CN117938434A - A ransomware collaborative protection system based on cloud computing platform - Google Patents

Abstract

The present invention discloses a ransomware collaborative protection system based on a cloud computing platform, including: a cloud backup module, a bait capture module, a security center module and a collaborative protection module. The cloud backup module is a cloud backup product provided by a cloud vendor, and the cloud backup module includes cloud host backup, cloud hard disk backup, file backup and database backup. The present invention solves the problem of utilizing the advantages of the cloud computing platform to provide comprehensive ransomware protection for the cloud services of an enterprise, improve the timeliness and accuracy of ransomware detection, enhance the security and recoverability of enterprise data, and has higher efficiency and better effects than existing general protection means, and realizes rapid response and collaborative protection of all hosts under the cloud platform, and realizes efficient, reliable backup and rapid recovery of data. This module can provide a bottom line when all other protection measures fail, avoid data loss and damage, and provide users with a last line of defense.

Description

A ransomware collaborative protection system based on cloud computing platform

Technical Field

The present invention relates to the technical field of ransomware collaborative protection systems, and in particular to a ransomware collaborative protection system based on a cloud computing platform.

Background technique

Ransomware is a type of malware that is contagious and destructive. Attackers usually exploit security configuration flaws and vulnerabilities of the host to invade and implant ransomware. Ransomware uses a variety of cryptographic algorithms to encrypt user data, and then intimidate, coerce, and extort high ransoms from users. It is usually spread in the form of spam, server intrusion, web page Trojans, bundled software, etc. Once attacked by a ransomware, most of the key files will be encrypted. The encrypted key files are almost impossible to decrypt by technical means. The encrypted files can only be restored by paying a high ransom to the attacker in exchange for the corresponding decryption private key. At present, there are mainly the following protection measures against ransomware:

1. Install antivirus software: By installing antivirus software, you can identify and remove known ransomware viruses.

2. Use bait files to dynamically detect ransomware behavior: By placing bait files in key locations on the host, changes to the bait files are monitored in real time (bait files are usually invalid files and users will not access these files under normal circumstances). Once the bait files are changed, it is judged as ransomware behavior.

3. Back up data regularly: By backing up data regularly, you can restore data after a ransomware incident and reduce losses.

However, these methods all have certain limitations and defects:

1. Antivirus software: It cannot identify and block unknown or variant ransomware and can be easily bypassed.

2. Bait file: Ransomware can only be identified when the ransomware accesses the bait file. When ransomware is detected, some files may have been encrypted and the loss cannot be prevented in time. In addition, users may mistakenly access the bait file, resulting in a certain probability of false alarms, which affects the user experience.

3. Regular data backup: This is only a safety measure to reduce losses. It cannot restore files to the latest state and cannot respond to ransomware incidents in real time. At the same time, this method requires a large amount of storage space and network bandwidth.

Summary of the invention

The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and invention title of this application to avoid blurring the purpose of this section specification abstract and invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

In view of the above-mentioned problems existing in the existing ransomware collaborative protection system based on a cloud computing platform, the present invention is proposed.

Therefore, the purpose of the present invention is to provide a ransomware collaborative protection system based on a cloud computing platform, which is suitable for solving the following problems: antivirus software cannot identify and intercept unknown or variant ransomware and is easily bypassed; bait files: the ransomware behavior can only be identified after the ransomware accesses the bait files; when the ransomware behavior is detected, some files may have been encrypted and the loss cannot be prevented in time; and users may mistakenly access the bait files, resulting in a certain probability of false alarms, affecting user experience; regular data backup: it is only a bottom-line measure to reduce losses, but cannot restore files to the latest state, and cannot respond to ransomware events in real time. At the same time, this method requires a large amount of storage space and network bandwidth.

In order to solve the above technical problems, the present invention provides the following technical solutions: a ransomware collaborative protection system based on a cloud computing platform, comprising: a cloud backup module, a bait capture module, a security center module and a collaborative protection module.

The cloud backup module is a cloud backup product provided by cloud vendors. The cloud backup module includes cloud host backup, cloud hard disk backup, file backup and database backup. The cloud backup module allows you to customize the backup method, backup frequency and backup scope. The cloud backup module can quickly restore data after other protection measures fail and a ransomware incident occurs, ensuring the security and integrity of the data, thereby providing the last line of defense for users.

The bait capture module is responsible for deploying some bait files on the host to dynamically detect ransomware behavior, and when ransomware behavior is detected, an alarm message is generated and reported to the security center;

The security center module is responsible for collecting and forwarding the ransom information reported by each host, analyzing and confirming the ransom information, and issuing protection instructions;

The collaborative protection module is responsible for processing the ransomware information and protection instructions issued by the security center.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the cloud backup module can utilize the powerful storage space and computing power provided by the cloud vendor to achieve high-speed data transmission and encrypted storage, and ensure the integrity and security of the data; the cloud backup module can flexibly set backup strategies and restore strategies according to user needs, realize regular data backup, and full or incremental data backup, to meet the needs of different scenarios and applications.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the cloud backup module can utilize the multi-regional or multi-availability zone characteristics provided by the cloud vendor to realize cross-regional or cross-availability zone backup and restoration of data, thereby improving data reliability and availability; the bait capture module automatically and randomly generates realistic bait files or selects bait files of appropriate types from a preset library based on the existing file types and contents and common file types on the host, and then generates bait files based on user configuration.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the user configuration includes file type, file name, and file content. When the collaborative protection module receives the suspicious program feature value issued by the security center, it will immediately scan the executable file of the currently running program and continuously monitor subsequent newly added files.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the ransomware usually traverses files in a forward or reverse order using the Unicode encoding order. For example, in the forward traversal, the file with the file name Unicode encoding ranking at the front is also at the front in the returned result. In order to ensure that the ransomware accesses the bait file first, the Unicode encoding ranking of the bait file name in the folder needs to be at the front or the end, so that it is traversed by the ransomware first. A character prefix is added to the bait file name as the first character. When the first characters of the first and last normal file names before the bait is deployed are A and B respectively, character A ranked one position higher than character A and character B ranked one position lower than character B are obtained, and then A and B are added to the bait file name as prefixes.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the bait capture module also regularly updates and replaces the bait file to improve its credibility and effectiveness. The bait file is usually stored in the system's root directory, the root directory of each drive letter, the desktop directory, the user's home directory, the system's key directory, and the user-defined directory that needs to be protected. When it is determined to be a ransomware behavior, the relevant executable program is isolated and reported to the security center.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, after the collaborative protection module receives the execution action issued by the security center, it will process it according to the action type. When the action type is release, the isolated file will be restored and added to the whitelist. When the action type is interception, the isolated file will be deleted and added to the virus library.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the bait capture module dynamically judges the ransomware behavior by monitoring the access events to the bait files. When a read operation and a write operation occur on the same bait file, it is determined to be a ransomware behavior; when a read operation and a delete operation occur on the same bait file, it is determined to be a ransomware behavior.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, after the collaborative protection module receives the suspicious program feature value issued by the security center, it will immediately scan the executable file of the currently running program and continuously monitor the subsequent newly added files. When a program or file matching the feature value is found, the running program will be terminated and the file will be isolated.

As a preferred solution of the ransomware collaborative protection system based on a cloud computing platform described in the present invention, the specific operation process is as follows:

S1. The cloud backup module backs up the key data on the host and can set the frequency, scope and method of backup according to user needs;

S2. The bait capture module generates and places some bait files on the host to attract ransomware attacks;

S3. The bait capture module monitors the access events of the bait files and detects the ransomware behavior;

S4. If the bait capture module finds ransomware behavior, it will isolate the suspicious program and report the incident to the security center for early warning;

S5. The security center distributes the suspicious program feature values to the collaborative protection modules of all hosts, achieving rapid response and collaborative protection of all hosts under the cloud platform;

S6. After receiving the suspicious program feature value sent by the security center, the collaborative protection module on the host immediately scans the executable file of the currently running program and monitors the executable files of the newly started programs on the local machine. If these programs meet the features, the program will be terminated and the corresponding executable files will be isolated as suspicious files, effectively preventing the spread and propagation of ransomware;

S7. The security center automatically analyzes and manually confirms the reported suspicious programs, and sends the results to the collaborative protection modules of all hosts for processing;

S8. The collaborative protection module on the host receives the execution action issued by the security center and executes the corresponding action. If the security center marks it as released, the isolated file is restored and added to the whitelist. If it is marked as blocked, the corresponding file is deleted and the file features are added to the virus database.

S9. If the ransomware bypasses the detection in step 3 and launches a ransomware attack on the host, or has encrypted some files on the host before the ransomware behavior is detected, data recovery can be performed using the files backed up in step 1 to reduce data loss and damage.

Beneficial effects of the present invention:

The present invention proposes a collaborative protection system for hosts against ransomware in a cloud computing environment, which includes four modules: a cloud backup module, a bait capture module, a security center module, and a collaborative protection module. The present invention fully utilizes the advantages of the cloud computing platform to provide comprehensive ransomware protection for cloud services of enterprises, improves the timeliness and accuracy of ransomware detection, and enhances the security and recoverability of enterprise data. Compared with existing general protection methods, it has higher efficiency and better effects.

The present invention proposes a collaborative protection mechanism, which uses the network communication and message transmission capabilities provided by cloud vendors to achieve rapid response and collaborative protection for all hosts under the cloud platform. This mechanism can process and block ransomware behavior as soon as it is discovered at any node, respond as quickly as possible, prevent the spread and propagation of ransomware on the cloud platform, and minimize losses.

The cloud backup module of the present invention can flexibly select backup methods and set backup strategies according to user needs with the help of mature backup products provided by cloud vendors, so as to achieve efficient and reliable backup and rapid recovery of data. The module can provide a last resort when all other protective measures fail, avoiding data loss and damage, and providing users with the last line of defense.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

FIG1 is a schematic diagram of the structure of a protection system of a ransomware collaborative protection system based on a cloud computing platform proposed by the present invention;

FIG2 is a protection system flow chart of a ransomware collaborative protection system based on a cloud computing platform proposed by the present invention.

Detailed ways

In order to make the above-mentioned objectives, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature structure or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it an embodiment that is mutually exclusive with other embodiments alone or selectively.

Secondly, the present invention is described in detail with reference to the schematic diagram. When describing the embodiments of the present invention in detail, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional space dimensions of length, width and depth should be included.

1-2, an embodiment of the present invention provides a ransomware collaborative protection system based on a cloud computing platform, including a cloud backup module, a bait capture module, a security center module and a collaborative protection module.

The cloud backup module is a cloud backup product provided by cloud vendors. The cloud backup module includes cloud host backup, cloud hard disk backup, file backup and database backup. The cloud backup module allows you to customize the backup method, backup frequency and backup scope. The cloud backup module can quickly restore data after other protection measures fail and a ransomware incident occurs, ensuring data security and integrity, thereby providing users with the last line of defense.

The bait capture module is responsible for deploying some bait files on the host to dynamically detect ransomware behavior. When ransomware behavior is detected, an alarm message is generated and reported to the security center.

The security center module is responsible for collecting and forwarding the ransomware information reported by each host, analyzing and confirming the ransomware information, and issuing protection instructions;

The collaborative protection module is responsible for processing ransomware information and protection instructions issued by the security center.

Furthermore, the cloud backup module can utilize the powerful storage space and computing power provided by cloud vendors to achieve high-speed data transmission and encrypted storage, ensuring data integrity and security; the cloud backup module can flexibly set backup strategies and restore strategies according to user needs, achieve regular data backup, as well as full or incremental data backup, to meet the needs of different scenarios and applications.

Furthermore, the cloud backup module can utilize the multi-regional or multi-availability zone features provided by cloud vendors to realize cross-regional or cross-availability zone backup and restoration of data, thereby improving data reliability and availability. The bait capture module automatically and randomly generates realistic bait files or selects appropriate types of bait files from a preset library based on the existing file types and contents on the host and common file types, and then generates bait files based on user configuration.

Furthermore, the user configuration includes the file type, file name, and file content. When the collaborative protection module receives the suspicious program feature value sent by the security center, it will immediately scan the executable file of the currently running program and continuously monitor subsequent newly added files.

Furthermore, ransomware usually uses Unicode encoding order to traverse files in forward or reverse order. For example, in forward traversal, the file with the higher Unicode encoding order of the file name is ranked, the higher it is in the returned result. In order to ensure that the ransomware accesses the bait file first, the Unicode encoding order of the bait file name in the folder needs to be at the front or the end, so that it is traversed by the ransomware first. A character prefix is added to the bait file name as the first character. When the first characters of the first and last normal file names before the bait is deployed are A and B respectively, then character A ranked one position higher than character A and character B ranked one position lower than character B are obtained, and then A and B are added as prefixes to the bait file name.

Furthermore, the bait capture module will regularly update and replace bait files to improve their credibility and effectiveness. Bait files are usually stored in the system's root directory, the root directory of each drive letter, the desktop directory, the user's home directory, the system's key directories, and user-defined directories that need to be protected. When it is determined to be a ransomware behavior, the relevant executable program will be isolated and reported to the security center.

Furthermore, after the collaborative protection module receives the execution action issued by the security center, it will process it according to the action type. When the action type is release, the isolated file will be restored and added to the whitelist. When the action type is interception, the isolated file will be deleted and added to the virus database.

Furthermore, the bait capture module dynamically judges the ransomware behavior by monitoring the access events to the bait files. When a read operation and a write operation occur on the same bait file, it is determined to be a ransomware behavior; when a read operation and a delete operation occur on the same bait file, it is determined to be a ransomware behavior.

Furthermore, when the collaborative protection module receives the suspicious program feature value sent by the security center, it will immediately scan the executable file of the currently running program and continuously monitor the subsequent newly added files. When a program or file matching the feature value is found, the running program will be terminated and the file will be isolated.

The specific embodiment operation process is as follows:

S1. The cloud backup module backs up the key data on the host and can set the frequency, scope and method of backup according to user needs;

S2. The bait capture module generates and places some bait files on the host to attract ransomware attacks;

S3. The bait capture module monitors the access events of the bait files and detects the ransomware behavior;

S4. If the bait capture module finds ransomware behavior, it will isolate the suspicious program and report the incident to the security center for early warning;

S5. The security center distributes the suspicious program feature values to the collaborative protection modules of all hosts, achieving rapid response and collaborative protection for all hosts on the cloud platform;

S6. After receiving the suspicious program feature value sent by the security center, the collaborative protection module on the host immediately scans the executable file of the currently running program and monitors the executable files of the newly started programs on the local machine. If these programs meet the features, the program will be terminated and the corresponding executable files will be isolated as suspicious files, effectively preventing the spread and propagation of ransomware;

S7. The security center automatically analyzes and manually confirms the reported suspicious programs, and sends the results to the collaborative protection modules of all hosts for processing;

S8. The collaborative protection module on the host receives the execution action issued by the security center and executes the corresponding action. If the security center marks it as released, the isolated file is restored and added to the whitelist. If it is marked as blocked, the corresponding file is deleted and the file features are added to the virus database.

S9. If the ransomware bypasses the detection in step 3 and launches a ransomware attack on the host, or has encrypted some files on the host before the ransomware behavior is detected, data recovery can be performed using the files backed up in step 1 to reduce data loss and damage.

Embodiment 2:

Compared with traditional static protection methods such as antivirus software or firewalls, the bait capture module has the following advantages:

This module can dynamically generate some bait files on the host, monitor and record the bait files, thereby building a dynamically changing bait environment that is difficult for attackers to detect, effectively attracting and identifying host ransomware viruses;

Based on the monitoring and recording of bait files, this module dynamically determines whether the files or programs on the host contain ransomware behavior and generates alarm information, thereby timely discovering and warning of host ransomware viruses;

This module can dynamically adjust the generation and distribution methods of bait files, as well as dynamic judgment rules or algorithms according to the characteristics and behaviors of different host ransomware viruses, thereby improving the detection and identification capabilities of host ransomware viruses.

Compared with traditional single-machine protection, the security center and collaborative response module have the following advantages:

The security center module can centrally manage and process alarm information from each host, achieving a global perspective and unified control of ransomware attacks on all hosts under the cloud platform;

The collaborative protection module can use the network communication and message transmission capabilities provided by cloud vendors to achieve rapid response and collaborative protection for all hosts on the cloud platform. After discovering ransomware behavior, the protection system can process and block it immediately and respond as quickly as possible to prevent the spread and propagation of ransomware on the cloud platform and minimize losses.

The security center module and the collaborative protection module can dynamically adjust the file isolation or recovery strategy according to different alarm information and processing instructions, thereby improving the flexible protection and optimized processing of all hosts under the cloud platform.

Embodiment three:

In this embodiment, it is assumed that there are three cloud hosts A, B, and C, which respectively run different services and data. The protection system provided by the invention is installed on these three hosts. The workflow is as follows:

S1: The user configures the following information according to the needs: data backup method, frequency and scope; user-defined directory where bait files need to be placed; bait file generation parameters, including bait file type, bait file name, bait file content (this configuration item can be omitted and dynamically generated by the system);

S2: The cloud backup module regularly backs up the data on hosts A, B, and C according to user configuration;

S3: The bait capture module generates multiple bait files in the following three locations of hosts A, B, and C: the root directory of the system, the desktop directory, and the user's home directory; the key directory of the system; and the directory that the user customizes to be protected. Assuming that the user sets the bait file generation parameter to be automatically generated by the system, the bait capture module will scan the file types on the local machine and randomly generate or select the corresponding type of bait files from the preset library based on the commonly used file types, add a file name prefix, and deploy them on each host;

S4: The bait capture module regularly updates the bait files to increase their credibility and effectiveness;

S5: the bait capture module monitors the access events of the bait files dynamically deployed on the local machine;

S6: Assume that a ransomware virus infects host A through the network and encrypts or deletes files on host A. Once the ransomware virus accesses the bait file, a corresponding event will be triggered. The bait capture module will determine whether ransomware behavior has occurred based on preset rules and algorithms, and exclude programs in the whitelist. If ransomware behavior exists, the bait capture module will immediately terminate the operation of the ransomware virus to prevent further losses, and encrypt its executable file and move it to the isolation directory. At the same time, the bait capture module will send alarm information to the security center, including host information, program process information, program executable file information, and bait file access action information;

S7: The security center distributes the suspicious program feature value to the collaborative protection modules of host B and host C;

S8: After receiving the suspicious program feature value sent by the security center, the collaborative protection module of host B and host C immediately scans the executable file of the currently running program and monitors the executable files of the newly started programs on the local machine. If these programs meet the features, the program will be terminated and the corresponding executable files will be isolated as suspicious files. In this way, if the ransomware infects host A and spreads horizontally to hosts B and C, the protection system can process and block it in the first time and respond as quickly as possible.

S9: The security center automatically analyzes the reported suspicious programs and prompts the user to confirm the results. After confirmation, the results are sent to the collaborative protection modules of hosts A, B, and C for processing.

S10: After receiving the execution action issued by the security center, the collaborative protection modules on hosts A, B, and C execute the corresponding action. If the security center marks it as released, the isolated file is restored and added to the whitelist. If it is marked as blocked, the corresponding file is deleted and the file features are added to the virus database.

S11: If the ransomware bypasses the detection in step 6 and launches a ransomware attack on the host, or some files on the host have been encrypted before the ransomware behavior is detected, data recovery is performed using the files backed up in step 2.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims (10)

1. A ransomware collaborative protection system based on a cloud computing platform, characterized in that it includes: a cloud backup module, a bait capture module, a security center module and a collaborative protection module, The cloud backup module is a cloud backup product provided by cloud vendors. The cloud backup module includes cloud host backup, cloud hard disk backup, file backup and database backup. The cloud backup module allows you to customize the backup method, backup frequency and backup scope. The cloud backup module can quickly restore data after other protection measures fail and a ransomware incident occurs, ensuring the security and integrity of the data, thereby providing the last line of defense for users. The bait capture module is responsible for deploying some bait files on the host to dynamically detect ransomware behavior, and when ransomware behavior is detected, an alarm message is generated and reported to the security center; The security center module is responsible for collecting and forwarding the ransom information reported by each host, analyzing and confirming the ransom information, and issuing protection instructions; The collaborative protection module is responsible for processing the ransomware information and protection instructions issued by the security center. 2. According to the ransomware collaborative protection system based on the cloud computing platform of claim 1, it is characterized in that: the cloud backup module can utilize the powerful storage space and computing power provided by the cloud vendor to realize high-speed transmission and encrypted storage of data, and ensure the integrity and security of the data; the cloud backup module can flexibly set the backup strategy and restore strategy according to the needs of the user, realize the regular backup of data, and the full or incremental backup of data, to meet the needs of different scenarios and applications. 3. According to claim 1, a ransomware collaborative protection system based on a cloud computing platform is characterized in that: the cloud backup module can utilize the multi-regional or multi-availability zone characteristics provided by the cloud vendor to realize cross-regional or cross-availability zone backup and restoration of data, thereby improving data reliability and availability; the bait capture module automatically and randomly generates realistic bait files or selects bait files of appropriate types from a preset library based on existing file types and contents and common file types on the host, and then generates bait files according to user configuration. 4. According to claim 1, a ransomware collaborative protection system based on a cloud computing platform is characterized in that: the user configuration includes file type, file name, and file content. When the collaborative protection module receives the suspicious program feature value issued by the security center, it will immediately scan the executable file of the currently running program and continuously monitor subsequent newly added files. 5. According to claim 1, a ransomware virus collaborative protection system based on a cloud computing platform is characterized in that: the ransomware usually uses Unicode encoding order to traverse files in forward or reverse order. For example, in forward traversal, the file with the file name Unicode encoding ranking at the front is also at the front in the returned result. In order to ensure that the ransomware accesses the bait file first, the Unicode encoding ranking of the bait file name in the folder needs to be at the front or the end, so that it is traversed by the ransomware first, and a character prefix is added to the bait file name as the first character. When the first characters of the first and last normal file names before deploying the bait are A and B respectively, then character A ranked higher than character A by one position, and character B ranked lower than character B by one position are obtained, and then A and B are added to the bait file name as prefixes. 6. According to claim 5, a ransomware collaborative protection system based on a cloud computing platform is characterized in that: the bait capture module will also regularly update and replace the bait file to improve its credibility and effectiveness. The bait file is usually stored in the system's root directory, the root directory of each drive letter, the desktop directory, the user's home directory, the system's key directory, and the user-defined directory that needs to be protected. When it is determined to be a ransomware behavior, the relevant executable program is isolated and reported to the security center. 7. According to claim 1, a ransomware collaborative protection system based on a cloud computing platform is characterized in that after the collaborative protection module receives the execution action issued by the security center, it will process it according to the action type. When the action type is release, the isolated file will be restored and added to the whitelist. When the action type is interception, the isolated file will be deleted and added to the virus library. 8. According to the ransomware collaborative protection system based on the cloud computing platform of claim 1, it is characterized in that: the bait capture module dynamically judges the ransomware behavior by monitoring the access events to the bait files. When a read operation and a write operation occur on the same bait file, it is determined as a ransomware behavior; when a read operation and a delete operation occur on the same bait file, it is determined as a ransomware behavior. 9. According to the ransomware collaborative protection system based on the cloud computing platform of claim 1, it is characterized in that: after the collaborative protection module receives the suspicious program feature value issued by the security center, it will immediately scan the executable file of the currently running program and continuously monitor the subsequent newly added files. When a program or file matching the feature value is found, the running program will be terminated and the file will be isolated. 10. A ransomware collaborative protection system based on a cloud computing platform according to any one of claims 1 to 9, characterized in that the specific operation process of the system is as follows: S1. The cloud backup module backs up the key data on the host and can set the frequency, scope and method of backup according to user needs; S2. The bait capture module generates and places some bait files on the host to attract ransomware attacks; S3. The bait capture module monitors the access events of the bait files and detects the ransomware behavior; S4. If the bait capture module finds ransomware behavior, it will isolate the suspicious program and report the incident to the security center for early warning; S5. The security center distributes the suspicious program feature values to the collaborative protection modules of all hosts, achieving rapid response and collaborative protection for all hosts on the cloud platform; S6. After receiving the suspicious program feature value sent by the security center, the collaborative protection module on the host immediately scans the executable file of the currently running program and monitors the executable files of the newly started programs on the local machine. If these programs meet the features, the program will be terminated and the corresponding executable files will be isolated as suspicious files, effectively preventing the spread and propagation of ransomware; S7. The security center automatically analyzes and manually confirms the reported suspicious programs, and sends the results to the collaborative protection modules of all hosts for processing; S8. The collaborative protection module on the host receives the execution action issued by the security center and executes the corresponding action. If the security center marks it as released, the isolated file is restored and added to the whitelist. If it is marked as blocked, the corresponding file is deleted and the file features are added to the virus database. S9. If the ransomware bypasses the detection in step 3 and launches a ransomware attack on the host, or has encrypted some files on the host before the ransomware behavior is detected, data recovery can be performed using the files backed up in step 1 to reduce data loss and damage.