the attack fingerprint library to determine whether the IO sequence is a ransom attack IO sequence. Since the amount of target data is generally large, the method in the embodiment of the present application does not need to calculate and detect the content of the target data, but determines the target fingerprint based on the IO sequence with a smaller amount of data, and determines whether the IO sequence is normal by comparing it with the attack fingerprint in the attack fingerprint library. Therefore, it is possible to quickly determine whether the IO sequence is a ransom attack IO sequence, thereby increasing the speed of detecting ransom attacks. In combination with the first aspect, in certain implementations of the first aspect, a target fingerprint is determined based on characteristics of a target IO sequence, the characteristics of the target IO sequence include instructions contained in the target IO sequence and / or a storage address corresponding to the target IO sequence, and the target IO sequence includes at least one instruction, and the at least one instruction is used to access target data. In an embodiment of the present application, considering that the instructions contained in the ransom attack IO sequence and / or the storage address corresponding to the ransom attack IO sequence have some special characteristics compared with the normal IO sequence, the computing device can determine the target fingerprint based on the instructions contained in the target IO sequence and / or the storage address corresponding to the target IO sequence, thereby facilitating the comparison of the target fingerprint with the attack fingerprint in the attack fingerprint library, thereby realizing the detection of the ransom attack. In combination with the first aspect, in certain implementations of the first aspect, the target fingerprint is determined based on the characteristics of the target IO sequence and the characteristics of the target data. Wherein, when the target data belongs to a file system, the characteristics of the target data include at least one of the following: metadata of the target data, metadata of the file system, and content of the target data. When the target data is a data block or part of the data in the data block, the characteristics of the target data include metadata of the target data and / or content of the target data. In the embodiment of the present application, considering that the characteristics of the ransom attack IO sequence have special characteristics compared with the characteristics of the normal IO sequence, and the characteristics of the data corresponding to the ransom attack IO sequence also have special characteristics compared with the characteristics of the data corresponding to the normal IO sequence, the computing device can determine the target fingerprint according to the characteristics of the target IO sequence and the characteristics of the target data, thereby facilitating the comparison of the target fingerprint with the attack fingerprint in the attack fingerprint library, and further realizing the detection of the ransom attack. In combination with the first aspect, in some implementations of the first aspect, the metadata of the file system includes at least one of the following: identification information of the target data in the file system, and identification information of the directory where the target data is located in the file system. In an embodiment of the present application, when the target data belongs to a file system, considering that the ransomware attack IO sequence may target specific data in the file system or specific data under a specific directory, the target fingerprint can be determined through the characteristics of the target IO sequence and the metadata of the file system, thereby comparing the target fingerprint with the attack fingerprint to achieve detection of the ransomware attack. In combination with the first aspect, in certain implementations of the first aspect, an entropy value of the content of the target data is determined based on the content of the target data; and a target fingerprint is determined based on characteristics of the target IO sequence and the entropy value of the content of the target data. In the embodiment of the present application, considering that the ransomware attack will encrypt the data content, and the entropy value of the encrypted data content is higher than the entropy value of the original data content, it is possible to calculate the entropy value of the data content and determine the target fingerprint based on the entropy value and the characteristics of the target IO sequence, thereby facilitating comparison with the attack fingerprint and realizing the detection of the ransomware attack. In combination with the first aspect, in some implementations of the first aspect, at least one feature of the target IO sequence is encoded to determine a target fingerprint. In an embodiment of the present application, the computing device can encode at least one feature of the target IO sequence, so that each feature is transformed into a target fingerprint that is easy to measure or compare, thereby increasing the speed of comparison with the attack fingerprint, and further increasing the speed of detecting ransomware attacks. In combination with the first aspect, in some implementations of the first aspect, a first vector is determined according to at least one feature of the target IO sequence; and a target fingerprint is determined according to the first vector. In the embodiment of the present application, the computing device can convert the characteristics of the target IO sequence into a first vector and determine the target fingerprint according to the first vector, thereby implementing the encoding process of the characteristics of the target IO sequence. The target fingerprint can be the first vector or a string determined according to the first vector, so that the time required for comparing the target fingerprint with the attack fingerprint is shorter. In combination with the first aspect, in certain implementations of the first aspect, at least one feature of the target IO sequence and at least one feature of the target data are encoded to determine the target fingerprint. In an embodiment of the present application, the computing device can encode at least one feature of the target IO sequence and at least one feature of the target data, so that each feature is transformed into a target fingerprint that is easy to measure or compare, thereby improving the speed of comparison with the attack fingerprint, and further improving the speed of detecting ransomware attacks. In combination with the first aspect, in some implementations of the first aspect, a second vector is determined based on at least one feature of the target IO sequence and at least one feature of the target data; and a target fingerprint is determined based on the second vector. In the embodiment of the present application, the computing device can convert the characteristics of the target IO sequence and the characteristics of the target data into a second vector, and determine the target fingerprint according to the second vector, thereby implementing the encoding process of the characteristics of the target IO sequence and the target data. The target fingerprint can be the second vector or a string determined according to the second vector, so that the time required for comparing the target fingerprint with the attack fingerprint is shorter. In combination with the first aspect, in certain implementations of the first aspect, if the similarity between the target fingerprint and the first attack fingerprint is greater than or equal to a first preset threshold, the target IO sequence is determined to be a ransomware attack IO sequence, and the first attack fingerprint is one attack fingerprint among at least one attack fingerprint; if the similarity between the target fingerprint and each attack fingerprint in the attack fingerprint library is less than the first preset threshold, the target IO sequence is determined to be a normal IO sequence. In the embodiment of the present application, the computing device can determine whether the target IO sequence is normal more quickly by comparing the similarity between the target fingerprint and the attack fingerprint with the first preset threshold, thereby improving the speed of detecting the ransomware attack. In combination with the first aspect, in some implementations of the first aspect, the attack fingerprint library further includes a storage address corresponding to each attack fingerprint. In an embodiment of the present application, the computing device may also store the storage address corresponding to each attack fingerprint in the attack fingerprint library, so that only the data content at the storage address can be restored according to the backup data corresponding to the storage address, without restoring the entire data block, the entire file system or the entire file, thereby speeding up the recovery speed and improving the recovery efficiency. In conjunction with the first aspect, in some implementations of the first aspect, the attack fingerprint library is stored in the form of key-value pairs, wherein the key in the key-value pair corresponds to the attack fingerprint, and the value in the key-value pair corresponds to the storage address corresponding to the attack fingerprint. In the embodiment of the present application, the attack fingerprint library can store the attack fingerprint and the storage address corresponding to the attack fingerprint in the form of a key-value pair, so as to realize a fast query of the attack fingerprint and the storage address corresponding to the attack fingerprint. In combination with the first aspect, in some implementations of the first aspect, when it is determined that the target IO sequence is a ransomware attack IO sequence, the target fingerprint is added to an attack fingerprint library. In an embodiment of the present application, when the computing device determines that the target IO sequence is a ransomware attack IO sequence, the target fingerprint corresponding to the target IO sequence is added to the attack fingerprint library, thereby expanding the attack fingerprint library so that the attack fingerprint library can include more attack fingerprints. In combination with the first aspect, in some implementations of the first aspect, before adding the target fingerprint to the attack fingerprint library, the method further includes: determining that the similarity between the target fingerprint and the second attack fingerprint is less than a second preset threshold. The second attack fingerprint is the attack fingerprint with the highest similarity to the target fingerprint among the at least one attack fingerprint, and the second preset threshold is greater than the first preset threshold. In the embodiment of the present application, a second preset threshold can be set so that the attack fingerprint library can avoid storing multiple attack fingerprints with high similarity, thereby further shortening the time for detecting ransomware attacks. In combination with the first aspect, in some implementations of the first aspect, when the target fingerprint is added to the attack fingerprint library, a storage address corresponding to the target fingerprint is added to the attack fingerprint library. In combination with the first aspect, in certain implementations of the first aspect, a first attack IO sequence is determined based on a first ransom attack sample in a ransom attack sample library, and the first ransom attack sample is a ransom attack sample in the ransom attack sample library; a first attack fingerprint is determined based on the first attack IO sequence, and the first attack fingerprint is an attack fingerprint among at least one attack fingerprint. In an embodiment of the present application, a simulated attack can be performed by using a ransom attack sample in a ransom attack sample library to determine at least one attack IO sequence in the attack process of each ransom attack sample, and an attack fingerprint can be determined based on the attack IO sequence, thereby constructing an attack fingerprint library for comparison with the target fingerprint. In combination with the first aspect, in certain implementations of the first aspect, an attack fingerprint is determined based on a feature of an attack IO sequence. The feature of the attack IO sequence includes instructions included in the attack IO sequence and / or a storage address corresponding to the attack IO sequence. The attack IO sequence includes at least one instruction, and at least one instruction in the attack IO sequence is used to access the attacked data. In an embodiment of the present application, considering that the instructions included in the ransom attack IO sequence and / or the storage address corresponding to the ransom attack IO sequence have some special characteristics compared with the normal IO sequence, the computing device can determine the attack fingerprint based on the instructions included in the attack IO sequence and / or the storage address corresponding to the attack IO sequence, thereby facilitating the comparison of the target fingerprint with the attack fingerprint, and further realizing the detection of the ransom attack. In combination with the first aspect, in certain implementations of the first aspect, the attack fingerprint is determined based on the characteristics of the attack IO sequence and the characteristics of the attacked data. When the attacked data belongs to the attacked file system, the characteristics of the attacked data include at least one of the following: metadata of the attacked data, metadata of the attacked file system, and content of the attacked data. When the attacked data is an attacked data block or part of the data in the attacked data block, the characteristics of the attacked data include metadata of the attacked data and / or content of the attacked data. In the embodiment of the present application, considering that the characteristics of the ransom attack IO sequence have special characteristics compared with the characteristics of the normal IO sequence, and the characteristics of the data corresponding to the ransom attack IO sequence also have special characteristics compared with the characteristics of the data corresponding to the normal IO sequence, the computing device can determine the attack fingerprint based on the characteristics of the attack IO sequence and the characteristics of the attacked data, thereby facilitating the comparison of the target fingerprint with the attack fingerprint, and further realizing the detection of the ransom attack. In combination with the first aspect, in some implementations of the first aspect, the metadata of the attacked file system includes at least one of the following: identification information of the attacked data in the attacked file system, and identification information of the directory where the attacked data is located in the attacked file system. In the embodiment of the present application, when the attacked data belongs to the attacked file system, it is considered that the ransom attack IO sequence may target specific data in the attacked file system or specific data under a specific directory. Therefore, the attack fingerprint can be determined by the characteristics of the attack IO sequence and the metadata of the attacked file system, so as to compare the target fingerprint with the attack fingerprint, thereby realizing the detection of the ransom attack. In combination with the first aspect, in certain implementations of the first aspect, an entropy value of the content of the attacked data is determined based on the content of the attacked data; and an attack fingerprint is determined based on the characteristics of the attack IO sequence and the entropy value of the content of the attacked data. In the embodiment of the present application, considering that the ransomware attack will encrypt the data content, and the entropy value of the encrypted data content is higher than the entropy value of the original data content, it is possible to calculate the entropy value of the data content and determine the attack fingerprint based on the entropy value and the characteristics of the attack IO sequence, thereby facilitating comparison with the target fingerprint and realizing the detection of the ransomware attack. In combination with the first aspect, in some implementations of the first aspect, at least one feature of the attack IO sequence is encoded to determine the attack fingerprint; or at least one feature of the attack IO sequence and at least one feature of the attacked data are encoded to determine the attack fingerprint. In an embodiment of the present application, the computing device may encode the features of the attack IO sequence, or may encode the features of the attack IO sequence and the attacked data, so that each feature is transformed into an attack fingerprint that is easy to measure or easy to compare, thereby increasing the speed of comparison with the target fingerprint, and further increasing the speed of detecting ransomware attacks. In combination with the first aspect, in some implementations of the first aspect, a third vector is determined according to at least one feature of the attack IO sequence, and the third vector is used to determine the attack fingerprint; or, according to at least one feature of the attack IO sequence and at least one feature of the attacked data, A fourth vector is determined, where the fourth vector is used to determine an attack fingerprint. In an embodiment of the present application, the computing device can encode the characteristics of the attack IO sequence, or the characteristics of the attack IO sequence and the characteristics of the attacked data, so that each feature is transformed into a vector or data that is easy to measure or easy to compare, thereby determining the attack fingerprint, and then facilitating the comparison of the target fingerprint with the attack fingerprint, thereby improving the speed of detecting ransomware attacks. In combination with the first aspect, in some implementations of the first aspect, the target fingerprint and / or the attack fingerprint is a character string of a preset length. In an embodiment of the present application, the computing device can compare the target fingerprint and the attack fingerprint by comparing two character strings of preset lengths, thereby determining whether the target IO sequence is normal, thereby improving the detection speed of the ransomware attack. In a second aspect, an embodiment of the present application provides a method for detecting a ransom attack. The method includes: determining a first attack IO sequence according to a first ransom attack sample in a ransom attack sample library, wherein the first ransom attack sample is a ransom attack sample in the ransom attack sample library; determining a first attack fingerprint according to the first attack IO sequence, wherein the first attack fingerprint is used to detect a ransom attack. In the embodiment of the present application, the attack fingerprint corresponding to each attack IO sequence can be determined by using the attack IO sequence in the attack process of the ransom attack sample. The attack fingerprint can be used to compare with the target fingerprint determined according to the IO sequence to be detected, so that it can be relatively quickly determined whether the IO sequence to be detected is a ransom attack IO sequence, without calculating and detecting the data content corresponding to the IO sequence to be detected, thereby improving the speed of detecting ransom attacks. In conjunction with the second aspect, in certain implementations of the second aspect, an attack fingerprint is determined based on a feature of an attack IO sequence. The feature of the attack IO sequence includes instructions included in the attack IO sequence and / or a storage address corresponding to the attack IO sequence. The attack IO sequence includes at least one instruction, and at least one instruction in the attack IO sequence is used to access the attacked data. In conjunction with the second aspect, in certain implementations of the second aspect, the attack fingerprint is determined based on the characteristics of the attack IO sequence and the characteristics of the attacked data. Wherein, when the attacked data belongs to the attacked file system, the characteristics of the attacked data include at least one of the following: metadata of the attacked data, metadata of the attacked file system, and content of the attacked data. When the attacked data is an attacked data block or part of the data in the attacked data block, the characteristics of the attacked data include metadata of the attacked data and / or content of the attacked data. In combination with the second aspect, in some implementations of the second aspect, the metadata of the attacked file system includes at least one of the following: identification information of the attacked data in the attacked file system, and identification information of the directory where the attacked data is located in the attacked file system. In combination with the second aspect, in certain implementations of the second aspect, an entropy value of the content of the attacked data is determined based on the content of the attacked data; and an attack fingerprint is determined based on the characteristics of the attack IO sequence and the entropy value of the content of the attacked data. In combination with the second aspect, in some implementations of the second aspect, at least one feature of the attack IO sequence is encoded to determine the attack fingerprint; or at least one feature of the attack IO sequence and at least one feature of the attacked data are encoded to determine the target fingerprint. In combination with the second aspect, in certain implementations of the second aspect, a third vector is determined based on at least one feature of the attack IO sequence, and the third vector is used to determine the attack fingerprint; or a fourth vector is determined based on at least one feature of the attack IO sequence and at least one feature of the attacked data, and the fourth vector is used to determine the attack fingerprint. In conjunction with the second aspect, in some implementations of the second aspect, an attack fingerprint library is determined based on at least one attack fingerprint. The attack fingerprint library also includes a storage address corresponding to each attack fingerprint. In conjunction with the second aspect, in some implementations of the second aspect, the attack fingerprint library is stored in the form of key-value pairs, wherein the key in the key-value pair corresponds to the attack fingerprint, and the value in the key-value pair corresponds to the storage address corresponding to the attack fingerprint. In combination with the second aspect, in some implementations of the second aspect, the attack fingerprint is a character string of a preset length. In a third aspect, an embodiment of the present application provides a computing device, which includes a module for implementing the first aspect, the second aspect, any possible implementation of the first aspect, or any possible implementation of the second aspect. In a fourth aspect, an embodiment of the present application provides a computing device, which includes a processor, which is used to couple with a memory, read and execute instructions and / or program codes in the memory to execute the first aspect, the second aspect, any possible implementation of the first aspect, or any possible implementation of the second aspect. In a fifth aspect, an embodiment of the present application provides a chip system, which includes a logic circuit, which is used to couple with an input / output interface and transmit data through the input / output interface to execute the first aspect, the second aspect, any possible implementation of the first aspect, or any possible implementation of the second aspect. In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a program code. When the program code runs on a computer, the computer executes the first aspect, the second aspect, any possible implementation of the first aspect, or any possible implementation of the second aspect. In a seventh aspect, an embodiment of the present application provides a computer program product, the computer program product comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the first aspect, the second aspect, and the first aspect. Any possible implementation of the second aspect or the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS FIG1 is a schematic structural block diagram of a ransomware attack detection system according to an embodiment of the present application. FIG. 2 is a schematic structural block diagram of a computing device according to an embodiment of the present application. FIG3 is a schematic flowchart of a method for detecting a ransomware attack according to an embodiment of the present application. FIG4 is a schematic flowchart of a method for detecting a ransomware attack according to another embodiment of the present application. FIG5 is a schematic flowchart of a method for determining a target fingerprint according to an embodiment of the present application. FIG6 is a schematic flowchart of a method for determining a target fingerprint according to another embodiment of the present application. FIG. 7 is a schematic flowchart of a method for establishing an attack fingerprint library according to an embodiment of the present application. FIG8 is a schematic structural block diagram of a computing device according to an embodiment of the present application. FIG. 9 is a schematic structural block diagram of a computing device according to an embodiment of the present application. DETAILED DESCRIPTION The technical solution in this application will be described below in conjunction with the accompanying drawings. The embodiments of the present application will present various aspects, embodiments or features around a system including multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used. In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way. The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of technology and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems. References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear at different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways. In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can be represented by: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple. The technical solutions in the embodiments of the present application can be applied to computing devices, such as servers, hosts, personal computers, laptops, desktops and other devices with computing capabilities. FIG1 is a schematic structural block diagram of a ransomware attack detection system provided in an embodiment of the present application. The ransomware attack detection system 100 in FIG1 may include a storage device 110 and a first computing device 120 . The storage device 110 may be connected to the first computing device 120, that is, the first computing device 120 may access the data stored in the storage device 110. The storage device 110 may be located outside the first computing device 120, that is, the storage device 110 and the first computing device 120 may be two independent devices, as shown in FIG1 . Alternatively, the storage device 110 may be located inside the first computing device 120, that is, the storage device 110 may be integrated with the first computing device 120 in the same device. The embodiment of the present application does not limit the specific type of the storage device 110, for example, the storage device 110 may include a volatile storage medium and / or a non-volatile storage medium. The volatile storage medium may include, for example, random access memory (RAM), static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SDRAM), and so on. The non-volatile storage medium may be, for example, a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), or a flash memory. In some embodiments, the storage device 110 may perform storage based on files, or the storage device 110 may perform storage based on data blocks, or the storage device 110 may perform storage based on objects. In some embodiments, the storage device 110 may be a centralized storage device or a distributed storage device. The storage device 110 may belong to a storage device cluster, and the storage device cluster may include at least one storage device. Multiple storage devices in the storage device cluster may be directly connected or connected through a network. The network may be, for example, a wide area network or a local area network. The storage device cluster may be included in the ransomware attack detection system 100. The first computing device 120 can access data in the storage device 110 by sending an IO sequence to the storage device 110. The IO sequence may include at least one instruction, and each instruction in the at least one instruction is used to access the data in the storage device 110. For example, the at least one instruction may be any one or more of the following instructions: a read instruction, a write instruction, a delete instruction, a rename instruction, etc. The read instruction can be used to read data in the storage device 110, and the write instruction can be used to write data to the storage device 110. The delete instruction can be used to delete data in the storage device 110. The rename instruction can be used to rename the data in the storage device 110. The IO sequence may also include timing information, and the timing information is used to indicate the order in which the storage device 110 executes instructions according to at least one IO sequence. The first computing device 120 may determine a target fingerprint according to a target IO sequence sent to the storage device 110. The target IO sequence is used to access target data in the storage device 110. The first computing device 120 may also determine the similarity between the attack fingerprint in the attack fingerprint library and the target fingerprint, and determine whether the target IO sequence is a normal IO sequence according to the similarity, thereby realizing the detection of a ransomware attack. Optionally, the ransomware attack detection system 100 in FIG. 1 may further include a second computing device 130. The second computing device 130 may be connected to the storage device 110 to access data in the storage device 110. The second computing device 130 may also be connected to the first computing device 120. The second computing device 130 may determine a target fingerprint based on a target IO sequence. The target IO sequence may be obtained by the second computing device 130 from the first computing device 120. Alternatively, the target IO sequence may be obtained by the second computing device 130 from the storage device 110. The second computing device 130 may also determine the similarity between the attack fingerprint in the attack fingerprint library and the target fingerprint, and determine whether the target IO sequence is a normal IO sequence based on the similarity, thereby realizing the detection of a ransomware attack. In some embodiments, the first computing device 120 and / or the second computing device 130 may belong to a computing device cluster. The computing device cluster may include at least one computing device. Any computing device in the computing device cluster may execute the method in the embodiment of the present application, or multiple computing devices in the computing device cluster may jointly execute the method in the embodiment of the present application. Multiple computing devices in the computing device cluster may be directly connected or connected through a network, and the network may be, for example, a wide area network or a local area network. FIG2 is a schematic structural diagram of a computing device provided in an embodiment of the present application. The computing device 200 in FIG2 may be the first computing device 120 in FIG1. ​​Alternatively, the computing device 200 may be the second computing device 130 in FIG1. ​​The computing device 200 in FIG2 includes an attack fingerprint library storage module 220 and a detection module 240. The attack fingerprint library storage module 220 may store an attack fingerprint library. The attack fingerprint library stores at least one attack fingerprint, and each attack fingerprint is determined according to an attack IO sequence in a historical ransom attack. The historical ransom attack may be a simulated attack based on a ransom attack sample in a ransom attack sample library. The computing device 200 may obtain the attack fingerprint library through other devices connected to the computing device 200. Alternatively, the computing device 200 may determine the attack fingerprint library through the attack fingerprint calculation module 210. Optionally, the computing device 200 may include an attack fingerprint calculation module 210. The attack fingerprint calculation module 210 is used to establish an attack fingerprint library. Specifically, the attack fingerprint calculation module 210 can attack a storage device (e.g., the storage device 110 in FIG. 1 ) according to a first ransom attack sample in a ransom attack sample library, thereby determining at least one attack IO sequence in the attack process of the first ransom attack sample. The ransom attack sample library stores at least one ransom attack sample, and the first ransom attack sample is a ransom attack sample in the ransom attack sample library. Each attack IO sequence in the at least one attack IO sequence is used to access data in the storage device. The attack fingerprint calculation module 210 can also determine at least one attack fingerprint according to the at least one attack IO sequence. The at least one attack IO sequence corresponds one-to-one to the at least one attack fingerprint. The attack fingerprint calculation module 210 can also establish an attack fingerprint library according to the at least one attack fingerprint. The detection module 230 can determine the target fingerprint based on the target IO sequence. The target IO sequence is used to access the target data in the storage device (e.g., the storage device 110 in FIG. 1 ). The target IO sequence can be, for example, the IO sequence sent by the first computing device 120 in FIG. 1 to the storage device 110. The detection module 230 can also determine the attack fingerprint from the attack fingerprint library storage module 220 and determine the similarity between the attack fingerprint and the target fingerprint. The detection module 230 can also determine the target IO sequence as Normal IO sequence or ransomware attack IO sequence. Optionally, the computing device 200 may further include an alarm module 240. The alarm module 240 is used to determine that a ransom attack is detected when determining that the target IO sequence is a ransom attack IO sequence, thereby issuing an alarm. The computing device 200 can determine the target fingerprint corresponding to the IO sequence in real time and compare the target fingerprint with the attack fingerprint in the attack fingerprint library, so as to more quickly determine whether the IO sequence is a ransomware attack IO sequence without calculating and detecting the data content corresponding to the IO sequence, thereby improving the speed of detecting ransomware attacks. FIG3 is a schematic flow chart of a method for detecting a ransomware attack provided in an embodiment of the present application. The method in FIG3 may be executed by a computing device. The computing device may be the first computing device 120 or the second computing device 130 in FIG1 . Alternatively, the computing device may be the computing device 200 in FIG2 . FIG3 includes the following steps. S310, determining a target fingerprint according to a target IO sequence. The computing device may determine the target fingerprint corresponding to the target IO sequence according to the target IO sequence. The target fingerprint is used to determine whether the target IO sequence is a normal IO sequence. The target fingerprint may be an extraction or description of the attack attribute in the behavior characteristics of the target IO sequence, that is, the target fingerprint may be used to indicate the attack attribute of the target IO sequence. The attack attribute may be an attribute for a ransomware attack. The embodiment of the present application does not limit the specific form of the target fingerprint. For example, the target fingerprint can be represented as a one-dimensional or multi-dimensional vector, or can be represented as a character string of a preset length. The character string of the preset length can include at least one character, and the at least one character can include any one or more of a number, a letter, and a symbol. For example, the target fingerprint can be an N-dimensional vector, or the target fingerprint can be a 256-bit character string. N is a positive integer greater than or equal to 1. The target IO sequence is used to access the target data in the storage device. For example, the target IO sequence may be an IO sequence sent by the first computing device 120 in FIG. 1 to the storage device 110, and the target IO sequence is used to access the target data in the storage device 110. The target IO sequence may include at least one instruction, and each instruction in the at least one instruction is used to access the target data. For example, the at least one instruction may be any one or more of the following instructions: a read instruction, a write instruction, a delete instruction, a rename instruction, etc. The target IO sequence may also include timing information, and the timing information is used to indicate the order in which the storage device 110 executes instructions according to at least one IO sequence. When the storage device stores data based on files, the target data may belong to the file system, that is, the target data may be all or part of the data of a file in the file system, or the target data may be a directory in the file system. When the storage device stores data based on data blocks, the target data may be a data block or part of the content in the data block. Optionally, the computing device may determine the target fingerprint based on the characteristics of the target IO sequence. The characteristics of the target IO sequence include the instructions contained in the target IO sequence and / or the storage address corresponding to the target IO sequence. When the target data belongs to a file system, the at least one instruction contained in the target IO sequence may be, for example, a read instruction, a write instruction, a delete instruction, a rename instruction, etc. When the target data is a data block or part of the data in a data block, the at least one instruction contained in the target IO sequence may be, for example, a read instruction and / or a write instruction, etc. The storage address corresponding to the target IO sequence may be the storage address of the target data corresponding to the target IO sequence. The storage address may be a physical address or a logical address, which is not limited in the embodiments of the present application. When the storage address is a logical address, the storage address may be, for example, a page index or a logical block address (logical block address, LBA). Optionally, the computing device may determine the target fingerprint based on the characteristics of the target IO sequence and the characteristics of the target data. When the target data belongs to a file system, the characteristics of the target data include at least one of the following: metadata of the target data, metadata of the file system where the target data is located, and content of the target data. When the target data is a data block or part of the data in the data block, the target data includes metadata of the target data and / or content of the target data. S320: Determine the similarity between the attack fingerprint in the attack fingerprint library and the target fingerprint according to the attack fingerprint library and the target fingerprint. After the computing device determines the target fingerprint corresponding to the target IO sequence, it can compare it with the attack fingerprint contained in the attack fingerprint library to determine whether the target IO sequence is a normal IO sequence. The attack fingerprint library includes at least one attack fingerprint, and the at least one attack fingerprint is determined according to the attack IO sequence in the historical ransom attack. The historical ransom attack can be a simulated attack based on the ransom attack sample in the ransom attack sample library. Optionally, the computing device may determine the attack fingerprint library by itself, or the computing device may receive the attack fingerprint library from another device, wherein the other device is a device connected to the computing device. Optionally, the computing device may determine the similarity between the first attack fingerprint and the target fingerprint according to a similarity evaluation algorithm. The first attack fingerprint is an attack fingerprint in the attack fingerprint library. Alternatively, the computing device may determine a first similarity set between the first attack fingerprint and the target fingerprint according to at least one similarity evaluation algorithm. The first similarity set includes at least one first similarity, each first similarity being determined according to a similarity evaluation algorithm. The computing device may also determine the similarity between the first attack fingerprint and the target fingerprint according to the first similarity set. Similarity. The embodiments of the present application do not limit the specific similarity evaluation algorithm, and may include, for example, a clustering algorithm, an edit distance algorithm, a cosine similarity algorithm, and the like. S330: Determine whether the target IO sequence is a normal IO sequence or a ransomware attack IO sequence according to the similarity between the target fingerprint and the attack fingerprint. When the similarity between the target fingerprint and the first attack fingerprint is greater than or equal to the first preset threshold, the computing device can determine that the target IO sequence is a ransomware attack IO sequence. In other words, when it is determined that there is an attack fingerprint with a similarity greater than or equal to the first preset threshold with the target fingerprint, the computing device can stop calculating the similarity between the target fingerprint and other attack fingerprints in the attack fingerprint library. The other attack fingerprint is an attack fingerprint in the attack fingerprint library that has not yet calculated similarity with the target fingerprint. When the similarity between the target fingerprint and each attack fingerprint in the attack fingerprint library is less than the first preset threshold, the computing device can determine that the target IO sequence is a normal IO sequence. The embodiment of the present application does not limit the specific value of the first preset threshold, and can be set according to actual needs. For example, the first preset threshold can be 0.6, 8, 85, etc. When the computing device determines that the target IO sequence is a ransomware attack IO sequence, the computing device may also issue an alarm to prompt the user that a ransomware attack may be currently occurring. In some embodiments, the attack fingerprint library may store a storage address corresponding to the attack fingerprint. The storage address corresponding to the attack fingerprint is the storage address of the data corresponding to the attack IO sequence that determines the attack fingerprint. The storage address may be a logical address or a physical address, which is not limited in the embodiments of the present application. Alternatively, the attack fingerprint library may also include a mapping relationship between each attack fingerprint and the storage address corresponding to each attack fingerprint. The storage address corresponding to each attack fingerprint may be used to recover the attacked data corresponding to the storage address. When the computing device determines that the target IO sequence is a ransom attack IO sequence, the computing device can also directly add the target fingerprint to the attack fingerprint library. Alternatively, the computing device can also directly add the target fingerprint and the storage address corresponding to the target fingerprint to the attack fingerprint library. The storage address corresponding to the target fingerprint is the storage address corresponding to the target IO sequence. The storage address corresponding to the target fingerprint is used to recover the attacked data content. Alternatively, when the computing device determines that the similarity between the target fingerprint and the second attack fingerprint is greater than or equal to the first preset threshold, and the similarity between the target fingerprint and the second attack fingerprint is less than the second preset threshold, the computing device can add the target fingerprint to the attack fingerprint library, or can add the target fingerprint and the storage address corresponding to the target fingerprint to the attack fingerprint library. The second attack fingerprint is the attack fingerprint with the highest similarity to the target fingerprint in the attack fingerprint library. The second preset threshold is greater than the first preset threshold. In an embodiment of the present application, by determining the target fingerprint corresponding to the IO sequence in real time and comparing the target fingerprint with the attack fingerprint in the attack fingerprint library, it is possible to quickly determine whether the IO sequence is a ransomware attack IO sequence without calculating and detecting the data content corresponding to the IO sequence, thereby improving the speed of detecting ransomware attacks. FIG4 is a schematic flow chart of a method for detecting a ransomware attack provided in an embodiment of the present application. The method in FIG4 may be executed by a computing device. The computing device may be the first computing device 120 or the second computing device 130 in FIG1 . Alternatively, the computing device may be the computing device 200 in FIG2 . FIG4 includes the following steps. S410, acquiring a target IO sequence, determining a feature of the target IO sequence, or determining a feature of the target IO sequence and a feature of target data. The computing device can obtain an IO sequence for accessing data in the storage device in real time, and the IO sequence is the target IO sequence. The target IO sequence can be sent by the computing device to the storage device. Alternatively, the target IO sequence can be sent by a device other than the computing device to the storage device. The computing device may directly determine the instructions contained in the target IO sequence and / or the storage address corresponding to the target IO sequence according to the target IO sequence, that is, determine the characteristics of the target IO sequence. After determining the characteristics of the target IO sequence, the computing device may execute step S421. After determining the storage address corresponding to the target IO sequence, the computing device may also determine the target data according to the storage address corresponding to the target IO sequence. The target data is the data at the storage address corresponding to the target IO sequence. After determining the target data, the computing device may also determine the characteristics of the target data. When the target data belongs to a file system, the characteristics of the target data include at least one of the following: metadata of the target data, metadata of the file system where the target data is located, and content of the target data. When the target data is a data block or part of the data in a data block, the characteristics of the target data include metadata of the target data and / or content of the target data. After determining the characteristics of the target IO sequence and the characteristics of the target data, the computing device may execute step S422. S421, determining a target fingerprint according to characteristics of a target IO sequence. Optionally, the computing device may encode at least one feature of the target IO sequence to determine the target fingerprint. For example, the computing device may input at least one feature of the target IO sequence into a first encoding model to determine the target fingerprint. The first encoding model is used to indicate a mapping relationship between the feature of the target IO sequence and the target fingerprint. In some embodiments, the first coding model may be a model obtained through machine learning training based on a first training data set. The first training data set may include features of the IO sequence, a fingerprint, and a mapping relationship between the features of the IO sequence and the fingerprint. In some embodiments, before step S421, the computing device may obtain a first encoding model that has been trained. Before S421, the computing device may obtain a first training data set, and train a model according to the first training data set, thereby obtaining a trained first encoding model. Optionally, the computing device may determine the first vector based on at least one feature of the target IO sequence, thereby determining the target fingerprint based on the first vector. The first vector may be an N-dimensional vector, where N is a positive integer greater than or equal to 1. The N-dimensional vector may be a vector containing N columns of elements, each of which may contain one or more elements. Alternatively, the N-dimensional vector may be a vector containing N rows of elements, each of which may contain one or more elements. Each element in the first vector may include at least one character. The at least one character may include any one or more of a number, a letter, or a symbol. Exemplarily, all instructions included in the target IO sequence can be regarded as a whole, thus serving as a feature of the target IO sequence. Alternatively, each instruction included in the target IO sequence can be used as a feature of the target IO sequence alone. S422, determining a target fingerprint according to the characteristics of the target IO sequence and the characteristics of the target data. Optionally, the computing device may encode at least one feature of the target IO sequence and at least one feature of the target data to determine the target fingerprint. For example, the computing device may input at least one feature of the target IO sequence and at least one feature of the target data into a second encoding model to determine the target fingerprint. The second encoding model is used to indicate the mapping relationship between the feature of the target IO sequence, the feature of the target data, and the target fingerprint. In some embodiments, the second coding model may be a model obtained by machine learning training based on a second training data set. The second training data set may include features of the IO sequence, features of the data, fingerprints, and a mapping relationship between the features of the IO sequence, the features of the data, and the fingerprints. In some embodiments, before step S422, the computing device may obtain a trained second coding model. Alternatively, before step S422, the computing device may obtain a second training data set and train the model according to the second training data set to obtain a trained second coding model. Optionally, the computing device may determine the second vector based on at least one feature of the target IO sequence and at least one feature of the target data. The computing device may also determine the target fingerprint based on the second vector. The second vector may be an M-dimensional vector, where M is a positive integer greater than or equal to 1. The second vector may be a vector containing M column elements, each column of the M column elements may contain one or more elements. Alternatively, the second vector may be a vector containing M row elements, each row of the M row elements may contain one or more elements. Each element in the second vector may include at least one character. The at least one character may include any one or more of numbers, letters, and symbols. It should be understood that step S421 and step S422 can be performed alternatively. S430: Determine a first similarity set between the target fingerprint and the attack fingerprint in the attack fingerprint library. The computing device may determine a first similarity set between the target fingerprint and the first attack fingerprint according to at least one similarity evaluation algorithm. The first attack fingerprint is any attack fingerprint in the attack fingerprint library. The first similarity set may include first similarities determined according to each similarity evaluation algorithm. For example, the computing device may determine a first similarity set between the target fingerprint and the first attack fingerprint according to P algorithms with a complexity of O(1), such as a clustering algorithm, an edit distance algorithm, and a cosine similarity, where P is a positive integer greater than or equal to 1. The first similarity set includes P first similarities. Each of the P first similarities is determined according to a similarity evaluation algorithm. S440: Determine the similarity between the target fingerprint and the attack fingerprint according to the first similarity set. After determining the first similarity set, the computing device may also determine the similarity between the target fingerprint and the attack fingerprint based on the first similarity set. For example, the computing device may calculate at least one first similarity in the first similarity set based on a bagging algorithm and / or a boosting algorithm to determine a second similarity. The computing device may use the second similarity as the similarity between the target fingerprint and the attack fingerprint. For example, assuming that the target fingerprint is 12110200 and the first attack fingerprint is 12110201, the computing device can determine the first similarity y1 between the target fingerprint and the attack fingerprint according to the clustering algorithm. The computing device can also determine the first similarity y2 between the target fingerprint and the attack fingerprint according to the edit distance algorithm. The computing device can directly use y1 or y2 as the similarity between the target fingerprint and the first attack fingerprint. Alternatively, the computing device can calculate y1 and y2 according to the bagging algorithm, determine y3, and use y3 as the similarity between the target fingerprint and the first attack fingerprint. S450: Determine whether the target IO sequence is normal according to the similarity between the target fingerprint and the attack fingerprint. The computing device may determine whether the target IO sequence is normal by comparing the similarity between the target fingerprint and the attack fingerprint and the size of the first preset threshold. For example, the computing device may determine that the target IO sequence is a ransomware attack IO sequence when it is determined that the similarity between the target fingerprint and the first attack fingerprint is greater than or equal to the first preset threshold, and execute step S460. The first attack fingerprint is any attack fingerprint in the attack fingerprint library. The computing device may also determine that the target IO sequence is a normal IO sequence when it is determined that the similarity between the target fingerprint and each attack fingerprint in the attack fingerprint library is less than the first preset threshold. After determining that the target IO sequence is a normal IO sequence, the computing device can continue to obtain a new IO sequence to detect whether the new IO sequence is normal. That is, after determining that the target IO sequence is a normal IO sequence, the computing device can repeat steps S410 to S460 for the new target IO sequence. S460: Determine that the target IO sequence is a ransomware attack IO sequence, and issue an alarm. When the computing device determines that the similarity between the target fingerprint and the first attack fingerprint is greater than or equal to the first preset threshold, it can determine that the target IO sequence is a ransom attack IO sequence, thereby issuing an alarm to prompt the user that a ransom attack may be occurring. The computing device can determine the target fingerprint corresponding to the IO sequence in real time and compare the target fingerprint with the attack fingerprint in the attack fingerprint library, so as to quickly determine whether the IO sequence is a ransomware attack IO sequence without calculating and detecting the data content corresponding to the IO sequence, thereby improving the speed of detecting ransomware attacks. FIG. 5 is a schematic flow chart of a method for determining a target fingerprint provided by an embodiment of the present application. The method in FIG. 5 can be performed by a computing device. The computing device can be the first computing device 120 or the second computing device 130 in FIG. 1 . Alternatively, the computing device can be the computing device 200 in FIG. 2 . It should be understood that the method in FIG. 5 is only one possible implementation of step S310 or step S421. Step S310 or step S421 can also be implemented by other implementations. FIG. 5 includes the following steps. S510: Determine a first vector according to characteristics of a target IO sequence. The computing device may determine the first vector according to at least one feature of the target IO sequence. The feature of the target IO sequence includes the instructions contained in the target IO sequence and / or the storage address corresponding to the target IO sequence. The first vector may be a vector containing N columns of elements, or the first vector may be a vector containing N rows of elements. N is a positive integer greater than or equal to 1. When the first vector is a vector containing N columns of elements, each column element in the first vector may correspond to one or more features of the target IO sequence. Alternatively, one feature of the target IO sequence may correspond to one or more column elements in the first vector. When the first vector is a vector containing N rows of elements, each row element in the first vector may correspond to one or more features of the target IO sequence. Alternatively, one feature of the target IO sequence may correspond to one or more row elements in the first vector. The following description is made by taking the case where the first vector is a vector including N columns of elements as an example. It should be understood that the implementation method when the first vector includes N rows of elements is similar to that when the first vector includes N columns of elements, and for the sake of brevity, it will not be repeated. Optionally, the computing device may determine one or more columns of elements in the first vector according to the instructions included in the target IO sequence. For example, the computing device may determine the one or more columns of elements according to the first mapping relationship and the instructions included in the target IO sequence. The first mapping relationship is used to indicate the mapping relationship between the instructions included in the target IO sequence and the one or more columns of elements. When the first mapping relationship is used to indicate the mapping relationship between the instructions included in the target IO sequence and a column of elements, the first mapping relationship can be used to indicate the instruction identifier corresponding to each preset instruction. For example, assume that the first mapping relationship is as shown in Table 1 below. Table 1 First mapping relationship table If the target IO sequence includes the following instructions: read instruction, write instruction, read instruction, delete instruction, and write instruction, the computing device may determine a column of elements corresponding to the target IO sequence according to the target IO sequence and the first mapping relationship shown in Table 1. The column of elements may be [1, 2, 1, 3, 2] T . Wherein, T represents transposition. It should be understood that the embodiment of the present application does not limit the type of instruction identifier. For example, the instruction identifier may include at least one character, and the at least one character may include any one or more of numbers, letters, and symbols. When the first mapping relationship is used to indicate the mapping relationship between the instructions included in the target IO sequence and the multiple column elements, the first mapping relationship may indicate the instruction identifier corresponding to the specific instruction and the instruction identifier corresponding to other instructions except the specific instruction. For example, assume that the first mapping relationship is as shown in Table 2 below. Table 2 First mapping relationship table If the target IO sequence includes the following instructions: read instruction, write instruction, read instruction, delete instruction, and write instruction, the computing device can determine the multiple columns of elements corresponding to the target IO sequence according to the target IO sequence and the first mapping relationship shown in Table 2. Among them, the column of elements determined when the read instruction is used as the specific instruction is [1, 0, 1, 0, 0] T This column element can indicate that the target IO sequence contains 5 instructions. The first and third instructions are read instructions. Similarly, when the write instruction is used as a specific instruction, the column elements determined are [0, 1, 0, 0, 1] T The column elements can indicate that among the five instructions in the target IO sequence, the second and fifth instructions are write instructions. When the delete instruction is used as a specific instruction, the column elements determined are [0, 0, 0, 1, 0] T. This column element may indicate that among the five instructions in the target IO sequence, the fourth instruction is a delete instruction. It should be understood that the embodiment of the present application does not limit the type of instruction identifier. For example, the instruction identifier may include at least one character, and the at least one character may include any one or more of numbers, letters, and symbols. Optionally, the computing device may determine one or more columns of elements in the first vector according to the storage address corresponding to the target IO sequence. For example, the computing device may determine one or more columns of elements according to the second mapping relationship and the storage address corresponding to the target IO sequence. The second mapping relationship is used to indicate the mapping relationship between the storage address corresponding to the target IO sequence and the one or more columns of elements. The storage address corresponding to the target IO sequence may be a physical address or a logical address, which is not limited in the embodiments of the present application. For example, assume that the storage address corresponding to the target IO sequence is an LBA address, and the LBA address is 7600. The binary code corresponding to the LBA address is 1100101100100. The computing device can determine, based on the storage address corresponding to the target IO sequence and the second mapping relationship, that a column of elements corresponding to the target IO sequence is

[7600] , or the column element may be [1100101100100]. It should be understood that the column element may also be determined according to other base codes of the storage address corresponding to the target IO sequence, such as octal code, hexadecimal code, etc., which is not limited in the embodiment of the present application. Optionally, the computing device may determine one or more columns of elements in the first vector according to the instructions included in the target IO sequence and the storage address corresponding to the target IO sequence. For example, the computing device may determine one or more columns of elements according to the third mapping relationship, the instructions included in the target IO sequence and the storage address corresponding to the target IO sequence. The third mapping relationship is used to indicate the mapping relationship between the instructions included in the target IO sequence, the storage address corresponding to the target IO sequence, and the column elements. For example, if the target IO sequence includes the following instructions: read instruction, write instruction, read instruction, delete instruction, and write instruction, and the LBA address corresponding to the target IO sequence is 7600. The computing device can determine a column of elements in the first vector according to the instructions included in the target IO sequence, the LBA address corresponding to the target sequence, and the third mapping relationship. The column of elements can be [1, 2, 1, 3, 2, 7600] T In this column element, part of the data corresponds to the five instructions contained in the target IO sequence, and the other part of the data corresponds to the storage address corresponding to the target IO sequence. It should be understood that this column element can also be expressed in other forms, such as [12132, 7600] T or [7600, 1, 2, 1, 3, 2] T wait. Optionally, the computing device may determine the first vector based on the first vector generation model and at least one feature of the target IO sequence. The first vector generation model may include any one or more of the first mapping relationship, the second mapping relationship, or the third mapping relationship. Alternatively, the first vector generation model may include a mapping relationship that is more complex than the first mapping relationship, the second mapping relationship, or the third mapping relationship. The first vector generation model may be a model obtained through machine learning training based on a third training data set. The third training data set may include features of the IO sequence, vectors, and mapping relationships between the features of the IO sequence and the vectors. S520: Determine a target fingerprint according to the first vector. Optionally, after determining the first vector, the computing device may use the first vector as the target fingerprint, that is, the target fingerprint is the first vector. The first vector includes at least one column of the following elements: one or more columns of elements determined according to the instructions included in the target IO sequence and / or the storage address corresponding to the target IO sequence. Optionally, after determining the first vector, the computing device may determine the target fingerprint according to the first vector and the fourth mapping relationship. The fourth mapping relationship is used to indicate the mapping relationship between the first vector and the target fingerprint. The target fingerprint may be a string of a preset length, and the embodiment of the present application does not limit the preset length. The string of the preset length may include at least one character, and the at least one character may include any one or more of a number, a letter, and a symbol. For example, the target fingerprint may be a 256-bit string. In some embodiments, the fourth mapping relationship may be used to indicate a mapping relationship between an element in a target region in the first vector and one or more bits of data in the target fingerprint. An element in a target region may include at least one column of elements in the first vector, or may include at least one row of elements, or may include a block of elements. The embodiment of the present application does not limit the number of elements in the block of elements, for example, it may be 1, 2, 4, etc. Taking the target region including a column of elements as an example, the fourth mapping relationship can be used to indicate the mapping relationship between the elements in the target region and a bit of data of the target fingerprint. For example, if the column of elements included in the target region is [0, 0, 0, 1, 0] T , the computing device can determine that a bit of data in the target fingerprint corresponding to the element included in the target area is 2 according to the element included in the target area and the fourth mapping relationship. Taking the target region including a column of elements as an example, the fourth mapping relationship can be used to indicate the mapping relationship between the elements in the target region and the multi-bit data of the target fingerprint. For example, if the column of elements included in the target region is [1, 0, 1, 0, 0] T, the computing device can determine that a bit of data in the target fingerprint corresponding to the element included in the target area is 20 according to the element included in the target area and the fourth mapping relationship. It should be understood that the method of determining the target fingerprint when the target area includes a row of elements or a block of elements is similar to the above method, and will not be repeated for the sake of brevity. Exemplarily, when the first vector includes data of letter or symbol type, the computing device may convert the data of letter or symbol type into data of digital type, thereby determining the target fingerprint according to the first vector. For example, the computing device may convert the data of letter or symbol type into the corresponding American standard code for information interchange (ASCII). Alternatively, the computing device may convert the data of letter or symbol type into digital data corresponding to the preset coding rule according to the preset coding rule. Alternatively, the computing device may convert the digital data in the first vector into data of letter or symbol type, thereby determining the target fingerprint according to the first vector. Optionally, the computing device may determine the target fingerprint according to the first fingerprint generation model and the first vector. The first fingerprint generation model may include a fourth mapping relationship, or may include a mapping relationship that is more complex than the fourth mapping relationship. The first fingerprint generation model may be a model obtained through machine learning training based on a fourth training data set. The fourth training data set may include a vector, a fingerprint, and a mapping relationship between the vector and the fingerprint. In the embodiment of the present application, considering that the instructions contained in the ransom attack IO sequence and / or the storage address corresponding to the ransom attack IO sequence have some special characteristics compared with the normal IO sequence, the computing device can determine the first vector according to the instructions contained in the target IO sequence and / or the storage address corresponding to the target IO sequence, thereby determining the target fingerprint. The target fingerprint can be used to compare with the attack fingerprint in the attack fingerprint library, thereby realizing the detection of the ransom attack. FIG6 is a schematic flow chart of a method for determining a target fingerprint provided by an embodiment of the present application. The method in FIG6 can be performed by a computing device. The computing device can be the first computing device 120 or the second computing device 130 in FIG1 . Alternatively, the computing device can be the computing device 200 in FIG2 . It should be understood that the method in FIG6 is only one possible implementation of step S310 or step S422. Step S310 or step S422 can also be implemented by other implementations. FIG6 includes the following steps. S610, determining a first vector according to characteristics of a target IO sequence and characteristics of target data. The computing device may determine the second vector according to at least one feature of the target IO sequence and at least one feature of the target data. The feature of the target IO sequence includes instructions included in the target IO sequence and / or a storage address corresponding to the target IO sequence. When the target data belongs to a file system, the characteristics of the target data may include at least one of the following: metadata of the target data, metadata of the file system where the target data is located, and content of the target data. The target data may be a target file, part of the content in a target file, or a target directory. The metadata of the target data is used to describe the properties of the target data. When the target data is a target file, the metadata of the target data may include, for example, at least one of the following: the size of the target data, the name of the target data, the type of the target data, the time information of the target data, the permission information of the target data, etc. The type of the target data may be represented by the extension (i.e., suffix) and / or magic number of the target data. The time information of the target data may include, for example, at least one of the following: the creation time of the target data, the last modification time of the target data, and the last access time of the target data. The metadata of the file system where the target data is located includes, for example, at least one of the following: the identification information of the target data in the file system, and the identification information of the directory where the target data is located in the file system. When the target data is part of the content in the target file, the metadata of the target data is the metadata of the target file where the target data is located, and the metadata of the file system where the target data is located is the metadata of the file system where the target file is located. When the target data is a target directory, the metadata of the target data may include, for example, at least one of the following: the name of the target data, the time information of the target data, the permission information of the target data, etc. The time information of the target data may include, for example, at least one of the following: the creation time of the target data, the last modification time of the target data, and the last access time of the target data. The metadata of the file system where the target data is located includes the identification information of the target directory in the file system. When the target data is a data block or part of the data in the data block, the characteristics of the target data include metadata of the target data and / or content of the target data. The target data may be a data block or part of the content in the data block. When the target data is a data block, the metadata of the target data includes at least one of the following: pool metadata, logical unit number (logical unit number, LUN) identification information (identity, ID), LBA address, time information. The time information may include at least one of the following: creation time of the target data, last modification time of the target data, last access time of the target data. When the target data is part of the content in the data block, the metadata of the target data is the metadata of the data block where the target data is located. The second vector may be a vector including M column elements, or the second vector may be a vector including M row elements. M is a positive integer greater than or equal to 1. The embodiment of the present application does not limit the size relationship between N and M. When the second vector is a vector containing M columns of elements, each column element in the second vector may correspond to one or more features, and the one or more features are features of the target IO sequence and / or the target data. Alternatively, a feature of the target IO sequence may correspond to one or more column elements in the second vector, and a feature of the target data may correspond to one or more column elements in the second vector. Alternatively, when the second vector is a vector containing M rows of elements, each row element in the second vector may correspond to one or more features, and the one or more features are features of the target IO sequence and / or the target data. Alternatively, a feature of the target IO sequence may correspond to a row in the second vector. One feature of the target data may correspond to one or more rows of elements in the second vector. The following description is made by taking the second vector as a vector including M columns of elements as an example. It should be understood that the implementation method when the second vector includes M rows of elements is similar to that when the second vector includes M columns of elements, and for the sake of brevity, it will not be repeated. Optionally, the computing device may determine one or more columns of elements in the second vector according to the metadata of the target data. For example, the computing device may determine one or more columns of elements according to the fifth mapping relationship and the metadata of the target file. The fifth mapping relationship is used to indicate a mapping relationship between the metadata of the target data and one or more columns of elements. For example, the fifth mapping relationship may be used to indicate a mapping relationship between one type of metadata of the target data and one or more columns of elements, or may be used to indicate a mapping relationship between multiple types of metadata of the target data and one or more columns of elements. For example, assuming that the size of the target data is 1.2 megabytes (MB), the computing device can determine that a column of elements is [1.2] based on the size of the target data and the fifth mapping relationship. Assuming that the name of the target data is "test1", the computing device can determine that a column of elements is [test1] based on the name of the target data and the fifth mapping relationship. Assuming that the fifth mapping relationship indicates that the type of the file is a portable document format (PDF), the corresponding element is 4. If the type of the target data is PDF, the computing device can determine that a column of elements is [4] based on the type of the target data and the fifth mapping relationship. Assuming that the last access time of the target data is June 29, 2023, the computing device can determine that a column of elements is [20330629] based on the name of the target data and the fifth mapping relationship. Assuming that the corresponding element when the fifth mapping relationship indicates that the permission information of the file is read-only is or. If the permission information of the target data is read-only, the computing device can determine that a column of elements is [or] based on the permission information of the target data and the fifth mapping relationship. Assuming that the LUN identification information of the target data is 1, the computing device can determine that a column of elements is [1] according to the LUN identification information of the target data and the fifth mapping relationship. For example, assuming that the size of the target data is 1.2MB, the name of the target data is "test1", and the type of the target data is PDF. The computing device can determine that a column of elements is [1.2, test1, 4] according to the size, name, type and fifth mapping relationship of the target data. T Alternatively, the computing device may determine two columns of elements, [1.2, test1] T and [4]. Alternatively, the computing device may determine three columns of elements, namely [1.2], [test1], and [4]. It should be understood that the computing device may also determine one or more columns of elements in other forms, such as [test1, 4, 1.2] T , [1.2, 4] T and [test1], etc., which are not limited in the embodiments of the present application. Optionally, the computing device may determine one or more columns of elements in the second vector according to the metadata of the file system where the target data is located. For example, the computing device may determine one or more columns of elements according to the sixth mapping relationship and the metadata of the file system. The sixth mapping relationship is used to indicate the mapping relationship between the metadata of the file system and one or more columns of elements. For example, the sixth mapping relationship may be used to indicate the mapping relationship between one type of metadata of the file system and a column of elements, or may be used to indicate the mapping relationship between multiple types of metadata of the file system and a column of elements. For example, suppose that the identification information of the target data in the file system is 115, and the identification information of the directory where the target data is located in the file system is 13. The computing device may determine a column of elements as

[0115] based on the identification information of the target data in the file system and the sixth mapping relationship. Alternatively, the computing device may determine a column of elements as

[0013] based on the identification information of the directory where the target data is located in the file system and the sixth mapping relationship. Alternatively, the computing device may determine two columns of elements as

[0115] and

[0013] , respectively, or determine a column of elements as [115, 13] based on the identification information of the target data in the file system and the identification information of the directory where the target data is located in the file system and the sixth mapping relationship. T . Optionally, the computing device may determine one or more columns of elements in the second vector according to the content of the target data. For example, the computing device may determine the entropy value of the content of the target data according to the content of the target data, thereby determining one or more columns of elements according to the entropy value of the content of the target data. The entropy value may be information entropy, relative entropy, cross entropy, etc., which is not limited in the embodiments of the present application. In some embodiments, the computing device may determine an entropy value based on the overall content of the target data, and determine one or more columns of elements in the second vector based on the entropy value. Alternatively, the computing device may divide the content of the target data into multiple parts, and determine the entropy value of each part respectively, thereby determining one or more columns of elements in the second vector. For example, assuming that the entropy value of the target data is 2.2836, the computing device can determine a column of elements as [2.2836] based on the target data. Alternatively, assuming that the target data can be divided into two parts, the entropy value of the first part is 3.4528, and the entropy value of the second part is 2.4002. The computing device can determine a column of elements as [3.4528, 2.4002] based on the two parts of the target data. T Alternatively, the computing device may determine two columns of elements, [3.4528] and [2.4002], based on the contents of the two parts of the target data. It should be understood that the contents of the target data may also be divided into three or more parts, each of which may correspond to an entropy value, thereby determining one or more columns of elements based on the entropy value of each part. Optionally, the computing device may determine one or more columns of elements in the second vector according to at least two of the metadata of the target data, the metadata of the file system, or the content of the target data. For example, the computing device may determine one or more columns of elements according to at least two of the metadata of the target data, the metadata of the file system, or the content of the target data and a seventh mapping relationship. The seventh mapping relationship is used to indicate a mapping relationship between at least two of the metadata of the target data, the metadata of the file system, or the content of the target data and one or more columns of elements. For example, assuming that the size of the target data is 1.2MB, the identification information of the target data in the file system is 115, and the entropy value that can be determined based on the content of the target data is 2.2836, the computing device can determine that a column of elements is [1.2, 115, 2.2836] based on the size of the target data, the identification information of the target data in the file system, the content of the target data and the seventh mapping relationship. T The three parts in the column element correspond to the size of the target data, the identification information of the target data in the file system, and the content of the target data. Alternatively, the computing device can determine two column elements, namely [1.2, 115] T and [2.2836]. Among them, [1.2, 115] T The elements in correspond to the size of the target data and the identification information of the target data in the file system, respectively, and [2.2836] corresponds to the content of the target data. Alternatively, the computing device may determine three columns of elements, namely [1.2],

[0115] , and [2.2836]. The three columns of elements correspond to the size of the target data, the identification information of the target data in the file system, and the content of the target data, respectively. Optionally, the computing device may determine one or more columns of elements in the second vector according to the characteristics of the target IO sequence and the characteristics of the target data. For example, the computing device may determine one or more columns of elements according to the eighth mapping relationship, the characteristics of the target IO sequence and the characteristics of the target data. The eighth mapping relationship is used to indicate the mapping relationship between the characteristics of the target IO sequence, the characteristics of the target data, and one or more columns of elements. For example, assuming that the target IO sequence includes instructions: read instruction, write instruction, read instruction, delete instruction and write instruction, and the size of the target data is 1.2MB, the computing device can input the instructions and the size of the target data included in the target IO sequence into the eighth mapping relationship, thereby determining a column of elements as [1.2, 1, 2, 1, 3, 2]. T A portion of the elements in the column (for example, the first data) corresponds to the size of the target data, and another portion of the elements in the column corresponds to the instructions contained in the target IO sequence. Alternatively, the computing device may determine two columns of elements, namely [1, 2, 1, 3, 2] Tand [1.2]. Among them, [1, 2, 1, 3, 2] T Corresponding to the instructions contained in the target IO sequence, [1.2] corresponds to the size of the target data. Optionally, the computing device may determine the second vector based on a second vector generation model, at least one feature of the target IO sequence, and at least one feature of the target data. The second vector generation model may include any one or more of the fifth to eighth mapping relationships. Alternatively, the second vector generation model may include a mapping relationship that is more complex than any of the fifth to eighth mapping relationships. The second vector generation model may be a model obtained through machine learning training based on a fifth training data set. The fifth training data set may include features of the IO sequence, features of the data, vectors, and mapping relationships between features of the IO sequence, features of the data, and vectors. S620, determining the target fingerprint according to the second vector. The implementation of step S620 is similar to the implementation of step S520, and will not be described here for brevity. In the embodiment of the present application, considering that the characteristics of the ransom attack IO sequence have special characteristics compared with the characteristics of the normal IO sequence, and the characteristics of the data corresponding to the ransom attack IO sequence also have special characteristics compared with the characteristics of the data corresponding to the normal IO sequence, the computing device can determine the second vector according to the characteristics of the target IO sequence and the characteristics of the target data, thereby determining the target fingerprint. The target fingerprint can be used to compare with the attack fingerprint in the attack fingerprint library, thereby realizing the detection of the ransom attack. FIG. 7 is a schematic flow chart of a method for determining an attack fingerprint provided by an embodiment of the present application. The method in FIG. 7 may be performed by a computing device. The computing device may be the first computing device 120 or the second computing device 130 in FIG. 1 . Alternatively, the computing device may be the computing device 200 in FIG. 2 . The method in FIG. 7 includes the following steps. S710: Determine a first attack IO sequence according to a first ransomware attack sample in a ransomware attack sample library. The computing device may attack the storage device according to the first ransom attack sample in the ransom attack sample library, thereby determining at least one attack IO sequence. The ransom attack sample library includes at least one ransom attack sample, and the first ransom attack sample is a ransom attack sample in the ransom attack sample library. Each ransom attack sample in the at least one ransom attack sample may be a known ransom attack virus. The first attack IO sequence is an attack IO sequence in the at least one attack IO sequence. The storage device stores data, and the storage device is connected to the computing device. When the computing device attacks the storage device according to the first ransom attack sample, the computing device may send at least one attack IO sequence to the storage device. For example, when the first computing device 120 in FIG. 1 attacks the storage device 110 according to the first ransom attack sample, the first computing device 120 may send at least one attack IO sequence to the storage device 110. The at least one attack IO sequence is used to access data in the storage device 110. The attack IO sequence may include at least one instruction, each instruction being used to access data in the storage device 110. The at least one instruction may be, for example, a read instruction, a write instruction, a delete instruction, a rename instruction, etc. S720: Determine a first attack fingerprint according to the first attack IO sequence. After determining at least one attack IO sequence, the computing device may determine an attack fingerprint according to each attack IO sequence. That is, the computing device may determine a first attack fingerprint according to the first attack IO sequence. The method of determining the first attack fingerprint according to the first attack IO sequence is similar to the method of determining the target fingerprint according to the target IO sequence, that is, the implementation method of step S720 is similar to that of step S310, and for the sake of brevity, it will not be repeated here. Optionally, the computing device may directly determine the instructions included in the first attack IO sequence and / or the storage address corresponding to the first attack IO sequence according to the first attack IO sequence, that is, determine the characteristics of the first attack IO sequence. The computing device may determine the first attack fingerprint according to the characteristics of the first attack IO sequence. The specific implementation method is similar to step S421 and will not be repeated here. Optionally, the computing device may determine the attacked data according to the storage address corresponding to the first attack IO sequence. The data at the storage address corresponding to the first attack IO sequence is the attacked data. The computing device may also determine the characteristics of the attacked data, and determine the first attack fingerprint according to the characteristics of the first attack IO sequence and the characteristics of the attacked data. The specific implementation method is similar to step S422 and will not be repeated here. Optionally, after the computing device determines the first attack fingerprint, step S730 may be executed. S730: Establish an attack fingerprint library according to the first attack fingerprint. The computing device may store the first attack fingerprint, thereby establishing an attack fingerprint library. The attack fingerprint library may store at least one attack fingerprint. The method of establishing an attack fingerprint library by using a known ransomware attack sample to simulate an attack may enable the computing device to more accurately and quickly determine whether the target IO sequence is normal when facing a known ransomware attack, thereby shortening the detection time and improving the detection accuracy. Optionally, the computing device may also store the storage address corresponding to each attack fingerprint in the attack fingerprint library. The storage address corresponding to each attack fingerprint is the storage address corresponding to the attack IO sequence that determines the attack fingerprint, and the storage address corresponding to each attack fingerprint is used to recover the attacked data content. The storage address may be a physical address or a logical address, which is not limited in the embodiments of the present application. The embodiment of the present application does not limit the specific storage method of the attack fingerprint library. For example, the computing device can store the attack fingerprint library in the form of an array, a matrix, a table, etc. Alternatively, the computing device can store the attack fingerprint library in the form of a key-value pair. The key in the key-value pair corresponds to the attack fingerprint, and the value in the key-value pair corresponds to the storage address corresponding to the attack fingerprint. For example, the attack fingerprint library can be stored in the form of Table 3. Table 3 Attack fingerprint library As shown in Table 3, the storage address corresponding to attack fingerprint 1 is storage address 1, and the storage address corresponding to attack fingerprint 2 is storage address 3. Moreover, attack fingerprint 1 and storage address 1 are a pair of key-value pairs, and attack fingerprint 2 and storage address 2 are a pair of key-value pairs. Optionally, when the computing device detects that the target IO sequence is a ransomware attack IO sequence, the computing device may add the target fingerprint to the attack fingerprint library, thereby expanding the attack fingerprint library. The computing device can simulate attacks by using the ransom attack samples in the ransom attack sample library, thereby determining at least one attack IO sequence in the attack process of each ransom attack sample, and determining the attack fingerprint according to the attack IO sequence, and then constructing an attack fingerprint library for comparison with the target fingerprint. The computing device can also determine the target fingerprint corresponding to the IO sequence in real time, and compare the target fingerprint with the attack fingerprint in the attack fingerprint library, so as to relatively quickly determine whether the IO sequence is a ransom attack IO sequence, without calculating and detecting the data content corresponding to the IO sequence, thereby improving the speed of detecting ransom attacks. FIG8 is a schematic structural block diagram of a computing device provided in an embodiment of the present application. The computing device 800 in FIG8 includes a determination module 810 and a processing module 820 . The determination module 810 can be used to determine the target fingerprint according to the target IO sequence. The determination module 810 can execute step S310 in the method of FIG. 3 , steps S410 , S421 , S422 in the method of FIG. 4 , the method in FIG. 5 , and the method in FIG. 6 . In some embodiments, the determination module 810 may also be used to determine an attack fingerprint library and execute steps S710 - S730 in FIG. 7 . The processing module 820 can determine the similarity between the attack fingerprint in the attack fingerprint library and the target fingerprint according to the attack fingerprint library and the target fingerprint. The processing module 820 can also determine whether the target IO sequence is a normal IO sequence or a ransom attack IO sequence according to the similarity between the target fingerprint and the attack fingerprint. The processing module 820 can execute steps S320 and S330 in FIG. 3 and steps S430-S460 in FIG. 4. Fig. 9 is a block diagram of a computing device according to an embodiment of the present application. The computing device 900 shown in Fig. 9 includes: a processor 901, a memory 902 and a communication interface 903, and the processor 901, the memory 902 and the communication interface 903 communicate with each other via a bus 904. In some embodiments, the computing device 900 may further include a receiver and / or a transmitter. The receiver is used to receive information or data from other devices, and the transmitter is used to send information or data stored in the memory 902 to other devices. The other devices are devices connected to the computing device 900. The method disclosed in the above embodiment of the present invention can be applied to the processor 901, or implemented by the processor 901. The processor 901 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), or other processors. Processor, DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general processor can be a microprocessor or any conventional processor, etc. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 901. The processor 901 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present invention. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in the memory 902. The processor 901 reads the instructions in the memory 902 and completes the steps of the above method in combination with its hardware. The memory 902 can store instructions for executing the method performed by the computing device in the above-mentioned embodiment. The memory 902 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a ROM, a PROM, an EPROM, an EEPROM or a flash memory. The volatile memory can be a RAM, which is used as an external cache. By way of exemplary but not limiting explanation, many forms of RAM are available, such as SRAM, DRAM, SDRAM, DDR SDRAM, ESDRAM, SLDRAM and DRDRAM. It should be noted that the memory of the system and method described herein is intended to include but is not limited to these and any other suitable types of memory. The processor 901 can execute the instructions stored in the memory 902, and complete the steps of the computing device in the above-mentioned embodiment in combination with other hardware, and the specific working process and beneficial effects can refer to the description in the above-mentioned embodiment. In addition to the data bus, the bus 904 may also include a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are labeled as the bus 904 in the figure. An embodiment of the present application further provides a computer storage medium in which program instructions are stored. When the program is executed, the program may include some or all of the steps of the method in the corresponding embodiments of Figures 3 to 7. An embodiment of the present application also provides a chip system, which includes a logic circuit, which is used to couple with an input / output interface and transmit data through the input / output interface to execute the various steps included in Figures 3 to 7 in the above embodiment. According to the method provided in the embodiments of the present application, the present application also provides a computer program product, which includes: a computer program code, when the computer program code is run on a computer, the computer executes each step in the above embodiments. According to the method provided in the embodiments of the present application, the present application also provides a computer-readable medium, which stores a program code. When the program code runs on a computer, the computer executes each step in the above embodiments. Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here. In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk. The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for detecting a ransomware attack, characterized in that: include: Determine a target fingerprint according to a target input and output IO sequence, wherein the target IO sequence is used to access target data; Determine the similarity between the attack fingerprint in the attack fingerprint library and the target fingerprint according to the attack fingerprint library and the target fingerprint, wherein the attack fingerprint library includes at least one attack fingerprint, and the attack fingerprint is determined according to the attack IO sequence in the historical ransomware attack; According to the similarity, it is determined that the target IO sequence is a normal IO sequence or a ransomware attack IO sequence.

2. The method according to claim 1, characterized in that Determining the target fingerprint according to the target input and output IO sequence includes: The target fingerprint is determined according to the characteristics of the target IO sequence, wherein the characteristics of the target IO sequence include instructions contained in the target IO sequence and / or a storage address corresponding to the target IO sequence, and the target IO sequence includes at least one instruction, and the at least one instruction is used to access the target data.

3. The method according to claim 1 or 2, characterized in that: Determining the target fingerprint according to the target input and output IO sequence includes: The target fingerprint is determined according to the characteristics of the target IO sequence and the characteristics of the target data, wherein: When the target data belongs to a file system, the characteristics of the target data include at least one of the following: metadata of the target data, metadata of the file system, and content of the target data; When the target data is a data block or partial data in the data block, the characteristics of the target data include metadata of the target data and / or content of the target data.

4. The method according to claim 3, characterized in that: The metadata of the file system includes at least one of the following: identification information of the target data in the file system, and identification information of the directory where the target data is located in the file system.

5. The method according to claim 3 or 4, characterized in that: The determining the target fingerprint according to the characteristics of the target IO sequence and the characteristics of the target data includes: Determining an entropy value of the content of the target data according to the content of the target data; The target fingerprint is determined according to the characteristics of the target IO sequence and the entropy value of the content of the target data.

6. The method according to any one of claims 1 to 5, characterized in that Determining the target fingerprint according to the target input and output IO sequence includes: At least one feature of the target IO sequence is encoded to determine the target fingerprint.

7. The method according to claim 6, characterized in that The step of encoding at least one feature of the target IO sequence to determine the target fingerprint includes: Determining a first vector according to at least one feature of the target IO sequence; The target fingerprint is determined according to the first vector.

8. The method according to any one of claims 3 to 5, characterized in that The determining the target fingerprint according to the characteristics of the target IO sequence and the characteristics of the target data includes: At least one feature of the target IO sequence and at least one feature of the target data are encoded to determine the target fingerprint.

9. The method according to claim 8, characterized in that The step of encoding at least one feature of the target IO sequence and at least one feature of the target data to determine the target fingerprint includes: Determining a second vector according to at least one feature of the target IO sequence and at least one feature of the target data; The target fingerprint is determined according to the second vector.

10. The method according to any one of claims 1 to 9, characterized in that The determining, according to the similarity, whether the target IO sequence is a normal IO sequence or a ransomware attack IO sequence includes: If the similarity between the target fingerprint and the first attack fingerprint is greater than or equal to a first preset threshold, determining that the target IO sequence is a ransomware attack IO sequence, and the first attack fingerprint is one of the at least one attack fingerprint; If the similarity between the target fingerprint and each of the at least one attack fingerprint is less than the first preset threshold, it is determined that the target IO sequence is a normal IO sequence.

11. The method according to any one of claims 1 to 10, characterized in that The attack fingerprint library also includes a storage address corresponding to each attack fingerprint.

12. The method according to claim 11, characterized in that The attack fingerprint library is stored in the form of key-value pairs, the key in the key-value pair corresponds to the attack fingerprint, and the value in the key-value pair corresponds to the storage address corresponding to the attack fingerprint.

13. The method according to any one of claims 1 to 12, characterized in that The method further comprises: When it is determined that the target IO sequence is a ransomware attack IO sequence, the target fingerprint is added to the attack fingerprint library.

14. The method according to claim 13, characterized in that Before adding the target fingerprint into the attack fingerprint library, the method further includes: Determine that a similarity between a second attack fingerprint and the target fingerprint is less than a second preset threshold, wherein the second attack fingerprint is an attack fingerprint having the highest similarity with the target fingerprint among the at least one attack fingerprint, and the second preset threshold is greater than the first preset threshold.

15. The method according to any one of claims 1 to 14, characterized in that The method further comprises: Determine a first attack IO sequence according to a first ransom attack sample in a ransom attack sample library, where the first ransom attack sample is a ransom attack sample in the ransom attack sample library; A first attack fingerprint is determined according to the first attack IO sequence, where the first attack fingerprint is one of the at least one attack fingerprint.

16. The method according to any one of claims 1 to 15, characterized in that The target fingerprint and / or the attack fingerprint is a character string of a preset length.

17. A computing device, characterized in that: include: A determination module, used to determine a target fingerprint according to a target input and output IO sequence, wherein the target IO sequence is used to access target data; A processing module, configured to determine, according to an attack fingerprint library and the target fingerprint, a similarity between an attack fingerprint in the attack fingerprint library and the target fingerprint, wherein the attack fingerprint library includes at least one attack fingerprint, and the attack fingerprint is determined according to an attack IO sequence in a historical ransomware attack; The processing module is further used to determine, based on the similarity, whether the target IO sequence is a normal IO sequence or a ransomware attack IO sequence.

18. The device according to claim 17, characterized in that The determination module is specifically used for: The target fingerprint is determined according to the characteristics of the target IO sequence, wherein the characteristics of the target IO sequence include instructions contained in the target IO sequence and / or a storage address corresponding to the target IO sequence, and the target IO sequence includes at least one instruction, and the at least one instruction is used to access the target data.

19. The device according to claim 17 or 18, characterized in that The determination module is specifically used for: The target fingerprint is determined according to the characteristics of the target IO sequence and the characteristics of the target data, wherein: When the target data belongs to a file system, the characteristics of the target data include at least one of the following: metadata of the target data, metadata of the file system, and content of the target data; When the target data is a data block or partial data in the data block, the characteristics of the target data include metadata of the target data and / or content of the target data.

20. The device according to claim 19, characterized in that The metadata of the file system includes at least one of the following: identification information of the target data in the file system, and identification information of the directory where the target data is located in the file system.

21. The device according to claim 19 or 20, characterized in that The determination module is specifically used for: Determining an entropy value of the content of the target data according to the content of the target data; The target fingerprint is determined according to the characteristics of the target IO sequence and the entropy value of the content of the target data.

22. The device according to any one of claims 17 to 21, characterized in that The determination module is specifically configured to encode at least one feature of the target IO sequence to determine the target fingerprint.

23. The device according to claim 22, characterized in that The determination module is specifically used for: Determining a first vector according to at least one feature of the target IO sequence; The target fingerprint is determined according to the first vector.

24. The device according to any one of claims 19 to 21, characterized in that The determination module is specifically configured to encode at least one feature of the target IO sequence and at least one feature of the target data to determine the target fingerprint.

25. The device according to claim 24, characterized in that The determination module is specifically used for: Determining a second vector according to at least one feature of the target IO sequence and at least one feature of the target data; The target fingerprint is determined according to the second vector.

26. The device according to any one of claims 17 to 25, characterized in that The processing module is specifically used for: If the similarity between the target fingerprint and the first attack fingerprint is greater than or equal to a first preset threshold, determining that the target IO sequence is a ransomware attack IO sequence, and the first attack fingerprint is one of the at least one attack fingerprint; If the similarity between the target fingerprint and each of the at least one attack fingerprint is less than the first preset threshold, it is determined that the target IO sequence is a normal IO sequence.

27. The device according to any one of claims 17 to 26, characterized in that The attack fingerprint library also includes a storage address corresponding to each attack fingerprint.

28. The device according to claim 27, characterized in that The attack fingerprint library is stored in the form of key-value pairs, the key in the key-value pair corresponds to the attack fingerprint, and the value in the key-value pair corresponds to the storage address corresponding to the attack fingerprint.

29. The device according to any one of claims 17 to 28, characterized in that The processing module is used to add the target fingerprint to the attack fingerprint library when it is determined that the target IO sequence is a ransomware attack IO sequence.

30. The device according to claim 29, characterized in that Before adding the target fingerprint to the attack fingerprint library, the processing module is further used to determine that the similarity between a second attack fingerprint and the target fingerprint is less than a second preset threshold, wherein the second attack fingerprint is the attack fingerprint with the highest similarity to the target fingerprint among the at least one attack fingerprint, and the second preset threshold is greater than the first preset threshold.

31. The device according to any one of claims 17 to 30, characterized in that The determining module is further used for: Determine a first attack IO sequence according to a first ransom attack sample in a ransom attack sample library, where the first ransom attack sample is a ransom attack sample in the ransom attack sample library; A first attack fingerprint is determined according to the first attack IO sequence, where the first attack fingerprint is one of the at least one attack fingerprint.

32. The device according to any one of claims 17 to 31, characterized in that The target fingerprint and / or the attack fingerprint is a character string of a preset length.

33. A computing device, characterized in that include: A processor, wherein the processor is coupled to a memory, and is configured to read and execute instructions and / or program codes in the memory to perform the method according to any one of claims 1 to 16.

34. A chip system, characterized in that: include: A logic circuit, the logic circuit is used to be coupled to an input / output interface, and transmit data through the input / output interface to execute the method according to any one of claims 1 to 16.

35. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program code, and when the program code is executed on a computer, the computer is caused to perform the method according to any one of claims 1 to 16.

Images