Embodiments of the present application provide a file
backup method, device, equipment and
computer program product; the file
backup method comprises: obtaining a file write request; in the case that the file write request is a file modification request, determining probability information of the file write request corresponding to a ransom behavior; in the case that the probability information is greater than or equal to a preset threshold, then before performing a write operation based on the file write request,
copying a request file corresponding to the file write request to a preset protected
directory, wherein the protected
directory is located in the kernel. In the present embodiment, since the protected
directory is located in the kernel, the access permission of the protected directory is higher than the access request of the file write request, so that in the case of write request operation, the file in the protected directory cannot be written, thereby avoiding the ransom operation on the request file, while ensuring the safety and reliability of the information content, further improving the practicability of the method.