Apparatus and method for detecting ransomware attacks by using artificial intelligence-based analysis

Abstract

The present invention relates to an apparatus and a method for detecting ransomware attacks by using artificial intelligence-based analysis and, more specifically, to an apparatus and a method involving: extracting, from data to be analyzed, a plurality of blocks having variable block sizes according to the number, positions, and directions of offsets so as to classify the blocks into incomplete blocks and complete blocks according to a data length of each block; dividing each of the classified incomplete blocks and complete blocks and the entire block into a plurality of segments having variable segment sizes to extract characteristic values; on the basis of the characteristic values of the segments corresponding to the entire block, the incomplete blocks, and the complete blocks, respectively, generating a plurality of detection models through artificial intelligence learning to determine data infected by ransomware attacks and data not infected; and detecting, by using the plurality of detection models, whether data is infected by ransomware attacks.

Description

Device for detecting ransomware attacks using artificial intelligence-based analysis and method therefor

[0001] The present invention relates to ransomware attack detection, and more particularly, to a device for detecting ransomware attacks using artificial intelligence-based analysis and a method therefor.

[0002] In the case of ransomware variant attacks, since the entire file is not encrypted, but rather the ransomware detection system is bypassed through intermittent encryption, it is difficult to detect ransomware using methods based on the analysis of data characteristics of conventional ciphertext or plaintext.

[0003] [Patent Document]

[0004] Korean Patent Publication No. 2021-0017142 (published on February 17, 2021)

[0005] The purpose of the present invention is to provide a device and method for detecting ransomware attacks using artificial intelligence-based analysis.

[0006] The method for detecting a ransomware attack of the present invention includes a step in which a data processing unit extracts a plurality of blocks by applying offsets to data to be analyzed according to a number of offsets, a step in which the data processing unit classifies the extracted blocks into incomplete blocks, which are blocks in which data is not filled to the size of the block, and complete blocks, which are blocks in which data is filled to the size of the block, a step in which the data processing unit divides each of a full block, an incomplete block, and a complete block from the extracted plurality of blocks into a plurality of segments, a step in which the data processing unit extracts a characteristic value from each of the full blocks, incomplete blocks, and complete blocks divided into a plurality of segments, and a step in which a detection unit analyzes the extracted characteristic value using at least one of a plurality of detection models depending on whether the classified block is an incomplete block or a complete block, thereby detecting whether the data is infected with ransomware.

[0007] The step of detecting whether the above data is infected with ransomware is characterized in that, if the classified block is an incomplete block, the detection unit detects whether the data is infected with ransomware by using at least one of a first detection model that distinguishes between infected data and non-infected data based on a characteristic value of a segment of the entire block and a second detection model that distinguishes between infected data and non-infected data based on a characteristic value of a segment of the incomplete block.

[0008] The step of detecting whether the above data is infected with ransomware is characterized in that, if the classified block is a complete block, the detection unit detects whether the data is infected with ransomware by using at least one of a first detection model that distinguishes between infected data and non-infected data based on a characteristic value of a segment of the entire block, and a third detection model that distinguishes between infected data and non-infected data based on a characteristic value of a segment of the complete block.

[0009] It is characterized in that at least one of the number, position and direction of the offsets, the size of the block corresponding to the offsets and the size of the segment corresponding to the block are set to be variable.

[0010] The method further includes, before the step of extracting the block, a step of loading a plurality of training data including ciphertext data, which is data infected by ransomware, and plaintext data, which is data that is not infected, by a data preparation unit; a step of extracting blocks by applying offsets to the plurality of training data according to a number of offsets by the data preparation unit; a step of classifying the plurality of blocks into incomplete blocks, which are blocks in which data is not filled to the size of the block, and complete blocks, which are blocks in which data is filled to the size of the block; a step of dividing each block into a plurality of segments according to full blocks, incomplete blocks, and complete blocks of the plurality of blocks; a step of extracting feature values ​​from blocks divided into a plurality of segments by the data preparation unit; a step of storing the extracted feature values ​​as training data by dividing them according to plaintext data and ciphertext data; and a step of generating a plurality of detection models that distinguish infected data and non-infected data through training by the training data.

[0011] The step of generating the above plurality of detection models includes a step in which the learning unit generates a first detection model that distinguishes between infected data and non-infected data according to characteristic values ​​of segments of an entire block, a step in which the learning unit generates a second detection model that distinguishes between infected data and non-infected data according to characteristic values ​​of segments of an incomplete block, and a step in which the learning unit generates a third detection model that distinguishes between infected data and non-infected data according to characteristic values ​​of segments of a complete block.

[0012] The device for detecting a ransomware attack of the present invention includes a data processing unit that extracts a plurality of blocks by applying an offset to data to be analyzed according to the number of offsets, classifies the extracted blocks into incomplete blocks, which are blocks in which data is not filled to the size of the block, and complete blocks, which are blocks in which data is filled to the size of the block, divides each of the entire blocks, the incomplete blocks, and the complete blocks from the extracted plurality of blocks into a plurality of segments, and extracts a characteristic value from each of the entire blocks, the incomplete blocks, and the complete blocks divided into the plurality of segments, and a detection unit that analyzes the extracted characteristic value using at least one of a plurality of detection models according to whether the classified block is an incomplete block or a complete block, thereby detecting whether the data is infected with ransomware.

[0013] The detection unit is characterized in that, if the classified block is an incomplete block, it detects whether the data is infected with ransomware by using at least one of a first detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the entire block and a second detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the incomplete block.

[0014] The detection unit is characterized in that, if the classified block is a complete block, it detects whether the data is infected with ransomware by using at least one of a first detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the entire block, and a third detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the complete block.

[0015] It is characterized in that at least one of the number, position and direction of the offsets, the size of the block corresponding to the offsets and the size of the segment corresponding to the block are set to be variable.

[0016] The device further includes a data preparation unit that loads a plurality of training data including encrypted data, which is data infected by ransomware, and plaintext data, which is data that is not infected, and extracts blocks by applying offsets to the plurality of training data according to the number of offsets, classifies the plurality of blocks into incomplete blocks, which are blocks in which data is not filled to the size of the block, and complete blocks, which are blocks in which data is filled to the size of the block, and divides each block into a plurality of segments according to full blocks, incomplete blocks, and complete blocks of the plurality of blocks, extracts characteristic values ​​from blocks divided into a plurality of segments, and stores the extracted characteristic values ​​as training data by distinguishing between plaintext data and ciphertext data, and a learning unit that generates a plurality of detection models that distinguish between infected data and non-infected data through learning using the training data.

[0017] The above learning unit is characterized in that it generates a first detection model that distinguishes between infected data and non-infected data according to the characteristic value of a segment of an entire block, generates a second detection model that distinguishes between infected data and non-infected data according to the characteristic value of a segment of an incomplete block, and generates a third detection model that distinguishes between infected data and non-infected data according to the characteristic value of a segment of a complete block.

[0018] According to the present invention, it is possible to precisely detect a variant attack of ransomware that does not encrypt the entire file but only encrypts a portion of the file at a variable location and variable size.

[0019] FIG. 1 is a drawing for explaining the configuration of a device for detecting a ransomware attack using artificial intelligence-based analysis according to an embodiment of the present invention.

[0020] FIG. 2 is a flowchart illustrating a method for generating an artificial intelligence-based detection model according to an embodiment of the present invention.

[0021] FIG. 3 is an exemplary diagram illustrating a method for generating multiple detection models of different types according to an embodiment of the present invention.

[0022] FIG. 4 is a diagram illustrating a method for generating learning data for generating an artificial intelligence-based detection model according to an embodiment of the present invention.

[0023] FIG. 5 is a flowchart illustrating a method for detecting a ransomware attack using artificial intelligence-based analysis according to an embodiment of the present invention.

[0024] FIG. 6 is an exemplary diagram illustrating a method for detecting a ransomware attack using artificial intelligence-based analysis according to an embodiment of the present invention.

[0025] FIG. 7 is an exemplary diagram of a hardware system for implementing a device for detecting a ransomware attack using artificial intelligence-based analysis according to one embodiment of the present invention.

[0026] Before going into a detailed description of the present invention, it should be noted that the terms and words used in this specification and claims described below should not be construed as limited to their typical or dictionary meanings, but should be construed with meanings and concepts that conform to the technical spirit of the present invention, based on the principle that the inventor can appropriately define the concept of the term in order to explain his or her own invention in the best way. Therefore, the embodiments described in this specification and the configurations illustrated in the drawings are merely the most preferred embodiments of the present invention, and do not represent all of the technical spirit of the present invention. Therefore, it should be understood that there may be various equivalents and modified examples that can replace them at the time of filing this application.

[0027] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the attached drawings. It should be noted that, where possible, identical components are represented by identical reference numerals throughout the drawings. Furthermore, detailed descriptions of well-known functions and structures that may obscure the gist of the present invention will be omitted. For the same reason, some components in the attached drawings are exaggerated, omitted, or schematically depicted, and the sizes of each component do not fully reflect their actual sizes.

[0028] First, the configuration of a device for detecting ransomware attacks using artificial intelligence-based analysis according to an embodiment of the present invention will be described. Figure 1 is a diagram illustrating the configuration of a device for detecting ransomware attacks using artificial intelligence-based analysis according to an embodiment of the present invention.

[0029] Referring to FIG. 1, the detection device (10) includes a storage unit (100), a data preparation unit (200), a learning unit (300), a data processing unit (400), and a detection unit (500).

[0030] The storage unit (100) is for storing learning data, multiple detection models, etc. according to an embodiment of the present invention.

[0031] The data preparation unit (200) is for extracting learning data from learning data.

[0032] The learning unit (300) is for creating multiple detection models through learning (machine learning / deep learning) using learning data.

[0033] The data processing unit (400) processes data to be analyzed and extracts input data corresponding to multiple detection models. Here, the input data may be characteristic values ​​of blocks of data or blocks divided into segments.

[0034] The detection unit (500) analyzes the data to be analyzed using at least one of the multiple detection models generated by the learning unit (300) to detect whether the data is infected with ransomware.

[0035] The specific operation of the detection device (10), which includes the storage unit (100), data preparation unit (200), learning unit (300), data processing unit (400), and detection unit (500) described above, will be described in more detail below.

[0036] Next, a method for generating an artificial intelligence-based detection model according to an embodiment of the present invention will be described. Fig. 2 is a flowchart illustrating a method for generating an artificial intelligence-based detection model according to an embodiment of the present invention. Fig. 3 is an exemplary diagram illustrating a method for generating multiple detection models of different types according to an embodiment of the present invention. Fig. 4 is a diagram illustrating a method for generating training data for generating an artificial intelligence-based detection model according to an embodiment of the present invention.

[0037] Referring to FIGS. 2 and 3, the data preparation unit (200) loads a plurality of training data, including encrypted data (data infected by ransomware) and plaintext data (data not infected), from the storage unit (100) at step S110. These plurality of training data are prepared in advance and stored in the storage unit (100). In addition, the plurality of training data are assigned labels that distinguish between plaintext data and encrypted data for differentiation.

[0038] Next, the data preparation unit (200) extracts multiple blocks by applying offsets to multiple learning data according to the number of offsets in step S120.

[0039] Figure 4 illustrates training data according to one embodiment of the present invention. As will be described below, the data being analyzed also has the same format as the training data. Referring to the diagram, in the embodiment of the present invention, the number of offsets is determined based on a preset offset threshold. That is, the offset threshold indicates the number of offsets to be applied.

[0040] Referring to FIG. 4, for example, if the offset number threshold value is 1 (ρ=1), the first offset (offset1) is applied. As another example, if the offset number threshold value is 2 (ρ=2), the first offset (offset1) and the second offset (offset2) are applied. As another example, if the offset number threshold value is 3 (ρ=3), three different thresholds are applied. As another example, if the offset number threshold value is k (ρ=k), k different thresholds are applied.

[0041] Additionally, the offset can be applied in a forward or reverse direction. For example, as in a) of FIG. 4, the forward direction is applied in which the first block (B1) and the second block (B2) are detected in the same order as the first offset (offset1) and the second offset (offset2), or as in b) of FIG. 4, the reverse direction is applied in which the first block (B1) and the second block (B2) are detected in the same order as the first offset (offset1) and the second offset (offset2).

[0042] Additionally, the position of the offset can be set to variable and can be set randomly.

[0043] And the offset is preset and can be set to various position values ​​such as "0, …, 192, …, 8192, …". For example, if the offset is 0, it means the starting reference position (i.e., the 0th byte position), and if the offset is 8192, it means the 8192nd byte position from the starting reference position (i.e., the 0th byte position).

[0044] Additionally, the size (bytes) of the detected block can also be preset and detected in various sizes, such as, for example, “…, 64, 128, 256, …, 1024, …, 2048, …, 4096 …” (bytes).

[0045] In particular, according to an embodiment of the present invention, for example, when the size of the entire data is K bytes x n (e.g., K = 8192), blocks can be extracted by variably setting the offset positions to even, odd, or random for n. At this time, K means the size of the block, and the offset value becomes K x q (where q is an integer greater than or equal to 0 and less than n).

[0046] Next, the data preparation unit (200) classifies the plurality of blocks extracted previously (S120) in step S130 into an incomplete block (not full block), which is a block in which data is not filled to the size of the block, and a full block, which is a block in which data is filled to the size of the block.

[0047] Next, the data preparation unit (200) divides each block into multiple segments (SG) according to the entire block, incomplete block, and complete block of the multiple blocks extracted previously (S120), as illustrated in FIG. 4, at step S140. Here, the size of the segment (SG) can be applied in various ways. For example, the size of the segment (SG) can be applied in various sizes according to a preset value, such as "8, 16, ..." (bits).

[0048] Next, the data preparation unit (200) extracts characteristic values ​​from a block divided into multiple segments in step S150. More specifically, the data preparation unit (200) extracts characteristic values ​​from each of the entire block, the incomplete block, and the complete block divided into multiple segments.

[0049] Here, the characteristic value includes at least one of a bit position ratio, which is a statistical value for the rate at which a specific bit value appears at each bit position in a plurality of segments, a segment bit count ratio, which is a statistical value for the number of bits having a specific bit value in a plurality of segments, and a segment pattern frequency, which is a statistical value for the frequency of occurrence of different segment patterns appearing in a plurality of segments.

[0050] Next, the data preparation unit (200) stores the extracted feature values ​​as training data by dividing them into plaintext data and ciphertext data in step S160. That is, as previously explained, each of the entire block, incomplete block, and complete block is based on plaintext data or ciphertext data. Therefore, the extracted feature values ​​by dividing them into plaintext data and ciphertext data can be stored as training data by dividing them into feature values ​​of plaintext data and feature values ​​of ciphertext data.

[0051] Next, the learning unit (300) uses the learning data in step S170 to create multiple detection models that distinguish between infected and non-infected data through learning (machine learning / deep learning), and stores the multiple detection models that are created separately.

[0052] At this time, the learning unit (300) can generate a first detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the entire block. In addition, the learning unit (300) can generate a second detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of an incomplete block, and can generate a third detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of a complete block.

[0053] In particular, when storing multiple detection models, the number of offsets, location and direction, the size of the block corresponding to each offset, and the size of the segment corresponding to each block are stored together for each detection model.

[0054] Next, a method for detecting ransomware attacks using artificial intelligence-based analysis according to an embodiment of the present invention will be described. Figure 5 is a flowchart illustrating a method for detecting ransomware attacks using artificial intelligence-based analysis according to an embodiment of the present invention. Figure 6 is an exemplary diagram illustrating a method for detecting ransomware attacks using artificial intelligence-based analysis according to an embodiment of the present invention.

[0055] Referring to FIGS. 5 and 6, the data processing unit (400) receives data to be analyzed at step S210. The data to be analyzed is data for which it is unknown whether it is infected with ransomware or not.

[0056] Next, the data processing unit (400) extracts multiple blocks by applying offsets to the data to be analyzed according to the offset number in step S220. As described above in FIG. 4, the data to be analyzed is processed in the same structure as the learning data. That is, the offset number is set according to the offset number threshold, and the offset is applied according to the offset number. Referring to FIG. 4, for example, if the offset number threshold value is 1 (ρ=1), the first offset (offset1) is applied. As another example, if the offset number threshold value is 2 (ρ=2), the first offset (offset1) and the second offset (offset2) are applied. As another example, if the offset number threshold value is 3 (ρ=3), three different thresholds are applied. As another example, if the offset number threshold value is k (ρ=k), k different thresholds are applied. In addition, the offset can be applied in the forward or reverse direction. For example, in a) of FIG. 4, the forward direction may be applied in which the first block (B1) and the second block (B2) are detected in the same order as the first offset (offset1) and the second offset (offset2), or in b) of FIG. 4, the reverse direction may be applied in which the first block (B1) and the second block (B2) are detected in the same order as the first offset (offset1) and the second offset (offset2). In addition, the position of the offset may be set variably and may be set randomly. And the offset may use a preset value. In addition, the size (bytes) of the detected block may also be detected in a preset size. That is, the data processing unit (400) may extract a plurality of blocks by applying offsets from the analysis target data according to the set number of offsets, positions and directions, and the sizes of the blocks corresponding to each offset.

[0057] Next, the data processing unit (400) classifies the plurality of blocks extracted previously (S220) in step S230 into an incomplete block (not full block), which is a block in which data is not filled to the size of the block, and a full block, which is a block in which data is filled to the size of the block.

[0058] Next, the data processing unit (400) divides each block into multiple segments by whole block, incomplete block, and complete block of the multiple blocks extracted previously (S220) in step S240.

[0059] Next, the data processing unit (400) extracts characteristic values ​​from the block divided into a plurality of segments in step S250. More specifically, the data preparation unit (200) can extract characteristic values ​​from each of the entire block, the incomplete block, and the complete block divided into a plurality of segments. As described above, the characteristic value includes at least one of a bit position ratio, which is a statistical value for the rate at which a specific bit value appears at each bit position in the plurality of segments, a segment bit count ratio, which is a statistical value for the number of bits having a specific bit value in the plurality of segments, and a segment pattern frequency, which is a statistical value for the frequency of occurrence of different segment patterns appearing in the plurality of segments.

[0060] Next, the detection unit (500) analyzes the characteristic values ​​extracted previously (S250) using at least one of a plurality of detection models learned (machine learning / deep learning) depending on whether the block classified previously (S230) is an incomplete block or a complete block in step S260, thereby detecting whether the data being analyzed is infected with ransomware.

[0061] According to one embodiment of step S260, if the block classified previously (S230) is an incomplete block, the detection unit (500) can detect whether the data to be analyzed is infected with ransomware by using at least one of a first detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the entire block and a second detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the incomplete block.

[0062] According to another embodiment of step S260, if the block classified previously (S230) is a complete block, the detection unit (500) can detect whether the data to be analyzed is infected with ransomware by using at least one of a first detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the entire block, and a third detection model that distinguishes between infected data and non-infected data based on the characteristic value of a segment of the complete block.

[0063] FIG. 7 is an exemplary diagram of a hardware system for implementing a device for detecting ransomware attacks using artificial intelligence-based analysis according to one embodiment of the present invention.

[0064] As illustrated in FIG. 7, a hardware system (2000) according to one embodiment of the present invention may have a configuration including a processor unit (2100), a memory interface unit (2200), and a peripheral device interface unit (2300).

[0065] Each component within the hardware system (2000) may be an individual component or integrated into one or more integrated circuits, and each of these components may be connected by a bus system (not shown).

[0066] Here, for a bus system, it is an abstraction representing any one or more individual physical buses, communication lines / interfaces, and / or multi-drop or point-to-point connections connected by appropriate bridges, adapters, and / or controllers.

[0067] The processor unit (2100) communicates with the memory unit (2210) through the memory interface unit (2200) to perform various functions in the hardware system, thereby executing various software modules stored in the memory unit (2210).

[0068] Here, in the memory unit (2210), each of the components including the storage unit (100), data preparation unit (200), learning unit (300), data processing unit (400), and detection unit (500) described above with reference to FIG. 1 can be stored in the form of a software module, and an operating system (OS) can be additionally stored. The components including the storage unit (100), data preparation unit (200), learning unit (300), data processing unit (400), and detection unit (500) can be loaded onto the processor unit (2100) and executed.

[0069] Each configuration including the storage unit (100), data preparation unit (200), learning unit (300), data processing unit (400), and detection unit (500) described above may be implemented in the form of a software module or hardware module executed by a processor, or may also be implemented in the form of a combination of software modules and hardware modules.

[0070] In this way, a software module, a hardware module, or a combination of software modules and hardware modules executed by a processor may be implemented as an actual hardware system (e.g., a computer system).

[0071] For an operating system, it includes various procedures, instruction sets, software components and / or drivers that control and manage general system operations (e.g., memory management, storage device control, power management, etc.) and facilitates communication between various hardware modules and software modules.

[0072] For reference, the memory unit (2210) may include a memory hierarchy including, but not limited to, cache, main memory, and secondary memory, which may be implemented through any combination of, for example, RAM (e.g., SRAM, DRAM, DDRAM), ROM, FLASH, magnetic and / or optical storage devices (e.g., disk drives, magnetic tape, compact disks (CDs), and digital video discs (DVDs)).

[0073] The peripheral device interface unit (2300) performs the role of enabling communication between the processor unit (2100) and the peripheral device.

[0074] In the case of a peripheral device here, as for providing different functions to the hardware system (2000), in one embodiment of the present invention, for example, a communication unit (2310) may be included.

[0075] Here, the communication unit (2310) performs the role of providing a communication function with other devices. The communication protocols supported by the communication unit (2310) may include any protocol capable of providing a communication environment with other devices.

[0076] In a hardware system (2000) according to one embodiment of the present invention, each component stored in the form of a software module in the memory unit (2210) performs an interface with the communication unit (2310) through the memory interface unit (2200) and the peripheral device interface unit (2300) in the form of a command executed by the processor unit (2100).

[0077] While this specification contains details of a number of specific implementations, as described above, these should not be construed as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features that may be unique to particular embodiments of particular inventions. Certain features described herein in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments, either individually or in any suitable subcombination. Furthermore, although features may operate in a particular combination and may initially be described as being claimed as such, one or more features from a claimed combination may in some cases be excluded from that combination, and the claimed combination may be modified into a subcombination or variation of a subcombination.

[0078] Likewise, while operations are depicted in the drawings in a particular order, this should not be construed as requiring that those operations be performed in the particular or sequential order depicted to achieve desired results, or that all depicted operations be performed. In certain instances, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components of the embodiments described above should not be construed as requiring such separation in all embodiments, and it should be understood that the program components and systems described may generally be integrated together in a single software product or packaged into multiple software products.

[0079] Specific embodiments of the subject matter described herein have been described. Other embodiments are within the scope of the following claims. For example, the operations recited in the claims may be performed in a different order and still achieve desirable results. For example, the processes depicted in the accompanying drawings do not necessarily require the specific illustrated order or sequential order to achieve desirable results. In certain implementations, multitasking and parallel processing may be advantageous.

[0080] This detailed description presents the best mode of the present invention and provides examples to illustrate the invention and enable those skilled in the art to make and use the invention. This written specification is not intended to limit the invention to the specific terms presented. Therefore, while the invention has been described in detail with reference to the examples described above, those skilled in the art will appreciate that modifications, variations, and variations can be made to these examples without departing from the scope of the invention.

[0081] Therefore, the scope of the present invention should not be determined by the described embodiments but by the claims.

[0082] [Explanation of symbols]

[0083] 10: Detection device

[0084] 100: Storage

[0085] 200: Data Preparation Department

[0086] 300: Learning Department

[0087] 400: Data Processing Unit

[0088] 500: Detection Unit

Claims

1. A method for detecting ransomware attacks, A step in which a data processing unit extracts multiple blocks by applying offsets to the data to be analyzed according to the number of offsets; A step in which the data processing unit classifies the extracted block into an incomplete block, which is a block in which data is not filled to the size of the block, and a complete block, which is a block in which data is filled to the size of the block; A step of dividing each of the entire blocks, incomplete blocks, and complete blocks from the extracted plurality of blocks into a plurality of segments by the data processing unit; A step of extracting characteristic values ​​from each of the entire block, the incomplete block, and the complete block divided into multiple segments by the data processing unit; and A detection unit detects whether the data is infected with ransomware by analyzing the extracted characteristic value using at least one of a plurality of detection models depending on whether the classified block is an incomplete block or a complete block; Before the step of extracting the above block, A step in which the data preparation unit loads multiple training data including encrypted data, which is data infected by ransomware, and plain text data, which is data that is not infected; A step in which the data preparation unit extracts blocks by applying offsets to the plurality of learning data according to the number of offsets; A step in which the data preparation unit classifies the plurality of blocks into an incomplete block, which is a block in which data is not filled to the size of the block, and a complete block, which is a block in which data is filled to the size of the block; A step in which the data preparation unit divides each block into a plurality of segments, each block being a full block, an incomplete block, and a complete block of the plurality of blocks; A step in which the data preparation unit extracts characteristic values ​​from a block divided into multiple segments; A step of storing the extracted characteristic values ​​as learning data by dividing them into plaintext data and ciphertext data by the above data preparation unit; and A step in which a learning unit creates multiple detection models that distinguish between infected and non-infected data through learning using the above learning data; characterized by further including How to detect ransomware attacks.

2. In paragraph 1, The steps to detect whether the above data is infected with ransomware are: If the above classified block is an incomplete block, The above detection unit A first detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the entire block. At least one of the second detection models that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of incomplete blocks is used. Characterized in that it detects whether the above data is infected with ransomware. How to detect ransomware attacks.

3. In paragraph 1, The steps to detect whether the above data is infected with ransomware are: If the above classified block is a complete block, The above detection unit A first detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the entire block, and A third detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments in a complete block. Using at least one of Characterized in that it detects whether the above data is infected with ransomware. How to detect ransomware attacks.

4. In paragraph 1, At least one of the number, position and direction of the offset, the size of the block corresponding to the offset and the size of the segment corresponding to the block characterized by being set to variable How to detect ransomware attacks.

5. In paragraph 1, The step of generating the above multiple detection models is A step in which the learning unit generates a first detection model that distinguishes between infected data and non-infected data based on characteristic values ​​of segments of the entire block; A step of generating a second detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the incomplete block by the learning unit; and A step of generating a third detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the above learning unit; characterized by including How to detect ransomware attacks.

6. In a device for detecting ransomware attacks, Extract multiple blocks by applying offsets to the data to be analyzed according to the number of offsets. The above extracted blocks are classified into incomplete blocks, which are blocks whose data is not filled to the size of the block, and complete blocks, which are blocks whose data is filled to the size of the block. Splitting each of the full blocks, incomplete blocks, and complete blocks from the extracted multiple blocks into multiple segments, A data processing unit that extracts characteristic values ​​from each of a full block, an incomplete block, and a complete block divided into multiple segments; and A detection unit that detects whether the data is infected with ransomware by analyzing the extracted characteristic value using at least one of a plurality of detection models depending on whether the classified block is an incomplete block or a complete block; Load multiple training data sets including encrypted data (data infected by ransomware) and plaintext data (data not infected). Extract blocks by applying offsets to the above multiple learning data according to the number of offsets, The above multiple blocks are classified into incomplete blocks, which are blocks in which data is not filled to the size of the block, and complete blocks, which are blocks in which data is filled to the size of the block. Divide each block into a plurality of segments, each block being a full block, an incomplete block, and a complete block of the above plurality of blocks, Extract feature values ​​from blocks divided into multiple segments, A data preparation unit that stores the extracted feature values ​​as learning data by dividing them into plaintext data and ciphertext data; and A learning unit that creates multiple detection models that distinguish between infected and non-infected data through learning using the above learning data; characterized by further including A device for detecting ransomware attacks.

7. In paragraph 6, The above detection unit If the above classified block is an incomplete block, A first detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the entire block. At least one of the second detection models that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of incomplete blocks is used. Characterized in that it detects whether the above data is infected with ransomware. A device for detecting ransomware attacks.

8. In paragraph 6, The above detection unit If the above classified block is a complete block, A first detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the entire block, and A third detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments in a complete block. Using at least one of Characterized in that it detects whether the above data is infected with ransomware. A device for detecting ransomware attacks.

9. In paragraph 6, At least one of the number, position and direction of the offset, the size of the block corresponding to the offset and the size of the segment corresponding to the block characterized by being set to variable A device for detecting ransomware attacks.

10. In paragraph 6, The above learning department Create a first detection model that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of the entire block, A second detection model is created that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of incomplete blocks. A third detection model is created that distinguishes between infected and non-infected data based on the characteristic values ​​of segments of a complete block. A device for detecting ransomware attacks.

Images