CN106844097A - A kind of means of defence and device for malice encryption software - Google Patents

Abstract

The invention discloses a protection method and device for malicious encryption software, and relates to the technical field of network security. The file is determined by sampling the accessed network files and marking the source of information, and matching the files written into the local storage. source of information. The main technical solution of the present invention is: monitor the execution process of the unknown application program, and judge whether the operation of modifying the specified data file exists in the unknown application program. The unknown application program is an application program whose security cannot be determined; Back up the data file before the application program modifies the data file; determine whether there is characteristic data in the content of the data file modified by the unknown application program, and the characteristic data is characteristic data of malicious encryption software; if it exists, terminate the unknown application program During the execution of the program, the modified data file is replaced with the backup file of the data file. The present invention is mainly used for protecting the safety of local data files.

Description

A protection method and device against malicious encryption software

technical field

The invention relates to the technical field of network security, in particular to a protection method and device for malicious encryption software.

Background technique

Ransomware, also known as blackmailer virus, is one of the fastest-growing network security threats in recent years. It is a kind of malicious software that criminals hijack user assets or resources by locking screens, encrypting files, etc. to extort money from users. Criminals often use phishing to implant ransomware into the victim computer to encrypt files or even all data on the hard disk, and then demand varying amounts of ransom (such as Bitcoin, etc.) from the victim company or individual before decrypting it. When a user is infected by ransomware, it usually has the following manifestations:

1. Lock the screen of the computer by setting the computer power-on password, login password, etc., affecting the normal use of the user system.

2. Intimidate users by threatening and blackmailing: For example, FakeAV ransomware will pretend to be anti-virus software, deceive users to find viruses in their systems, and trick users into paying for their "anti-virus software."

3. Encrypt user files and data and ask for ransom payment: the most typical one is the CTB-Locker family, which uses high-strength encryption algorithms to encrypt user files, and only after the user pays the ransom will the method of decrypting the files be provided.

4. Tampering with the disk MBR (Master Boot Record, the master boot record of the hard disk), creating a blue screen restart of the computer, and then encrypting the entire disk of the computer to extort ransom.

Judging from the dissemination process of popular ransomware in China in recent years, users need to turn on the anti-virus function and update it in time to ensure the effective identification of ransomware. It is also difficult to avoid ransomware attacks when the security is compromised.

Contents of the invention

In view of this, the present invention provides a method and device for protecting against malicious encryption software, by sampling and marking information sources on accessed network files, and matching files written into local storage to determine the information sources of the files .

According to one aspect of the present invention, a kind of protection method against malicious encryption software is proposed, the method includes:

Monitoring the execution process of the unknown application program, and judging whether the operation of modifying the specified data file exists in the unknown application program, and the unknown application program is an application program whose security cannot be determined;

If it exists, backing up the data file before the unknown application program modifies the data file;

Judging whether there is feature data in the content of the data file modified by the unknown application, the feature data is feature data of malicious encryption software;

If it exists, the execution process of the unknown application program is terminated, and the modified data file is replaced by the backup file of the data file.

Preferably, the terminating the execution process of the unknown application program, and using the backup file of the data file to replace the modified data file includes:

Sending alarm information, the alarm information is used to prompt that the unknown application program is suspected of malicious encryption software, and obtain the user's operation instruction;

When the operation instruction is a termination execution instruction, end the process of the unknown application program;

The modified data file is replaced with the backup file of the data file.

Preferably, the monitoring the execution process of the unknown application program, and judging whether the operation of modifying the specified data file in the unknown application program includes:

identifying the security of the application when the application starts executing;

If the security of the application program cannot be determined, then determine that the application program is an unknown application program;

Monitor whether the unknown application program loads the specified data file.

Preferably, backing up the data file before the unknown application program modifies the data file includes:

When the unknown application program has an operation to modify the data file, output prompt information to determine whether to continue to perform the operation to modify the data file;

If the execution continues, the data file is backed up before the data file is modified.

Preferably, the judging whether there is characteristic data in the content of the data file modified by the unknown application program includes:

Acquiring characteristic data of malicious encryption software, said characteristic data including encrypted format information and decryption prompt information;

Matching the unknown application program according to the feature data to modify the content of the data file;

If the matching is successful, it is determined that the unknown application program is suspected malicious encryption software.

According to another aspect of the present invention, a kind of protection device against malicious encryption software is proposed, the device includes:

The first judging unit is used to monitor the execution process of the unknown application program, and judge whether the unknown application program has an operation to modify the specified data file, and the unknown application program is an application program whose security cannot be determined;

A backup unit, configured to back up the data file before the unknown application program modifies the data file when the first judging unit judges that there is an operation to modify the specified data file;

The second judging unit is used to judge whether there is feature data in the content of the data file modified by the unknown application program, and the feature data is feature data of malicious encryption software;

A replacement unit, configured to terminate the execution of the unknown application program when the second judging unit determines that the feature data exists in the modified content of the data file, and use the backup unit to copy the backup file of the data file Replace modified data files.

Preferably, the replacement unit includes:

The sending module is used to send alarm information, and the alarm information is used to prompt that the unknown application program is suspected of malicious encryption software, and obtain the user's operation instruction;

A termination module, configured to terminate the process of the unknown application program when the user's operation instruction is a termination execution instruction;

The replacement module is used to replace the modified data file with the backup file of the data file.

Preferably, the first judging unit includes:

An identification module, configured to identify the security of the application when the application starts to execute;

A determination module, configured to determine that the application is an unknown application when the identification module cannot determine the security of the application;

The monitoring module is used to monitor whether the unknown application determined by the determination module loads the specified data file.

Preferably, the backup unit includes:

An output module, configured to output prompt information when the unknown application program has an operation to modify the data file, so as to determine whether to continue to perform the operation to modify the data file;

The backup module is configured to back up the data file before modifying the data file when the feedback information of the prompt information output by the output module is to continue the modification operation.

Preferably, the second judging unit includes:

An acquisition module, configured to acquire characteristic data of malicious encryption software, said characteristic data including encrypted format information and decryption prompt information;

A matching module, configured to match the unknown application program to modify the content of the data file according to the feature data acquired by the acquisition module;

A determining module, configured to determine that the unknown application program is suspected malicious encryption software when the matching module successfully matches.

A protection method and device for malicious encryption software adopted by the present invention is to first perform the file read or modify by the unknown application program before the unknown application program reads or modifies the local files. Back up, and then allow unknown applications to perform all operations on files. At the same time, monitor the content of files modified by unknown applications to determine whether the modified content contains characteristic data consistent with malicious encryption software. After confirming that it contains characteristic data , then determine the unknown application program as malicious software, terminate its local execution and delete the modified file, and use the backup file to overwrite the deleted file. Through the protection method and device adopted in the present invention, it is possible to judge the characteristic data carried by the suspected malicious encrypted ransomware in the execution process, and for the local files modified by the suspected ransomware, it can also be ensured by pre-backup. Locally modified files can be effectively repaired, thereby preventing damage and losses caused by unknown applications maliciously encrypting local files.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

FIG. 1 shows a flowchart of a protection method for malicious encryption software proposed by an embodiment of the present invention;

FIG. 2 shows a flow chart of another protection method against malicious encryption software proposed by an embodiment of the present invention;

FIG. 3 shows a block diagram of a protection device for malicious encryption software proposed by an embodiment of the present invention;

FIG. 4 shows a block diagram of another protection device against malicious encryption software proposed by an embodiment of the present invention.

detailed description

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

The embodiment of the present invention provides a protection method against malicious encryption software. The method is mainly used to enhance the security of the system, especially for malicious attacks of ransomware. The specific steps are shown in Figure 1, including:

101. Monitor the execution process of the unknown application program, and determine whether the unknown application program has an operation of modifying a specified data file.

Wherein, the unknown application program in the embodiment of the present invention refers to a program for which the system cannot determine the security of the application. That is to say, when the application program is started and executed, the system will judge whether the application program is a safe application through the security defense software, and if so, continue to execute, and when it is judged that the application program is a Trojan horse or a virus, then prohibit the application program from running. implement. In addition to the above two situations, when it is impossible to determine whether the application program is a security application or a Trojan horse or a virus program, a prompt message is sent to the local user, informing the application that the security is unknown and there may be risks in continuing to execute. At the same time, The user is required to judge whether to continue to execute the application program, and then further determine whether to execute the application program according to the user's instruction.

When it is determined that the application program is an unknown application program, when the unknown application program is started, the system will monitor the program in real time to determine whether the unknown application program will modify the local file. Wherein, the modified local file is a specified data file. Generally, the specified data file is a specified type of file, such as .doc, .gif, .exe, etc. Since the purpose of malicious encryption software is to Therefore, in order to prevent the unknown application from being malicious encryption software, it is necessary to monitor the operation of the unknown application, especially the write operation to the local data file. In the embodiment of the present invention, the type of the specified data file can be customized according to the needs of the actual situation. In this way, the important types of data files in the local area can be protected with emphasis, thereby reducing the system due to monitoring of unknown applications. System resources consumed by the program.

102. Back up the specified data file before the unknown application program modifies the data file.

When it is judged in step 101 that the unknown application has an operation to modify the specified data file in the local, a backup copy operation will be performed on the operated data file. It should be noted that the backed up data file is a backup operation performed before the unknown application program modifies the data file.

In the embodiment of the present invention, the time to perform the data backup operation is during the process of monitoring the unknown application program, when the unknown application program reads the specified data file in the local, or before preparing to write data content to the data file.

In addition, in order to ensure that the backed up data file will not be modified again by the unknown application program, when storing the backup file, the backup file needs to be saved in a local security area, which generally prohibits reading or writing to the data file. operation, or encrypt the backup file, and change the file type of the original data file.

103. Determine whether there is feature data in the content of the data file specified by the unknown application program.

After completing the backup of the data file, it will continue to execute and monitor the unknown application program, that is, monitor the modification operation of the specified data file by the unknown application program. The main content of the monitoring is to monitor the specific modification operation in the data file. content, and determine whether there is characteristic data of malicious encryption software in the content. In the embodiment of the present invention, the feature data does not specifically refer to the feature data of known malicious encryption software, but some feature data common to all malicious encryption software, for example, the key information for encrypting data files , or information used for extortion, etc. It can be seen that this step is a specific step for identifying the unknown application, that is, to determine whether it is malicious encryption software according to the content written by the unknown application in the data file, and when there is characteristic data, determine the unknown application as suspected Malicious encryption software.

104. Terminate the execution process of the unknown application program, and replace the modified data file with the backup file of the data file.

According to the judgment in step 103, when it is determined that the unknown application program is suspected malicious encryption software, the system will terminate the execution of the unknown application program, and meanwhile obtain the backup file of the modified data file to replace the modified data file. That is to stop the execution of suspected malicious encryption software, prevent it from continuing to modify other data files, delete the modified data files simultaneously, and use the backup file of the data file backed up in step 102 to save to the original file of the file. address, so that suspected malicious encryption software cannot maliciously encrypt local data files.

In addition, after the execution of the suspected malicious encryption software is terminated, the relevant information of the unknown application program can also be reported through the security defense software, so that other network users can identify the suspected malicious encryption software and reduce the number of suspected malicious encryption software. the harm caused.

The above-mentioned protection method against malicious encryption software provided by the embodiment of the present invention is to first perform the file read or modify by the unknown application program before the unknown application program reads or modifies the local file. Back up, and then allow unknown applications to perform all operations on files. At the same time, monitor the content of files modified by unknown applications to determine whether the modified content contains characteristic data consistent with malicious encryption software. After confirming that it contains characteristic data , then determine the unknown application program as malicious software, terminate its local execution and delete the modified file, and use the backup file to overwrite the deleted file. Through the protection method and device adopted in the embodiment of the present invention, it is possible to judge the characteristic data carried by the suspected malicious encrypted ransomware during the execution process, and for the local files modified by the suspected ransomware, the backup can also be performed in advance. It can ensure that the locally modified files can be effectively repaired, so as to prevent the damage and loss caused by the malicious encryption of local files by unknown applications.

Further, in order to describe in more detail the specific implementation of the above-mentioned protection method against malicious encryption software in practical applications, the following embodiments will describe in detail the steps in the above-mentioned embodiments, as shown in FIG. 2 , including :

201. Monitor an execution process of an unknown application program, and judge whether the unknown application program has an operation of modifying a specified data file.

This step is to monitor the unknown application program in real time after it is started. Among them, the judgment of the unknown application program is that after the application program is started, the security defense software in the system will obtain the relevant information of the application program to determine the security of the application program. Generally, the security defense software will store a large number of The security judgment information of the application program includes a safe application program and a dangerous application program, that is, Trojan horse or virus software. Judging by comparison, when the relevant information of the application program cannot be recognized by the security defense software, at this time, the application program is determined as an unknown application program.

Because it is uncertain that unknown applications can cause damage to data files in the system or locally. Therefore, the execution of unknown applications cannot be blocked in the same way as Trojan horses or virus software. Therefore, when an unknown application program is started, it needs to be monitored in real time to determine whether the unknown application program poses a security threat. In the embodiment of the present invention, because it is aimed at the protection of malicious encryption software, and malicious encryption software is to obtain local data files to encrypt and then achieve the purpose of extortion, therefore, the main purpose of monitoring unknown application programs in this step The purpose is to judge whether it will load data files, and further perform encryption operations. Among them, according to the importance of data files in the system, specified types of data files can be monitored.

202. Back up the specified data file before the unknown application program modifies the data file.

When it is monitored that an unknown application is about to modify a specified data file, the system will back up the data file in advance. In this step, when it is monitored that an unknown application loads the specified data file locally, the data file will be backed up, so as to prevent the unknown application from maliciously encrypting the data file.

In addition, when it is monitored that an unknown application loads or modifies a specified data file locally, a prompt message can be further output to the user, and the user can judge whether to continue the operation of modifying the data file. When the user chooses to terminate the operation, the system will stop running the unknown application, and when the user chooses to continue the operation, the system will first back up the data file, and then execute the operation of modifying the data file by the unknown application.

203. Determine whether characteristic data exists in the content of the data file specified by the unknown application program.

Before performing this step, it is necessary to obtain the characteristic data of the malicious encryption software, and these characteristic data are the characteristics of some data content that must be modified by the preset malicious encryption software when encrypting the data file, including: encryption format information, For example, the key information required for encryption, and the prompt information for decryption, such as "If you want to know the password, please transfer money to XXX account XXX" and similar prompt information.

After the feature data is determined, the content of the data file modified by the unknown application program is monitored to match whether there is any feature data of the acquired malicious encryption software in the content. When the match is successful, the unknown application is identified as suspected malicious encryption software.

204. Send alarm information when there is characteristic data.

In this step, after it is determined that the unknown application program is suspected malicious encryption software, an alarm message is sent to prompt the user that the currently running unknown application program is suspected malicious encryption software. Among them, the alarm information also includes the user's operation interface. After seeing the alarm information, the user can determine whether to continue to execute the unknown application through the operation interface. If the user chooses to continue to execute, the system will not block the unknown application. program, and when the user chooses to terminate execution, step 205 will be executed.

205. Terminate the process of the unknown application program according to the user's operation instruction, and replace the modified data file with the backup file of the data file.

It should be noted that since the backup files are generally stored locally in a safe area to prevent infection by malicious encryption software, and the local safe area often has limited capacity, the saved backup files are important in determining the security of unknown applications. After that, it will be removed from the safe zone. That is to say, when it is determined that the unknown application program is a common application program, the backup file will be directly deleted, and when it is determined that the unknown application program is malicious encryption software, the backup file will be extracted and replaced by the backup file. Modified data files.

The specific implementation of the protection method against malicious encryption software in practical applications has been described in detail above. As a specific device for implementing the above method, an embodiment of the present invention also provides a protection device against malicious encryption software, as shown in FIG. 3 , The unit includes:

The first judging unit 31 is used to monitor the execution process of the unknown application program, and judge whether the unknown application program has an operation to modify the specified data file, and the unknown application program is an application program whose security cannot be determined;

A backup unit 32, configured to back up the data file before the unknown application program modifies the data file when the first judging unit 31 judges that there is an operation to modify the specified data file;

The second judging unit 33 is used to judge whether there is feature data in the contents of the data file modified by the unknown application program, and the feature data is feature data of malicious encryption software;

A replacement unit 34, configured to terminate the execution of the unknown application program when the second judging unit 33 determines that the feature data exists in the modified content of the data file, and use the backup unit 32 to copy the data file The backup file replaces the modified data file.

Further, as shown in Figure 4, the replacement unit 34 includes:

The sending module 341 is configured to send alarm information, and the alarm information is used to prompt that the unknown application program is suspected of malicious encryption software, and to obtain user operation instructions;

Termination module 342, configured to end the process of the unknown application program when the user's operation instruction is an instruction to terminate execution;

A replacement module 343, configured to use the backup file of the data file to replace the modified data file.

Further, as shown in FIG. 4, the first judging unit 31 includes:

An identification module 311, configured to identify the security of the application program when the application program starts to execute;

A determination module 312, configured to determine that the application is an unknown application when the identification module 311 cannot determine the security of the application;

The monitoring module 313 is configured to monitor whether the unknown application determined by the determining module 312 loads a specified data file.

Further, as shown in Figure 4, the backup unit 32 includes:

An output module 321, configured to output prompt information when the unknown application program has an operation to modify the data file, so as to determine whether to continue to perform the operation to modify the data file;

The backup module 322 is configured to back up the data file before modifying the data file when the feedback information of the prompt information output by the output module 321 is to continue the modification operation.

Further, as shown in FIG. 4, the second judging unit 33 includes:

An acquisition module 331, configured to acquire characteristic data of malicious encryption software, said characteristic data including encrypted format information and decryption prompt information;

A matching module 332, configured to match the unknown application program to modify the content of the data file according to the characteristic data acquired by the acquiring module 331;

The determining module 333 is configured to determine that the unknown application program is suspected malicious encryption software when the matching module 332 successfully matches.

To sum up, the method and device for protecting against malicious encryption software provided by the embodiments of the present invention is to first read or modify the files in the local file before the unknown application program reads or modifies the local file. The read or modified files are backed up, and then all operations on the files are allowed by unknown applications. At the same time, the content of files modified by unknown applications is monitored to determine whether the modified content contains characteristic data consistent with malicious encryption software. , when it is determined that it contains characteristic data, the unknown application program is determined as suspected malware, and an alarm message is sent to the local user at the same time. When the user chooses to terminate the application program, the process of the application program is terminated and the modified file Delete to overwrite deleted files with backup files. Through the protection method and device adopted in the embodiment of the present invention, it is possible to judge the characteristic data carried by the suspected malicious encrypted ransomware during the execution process, and for the local files modified by the suspected ransomware, the backup can also be performed in advance. It can ensure that the locally modified files can be effectively repaired, so as to prevent the damage and loss caused by the malicious encryption of local files by unknown applications.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

It can be understood that related features in the above cloud server and devices can be referred to each other. In addition, "first", "second" and so on in the above embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the aforementioned cloud server embodiment, and will not be repeated here.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known cloud servers, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline the present disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any cloud server so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. Or all processes or units of equipment combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the components in the title of the invention (such as the device for determining the connection level in the website) according to the embodiment of the present invention some or all of the features. The present invention can also be implemented as a device or device program (for example, a computer program and a computer program product) for executing a part or all of the cloud server described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (10)

1. a kind of means of defence for malice encryption software, it is characterised in that methods described includes：

The implementation procedure of Unknown Applications is monitored, the data file that the Unknown Applications are specified with the presence or absence of modification is judged Operation, the Unknown Applications are the application programs that not can determine that security；

If in the presence of being backed up to the data file before the Unknown Applications change the data file；

Whether there is characteristic, the characteristic in the content for judging the Unknown Applications modification data file It is the characteristic of malice encryption software；

If in the presence of, terminate the implementation procedure of the Unknown Applications, replace quilt using the backup file of the data file The data file of modification.

2. method according to claim 1, it is characterised in that the implementation procedure of the termination Unknown Applications, The data file changed is replaced using the backup file of the data file to be included：

Warning message is sent, the warning message is used to point out the Unknown Applications doubtful malice encryption software, obtains and use The operational order at family；

When the operational order is to terminate execute instruction, terminate the process of the Unknown Applications；

The data file changed is replaced using the backup file of the data file.

3. method according to claim 1, it is characterised in that the implementation procedure of the monitoring Unknown Applications, judges The operation of the data file that the Unknown Applications are specified with the presence or absence of modification includes：

When application program launching is performed, the security of the application program is recognized；

If the security of the application program cannot be determined, it is determined that the application program is Unknown Applications；

Monitor whether the Unknown Applications load the data file specified.

4. method according to claim 3, it is characterised in that the Unknown Applications change the data file it It is preceding backup is carried out to the data file to include：

When the Unknown Applications have the operation of the modification data file, export prompt message, with judge whether after The continuous operation for performing the modification data file；

If continuing executing with, the data file is backed up before the data file is changed.

5. the method according to any one of claim 1-4, it is characterised in that the judgement Unknown Applications are repaiied Include with the presence or absence of characteristic in the content for changing the data file：

The characteristic of malice encryption software is obtained, the characteristic includes encryption format information, decryption prompt message；

The content that the Unknown Applications change the data file is matched according to the characteristic；

Determine that the Unknown Applications are doubtful malice encryption software if the match is successful.

6. a kind of protector for malice encryption software, it is characterised in that described device includes：

First judging unit, the implementation procedure for monitoring Unknown Applications judges that the Unknown Applications whether there is The operation of the data file that modification is specified, the Unknown Applications are the application programs that not can determine that security；

Backup units, for when first judging unit is judged in the presence of the operation for changing the data file specified, described Unknown Applications are backed up before changing the data file to the data file；

Second judging unit, for whether there is feature in the content for judging the Unknown Applications modification data file Data, the characteristic is the characteristic of malice encryption software；

Replacement unit, for there is the characteristic in the content that the modification data file is determined when second judging unit According to when, terminate the execution of the Unknown Applications, the backup file for replicating the data file using the backup units is replaced Change the data file changed.

7. device according to claim 6, it is characterised in that the replacement unit includes：

Sending module, for sending warning message, the warning message is used to point out the doubtful malice of the Unknown Applications to add Close software, obtains the operational order of user；

Terminate module, for when the operational order of the user is to terminate execute instruction, terminating the Unknown Applications Process；

Replacement module, the data file changed is replaced for the backup file using the data file.

8. device according to claim 6, it is characterised in that first judging unit includes：

Identification module, for when application program launching is performed, recognizing the security of the application program；

Determining module, during for the security that the application program cannot be determined when the identification module, determines the application journey Sequence is Unknown Applications；

Whether monitoring module, the data file specified is loaded for monitoring the Unknown Applications that the determining module determines.

9. device according to claim 8, it is characterised in that the backup units include：

Output module, for when the Unknown Applications have the operation for changing the data file, exporting prompt message, To judge whether to continue executing with the operation for changing the data file；

Backup module, for when the prompt message that the output module is exported feedback information for continue executing with modification operation when, The data file is backed up before the data file is changed.

10. the device according to any one of claim 6-9, it is characterised in that second judging unit includes：

Acquisition module, the characteristic for obtaining malice encryption software, the characteristic includes encryption format information, decryption Prompt message；

Matching module, the characteristic for being obtained according to the acquisition module matches the Unknown Applications and changes the number According to the content of file；

Determining module, for when the match is successful for the matching module, determining that the Unknown Applications are encrypted for doubtful malice Software.