CN109766691B - A method and device for monitoring ransomware - Google Patents

Abstract

The present invention provides a ransomware virus monitoring method and device, the method comprising: after monitoring suspicious operations on the honeypot system, obtaining suspicious sequences corresponding to the suspicious operations; initializing the sandbox system, and inputting the suspicious sequences into the sandbox The system replays, and if the replayed result and the suspicious sequence meet the preset malicious conditions, the suspicious sequence is determined to be a malicious sequence; after obtaining the normal sequence corresponding to the normal operation on the user system, the normal operation, suspicious operation and Malicious operations are input into the preset machine learning engine for training to obtain the first classification model; input malicious sequences into the first classification model again, and classify the first classification model into ransomware types to obtain the second classification model; The operation sequence is input into the second classification model, and if it is a sequence generated by a ransomware virus, an early warning will be given. The present invention can effectively monitor existing ransomware, its variants or new ransomware.

Description

A method and device for monitoring ransomware

technical field

The invention relates to the technical field of computer security, in particular to a ransomware virus monitoring method and device.

Background technique

Ransomware generally uses zero-day vulnerabilities to spread. Different from other malicious behavior viruses, ransomware often encrypts data through normal encryption methods, and its behavior characteristics are similar to manual operations. It is also relatively simple. Anti-virus software that analyzes based on fixed characteristic behaviors is generally difficult to effectively distinguish its behavior from other normal operations, resulting in the inability to predict, and the accuracy and efficiency of scanning and killing are low.

Contents of the invention

The embodiments of the present invention provide a ransomware virus monitoring method and device, which can effectively monitor existing ransomware viruses, their variants, or new ransomware viruses.

According to one aspect of the present invention, a method for monitoring ransomware is provided, including:

After detecting that there is a suspicious operation on the honeypot system, obtaining a suspicious sequence corresponding to the suspicious operation;

Initializing the sandbox system, inputting the suspicious sequence into the sandbox system for replay, and determining that the suspicious sequence is a malicious sequence if the replayed result and the suspicious sequence meet preset malicious conditions;

After obtaining the normal sequence corresponding to the normal operation on the user system, input the normal operation, the suspicious operation and the malicious operation into a preset machine learning engine for training to obtain a first classification model;

Input the malicious sequence to the first classification model again, and classify the type of ransomware to the first classification model to obtain a second classification model;

The operation sequence on the user system is input into the second classification model, and if it is a sequence generated by a ransomware virus, an early warning is given.

Preferably, if the replayed result and the suspicious sequence meet the preset malicious conditions, it is specifically:

If the state of the file to be played back is a preset malicious state, and the suspicious sequence includes a subsequence of an encrypted API call.

Preferably, the preset malicious status is deleted or cannot be opened or opened abnormally.

Preferably, the classification of the ransomware type on the first classification model is specifically:

Classify the type of ransomware on the first classification model based on the sequence similarity.

Preferably, the classification of the ransomware type by the first classification model based on the sequence similarity is specifically:

The sequence similarity between the malicious sequences is calculated by word embedding, and the first classification model is used to classify the type of ransomware according to the sequence similarity.

Preferably, inputting the operation sequence on the user system into the second classification model, if it is a sequence generated by a ransomware virus, after the warning, it also includes:

Inputting the sequence generated by the ransomware into the second classification model to update the model.

Preferably, inputting the operation sequence on the user system into the second classification model, if it is a sequence generated by a ransomware virus, after the warning, it also includes:

A monitoring report of the ransomware is generated.

According to another aspect of the present invention, a ransomware monitoring device is provided, including:

The obtaining module is used to obtain a suspicious sequence corresponding to the suspicious operation after monitoring that there is a suspicious operation on the honeypot system;

A replay module, configured to initialize a sandbox system, input the suspicious sequence into the sandbox system for replay, and if the replayed result and the suspicious sequence meet preset malicious conditions, then determine that the suspicious sequence is malicious sequence;

The training module is used to obtain the normal sequence corresponding to the normal operation on the user system, input the normal operation, the suspicious operation and the malicious operation into a preset machine learning engine for training, and obtain a first classification model ;

A classification module, configured to input the malicious sequence into the first classification model again, classify the type of ransomware on the first classification model, and obtain a second classification model;

The monitoring module is used to input the operation sequence on the user system into the second classification model, and give an early warning if it is a sequence generated by a ransomware virus.

According to another aspect of the present invention, there is provided a ransomware monitoring device, including a processor and a memory, and computer program instructions are stored on the memory, and when the program instructions are executed by the processor, the ransomware virus as described above is implemented. monitoring method.

According to another aspect of the present invention, there is provided a computer-readable storage medium, on which computer program instructions are stored, and when the program instructions are executed by a processor, the method for monitoring ransomware as described above is implemented.

It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

The present invention provides a ransomware virus monitoring method and device. The method includes: after monitoring suspicious operations on the honeypot system, obtaining suspicious sequences corresponding to the suspicious operations; initializing the sandbox system, and inputting the suspicious sequences into the sandbox If the replayed result and the suspicious sequence meet the preset malicious conditions, it is determined that the suspicious sequence is a malicious sequence; after obtaining the normal sequence corresponding to the normal operation on the user system, the normal operation, suspicious operation Enter the preset machine learning engine with malicious operations for training to obtain the first classification model; input the malicious sequence into the first classification model again, classify the type of ransomware on the first classification model, and obtain the second classification model; Input the operation sequence into the second classification model, and if it is a sequence generated by ransomware, an early warning will be given. The invention collects suspicious sequences through the honeypot system, and determines the malicious sequence after playback through the sandbox system, and then inputs the normal sequence, suspicious sequence and malicious sequence into the supervised machine learning engine for training, and obtains a method that can distinguish between normal operations and malicious operations of viruses The first classification model of the first classification model, and then split the first classification model based on the virus type to obtain the second classification model, so the present invention can effectively target the existing ransomware without knowing the prior characteristics of the ransomware , its variants, or new ransomware viruses.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings on the premise of not paying creative efforts.

Fig. 1 is the schematic flow chart of an embodiment of a kind of blackmail virus monitoring method provided by the present invention;

Fig. 2 is a schematic flow chart of another embodiment of a ransomware monitoring method provided by the present invention;

Fig. 3 is a schematic structural diagram of an embodiment of a ransomware monitoring device provided by the present invention.

Detailed ways

The embodiments of the present invention provide a ransomware virus monitoring method and device, which can effectively monitor existing ransomware viruses, their variants, or new ransomware viruses.

In order to make the purpose, features and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the following The described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Referring to Fig. 1, an embodiment of a method for monitoring ransomware provided by the present invention includes:

101. After detecting that there is a suspicious operation on the honeypot system, obtain a suspicious sequence corresponding to the suspicious operation;

102. Initialize the sandbox system, input the suspicious sequence into the sandbox system for replay, if the replayed result and the suspicious sequence meet the preset malicious conditions, then determine the suspicious sequence as a malicious sequence;

103. After obtaining the normal sequence corresponding to the normal operation on the user system, input the normal operation, suspicious operation and malicious operation into the preset machine learning engine for training to obtain the first classification model;

104. Input the malicious sequence into the first classification model again, classify the type of ransomware on the first classification model, and obtain the second classification model;

105. Input the operation sequence on the user system into the second classification model, and give an early warning if it is a sequence generated by a ransomware virus.

It should be noted that the honeypot system is used to obtain attack behaviors that exploit unknown vulnerabilities in the network. The honeypot is deployed in a network that is expected to monitor ransomware. It can be used as a honeypot device network or a single honeypot device Form presented. Honeypots run conventional operating systems, including Linux or Windows, etc.; run typical system software and application software, including database systems, control systems, office systems, file editing systems, etc. The operating system running in the honeypot is pre-implanted with software probes, and the probes are used to collect events generated in the system, including at least network operation events, file operation events, process operation events, and key API call events.

The sandbox system is used to record and analyze the operation behavior of the ransomware virus on a single device. The device is installed with a conventional operating system, including Linux or Windows operating system, and runs typical system software and application software, including database systems, control class system, office system, file editing system, etc. The sandbox can effectively execute issued computer instructions, capture and record the state of the system (memory and file system snapshots), the sandbox can set the initial state, can set the state at any time during the storage operation, and can After performing several restores to the set state.

The machine learning engine is used to conduct supervised training on the input event sequence and corresponding labels to form a classification model of ransomware and normal behavior. The machine learning engine performs unsupervised training on the event sequence according to its similarity to form a classification model between different ransomware. For a sequence of events of a specified software, the machine learning engine is used to reason about it and determine whether it is ransomware.

The invention collects suspicious sequences through the honeypot system, and determines the malicious sequence after playback through the sandbox system, and then inputs the normal sequence, suspicious sequence and malicious sequence into the supervised machine learning engine for training, and obtains a method that can distinguish between normal operations and malicious operations of viruses The first classification model of the first classification model, and then split the first classification model based on the virus type to obtain the second classification model, so the present invention can effectively target the existing ransomware without knowing the prior characteristics of the ransomware , its variants, or new ransomware viruses.

The above is an embodiment of a method for monitoring a ransomware virus. For a more specific description, another embodiment of a method for monitoring a ransomware virus is provided below, please refer to FIG. Another embodiment includes:

201. After detecting that there is a suspicious operation on the honeypot system, obtain a suspicious sequence corresponding to the suspicious operation;

In this embodiment, a honeypot system, a sandbox system, and a user system are deployed in the detected target network, and the honeypot system is set to have no user operation. The event sequence of each process running on it can be collected through the honeypot system, and whether there is any operation on key data such as user files, database files, configuration files, etc., if there is, it is called a suspicious operation, and the suspicious operation is obtained. Suspicious sequence of operations.

202. Initialize the sandbox system, input the suspicious sequence into the sandbox system for replay, if the state of the replayed file is a preset malicious state, and the suspicious sequence contains a subsequence of encrypted API calls, then determine that the suspicious sequence is a malicious sequence ;

In this embodiment, since the suspicious operation is not necessarily performed by a ransomware virus, the present invention inputs the suspicious sequence into the sandbox system for replay by initializing the sandbox system, if the replayed file status is deleted Or cannot be opened or opened abnormally, and the suspicious sequence includes a subsequence of the encrypted API call, then it is determined that the suspicious sequence is a malicious sequence, that is, a malicious sequence caused by a ransomware virus.

203. After obtaining the normal sequence corresponding to the normal operation on the user system, input the normal operation, suspicious operation and malicious operation into the preset machine learning engine for training to obtain the first classification model;

After the malicious sequence is determined, it is necessary to collect the normal event sequence of each process running on the user system, that is, the normal sequence. Then input the normal operation, suspicious operation and malicious operation into the preset machine learning engine for training to obtain the first classification model. It can be understood that the first classification model can be used to classify operations of ransomware malicious programs, normal operations, and suspicious operations (performed by non-ransomware).

204. Input the malicious sequence into the first classification model again, calculate the sequence similarity between the malicious sequences by word embedding, classify the type of ransomware on the first classification model according to the sequence similarity, and obtain the second classification model;

After obtaining the first classification model, the malicious sequence can be input to the first classification model again. Since the malicious sequence usually contains multiple sequences and can be generated by different types of ransomware, the present invention calculates According to the sequence similarity, the similar sequences are classified according to the sequence similarity, that is, the classification of the ransomware type is completed on the first classification model, and the second classification model is obtained.

205. Input the operation sequence on the user system into the second classification model, and give an early warning if it is a sequence generated by a ransomware virus.

After obtaining the second classification model, it can be used to monitor the operation sequence on the user system. If it is a sequence generated by a ransomware virus, the corresponding process can be found and an early warning can be given

Furthermore, after step 205, it also includes:

206. Input the sequence generated by the ransomware virus into the second classification model to update the model.

Since the ransomware in step 205 may be a new type of ransomware, its corresponding sequence can be input into the second split model for incremental training to update the model.

Furthermore, after step 205, it also includes:

207. Generate a monitoring report for ransomware.

After it is determined that the operation is caused by the ransomware, a monitoring report of the ransomware can be generated for users to review.

The invention collects suspicious sequences through the honeypot system, and determines the malicious sequence after playback through the sandbox system, and then inputs the normal sequence, suspicious sequence and malicious sequence into the supervised machine learning engine for training, and obtains a method that can distinguish between normal operations and malicious operations of viruses The first classification model of the first classification model, and then split the first classification model based on the virus type to obtain the second classification model, so the present invention can effectively target the existing ransomware without knowing the prior characteristics of the ransomware , its variants, or new ransomware viruses.

The above is a detailed description of a blackmail virus monitoring method provided by the present invention. The structure and connection relationship of a blackmail virus monitoring device provided by the present invention will be described below. Please refer to Figure 3, a blackmail virus provided by the present invention One embodiment of the monitoring device includes:

The obtaining module 301 is configured to obtain a suspicious sequence corresponding to the suspicious operation after monitoring that there is a suspicious operation on the honeypot system;

The replay module 302 is used to initialize the sandbox system, input the suspicious sequence into the sandbox system for replay, and if the replayed result and the suspicious sequence meet preset malicious conditions, then determine that the suspicious sequence is a malicious sequence;

The training module 303 is used to obtain the normal sequence corresponding to the normal operation on the user system, input the normal operation, suspicious operation and malicious operation into the preset machine learning engine for training, and obtain the first classification model;

The classification module 304 is used to input the malicious sequence to the first classification model again, classify the type of ransomware virus to the first classification model, and obtain the second classification model;

The monitoring module 305 is used to input the operation sequence on the user system into the second classification model, and if it is a sequence generated by a ransomware virus, it will give an early warning.

Furthermore, the replay module 302 is also used to initialize the sandbox system, and input the suspicious sequence into the sandbox system for replay. sequence, the suspicious sequence is determined to be a malicious sequence.

Furthermore, the preset malicious state is deleted or cannot be opened or opened abnormally.

Furthermore, the classification module 304 is configured to input the malicious sequence to the first classification model again, calculate the sequence similarity between the malicious sequences by word embedding, and classify the type of ransomware to the first classification model according to the sequence similarity , to get the second classification model.

Furthermore, a ransomware monitoring device provided by the present invention also includes:

The update module is used to input the sequence generated by the ransomware virus into the second classification model for model update.

Furthermore, a ransomware monitoring device provided by the present invention also includes:

The generation module is used to generate the monitoring report of ransomware.

Another embodiment of a ransomware monitoring device provided by the present invention includes a processor and a memory, and computer program instructions are stored in the memory, and when the program instructions are executed by the processor, the method for monitoring ransomware as described above is realized.

The present invention also relates to a computer-readable storage medium, on which computer program instructions are stored, and when the program instructions are executed by a processor, the method for monitoring ransomware as described above is realized.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, and other media that can store program codes.

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still understand the foregoing The technical solutions recorded in each embodiment are modified, or some of the technical features are replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. A ransomware virus monitoring method, is characterized in that, comprises: After detecting that there is a suspicious operation on the honeypot system, obtaining a suspicious sequence corresponding to the suspicious operation; Initializing the sandbox system, inputting the suspicious sequence into the sandbox system for replay, and determining that the suspicious sequence is a malicious sequence if the replayed result and the suspicious sequence meet preset malicious conditions; After obtaining the normal sequence corresponding to the normal operation on the user system, input the normal operation, the suspicious operation and the malicious operation into a preset machine learning engine for training to obtain a first classification model; Input the malicious sequence to the first classification model again, and classify the type of ransomware to the first classification model to obtain a second classification model; The step of classifying the type of ransomware on the first classification model includes: Classify the type of ransomware on the first classification model based on the sequence similarity; The classification of the ransomware type of the first classification model based on the sequence similarity is specifically: Calculate the sequence similarity between the malicious sequences by word embedding, and classify the first classification model according to the sequence similarity to the type of ransomware; The operation sequence on the user system is input into the second classification model, and if it is a sequence generated by a ransomware virus, an early warning is given. 2. The ransomware monitoring method according to claim 1, characterized in that if the replayed result and the suspicious sequence meet the preset malicious conditions, it is specifically: If the state of the file to be played back is a preset malicious state, and the suspicious sequence includes a subsequence of an encrypted API call. 3. The ransomware monitoring method according to claim 2, wherein the preset malicious state is deleted or cannot be opened or opened abnormally. 4. The ransomware monitoring method according to any one of claims 1 to 3, characterized in that, if the operation sequence on the user system is input into the second classification model, if it is a sequence generated by a ransomware, After warning, it also includes: Inputting the sequence generated by the ransomware into the second classification model for model update. 5. The ransomware monitoring method according to any one of claims 1 to 3, wherein the input of the operation sequence on the user system into the second classification model, if it is a sequence generated by a ransomware, After warning, it also includes: A monitoring report of the ransomware is generated. 6. A ransomware monitoring device, comprising: The obtaining module is used to obtain a suspicious sequence corresponding to the suspicious operation after monitoring that there is a suspicious operation on the honeypot system; A replay module, configured to initialize a sandbox system, input the suspicious sequence into the sandbox system for replay, and if the replayed result and the suspicious sequence meet preset malicious conditions, then determine that the suspicious sequence is malicious sequence; The training module is used to obtain the normal sequence corresponding to the normal operation on the user system, input the normal operation, the suspicious operation and the malicious operation into a preset machine learning engine for training, and obtain the first classification model; A classification module, configured to input the malicious sequence into the first classification model again, classify the type of ransomware on the first classification model, and obtain a second classification model; The classification module is specifically used for: Input the malicious sequence to the first classification model again, and classify the type of ransomware to the first classification model based on sequence similarity to obtain a second classification model; The classification of the ransomware type by the first classification model based on the sequence similarity is specifically: Calculate the sequence similarity between the malicious sequences by word embedding, and classify the first classification model according to the sequence similarity to the type of ransomware; The monitoring module is used to input the operation sequence on the user system into the second classification model, and give an early warning if it is a sequence generated by a ransomware virus. 7. A ransomware monitoring device, characterized in that it includes a processor and a memory, and computer program instructions are stored on the memory, and when the program instructions are executed by the processor, any of claims 1 to 5 can be realized. A described ransomware monitoring method. 8. A computer-readable storage medium, wherein computer program instructions are stored on the medium, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 5 is realized. Ransomware monitoring method.