TW202307703A - Method for preventing data kidnapping and related computer program - Google Patents

Abstract

A method for preventing data kidnapping and related computer program are disclosed. The method includes the steps: (a) setting a protected directory and protected files with a designated extension in the protected directory; (b) creating a target directory in a root directory or a user directory where the protected directory is located, wherein a first character of the name of the directory is ranked higher than a first character of the names of all directories in the root directory or the user directory in the Unicode character list; (c) creating at least 100 target files with the specified extension in the target directory; (d) cyclically creating an image file with a first frequency for all the protected files in the protected directory are storing them in a designated space; (e) checking if specific target files in the target directory with a second frequency whether they have been modified or deleted; and (f) if the total number of modified or deleted target files checked in step (e) reaches a specific value, stopping creating the image file and setting the handle values of these protected files to restrict writing.

Description

Method for preventing data hijacking and related computer program

The present invention relates to an information operation method and related computer program products, especially a method for preventing data hijacking and related computer program products.

In today's advanced information technology, information security is very important. From small electronic products for personal use to large public projects at the national level, if the software or data used by them is "hacked", the corresponding services may be reduced in performance or even shut down. A common hacker method is to invade the host computer through the network, and use malicious software to encrypt the data in the storage device (such as hard disk, SSD) through the loopholes or special settings of the operating system, so that the host computer cannot operate. This is the so-called data kidnapping. These hackers who launch cyber attacks can demand a ransom from the owner of the computer host, and only after receiving the ransom will they decrypt the data and restore the system to normal.

After invading the host computer, these malicious software will encrypt the data in the computer storage device according to certain rules. Since the host computer will display different characteristics from normal operation during the execution process, some cloud anti-hacking systems can monitor these characteristics and propose relative protective measures against malicious software to ensure information security. But on the other hand, these cloud anti-hacking systems may also obtain or even steal user data, which has become another security concern. Therefore, in order to solve this contradictory problem, it is better to have stand-alone applications to prevent malware data hijacking, and these applications only set operations within the scope allowed by the user. The present invention is a novel solution.

This paragraph extracts and compiles certain features of the present invention. Other features will be disclosed in subsequent paragraphs. It is intended to cover various modifications and similar arrangements within the spirit and scope of the appended claims.

In order to meet the aforementioned needs, the present invention discloses a method for preventing data hijacking, which includes the steps of: a) setting a protected directory and a protected file with a designated extension in the protected directory in the file system of a computer; b) Create a target directory in the root directory or user directory where the protected directory is located. The first character of the name of the target directory is higher than the first character of the names of all directories in the root directory or user directory. The order of the element in the Unicode character list is first; c) create at least 100 target files with the specified extension in the target directory; d) all protected files in the protected directory with a first Make an image file in a frequency cycle and store it in a designated space; e) Check the target directory with a second frequency, whether the first A and the last B target files read according to the file name have been modified or deleted, wherein A and B are positive integers; and f) if the total number of modified or deleted target files in step e) reaches C, the control codes of these protected files are set to restrict writing, where C is a positive integer Not greater than A and not greater than B.

The aforementioned method for preventing data hijacking can further include steps after step d): d1) check whether there is any modified or deleted person in the protected file, and if so, it will be modified in the image file made in the next cycle or deleted protected files are listed in an area to be deleted; and d2) repeat step d), and judge whether the modified or deleted target file is restored to its original state before the image file is made in the next next round: if not, then The modified or deleted subject file is deleted from the area to be deleted, and moved back to its original position; if so, the subject file to be modified or deleted is deleted from the area to be deleted, and the current system of all protected files at that time is followed. into an image file.

If there is a unique name in the root directory or user directory where the first character of the name of the directory is in the same order as the first character of the name of the target directory in the Unicode character list, the name of the target directory From the second character of the Unicode character list, the first character in the Unicode character list will be used until a certain character after the second character of the target directory name is in the Unicode character list. Sort first.

Preferably, A is 5, B is 5, and C is 3; the size of each target file is not less than 64kB; the designated space is a storage device not attached to the computer or a cloud storage platform; the first frequency is at least every 10 once a minute; the second frequency is at least once every 100 microseconds.

The present invention also discloses a computer program, including readable codes, installed in a computer. When the readable codes are run in the computer, the processor of the computer executes the aforementioned data hijacking prevention method.

Preferably, when the aforementioned readable codes are running in the computer, the processor of the computer displays an operation interface on a screen, and the operation interface guides the user to set the protected directory and the protected file.

Since the method for preventing data hijacking is executed by a computer program running on a single machine, it will not cause the situation of stealing user data. In addition, the present invention provides double protection for protected files, which is the first in the industry.

The present invention will be described more specifically by referring to the following embodiments.

Please refer to FIG. 1 , which is a flow chart of a method for preventing data hijacking (hereinafter referred to as the method) according to an embodiment of the present invention. In practice, the method is implemented by installing a computer program in a computer, and when the computer executes the computer program. The first step of the method is to set a protected directory and a protected file with a designated extension in the protected directory in the file system of a computer (S01). In order to have a better understanding of this, please refer to Figure 2, which shows the application scenario of this method. In FIG. 2, a computer 1 has a hard disk 2, which is a physical device for storing data. The magnetic fields in the hard disk can be effectively managed through the operating system of the computer 1, so that data (files) whose structure is a combination of 0 and 1 can be stored, and the location where the file exists can be pointed to for reading and writing. According to the present invention, the protected object is the specified file in the specified protected directory, not all the files stored in the hard disk 2 . According to hackers' intrusion methods, if kidnapping is used, it is usually encrypted for a file with a specific file name, so that the file cannot be read and forms useless data. File extensions that are commonly kidnapped include doc, xls, bin, rft, pdf, dbf, jpg, dwg, cdr, psd, cd, mdb, png, lcd, zip, rar, csv, log, etc. The designation of the extension in step S01. Users of this computer program can set the protected directory. In Figure 2, the hard disk of computer 1 is logically divided into a system slot 21 (C slot) and a file slot 22 (D slot). The system slot 21 and the file slot 22 are both a "directory" (root directory). . Taking the file slot 22 as an example, in this embodiment, there are three directories whose names are "document", "!!important" and "figure". According to the requirements, the protected files that need to be protected are located in the "document" directory, which is the so-called protected directory. However, not all files in the protected directory are protected, only files with specified extensions are protected. In this embodiment, there are 6 files in the "document" directory, namely abc.doc, friend.doc, mydata.log, time1937.log, time245.log and ffnuefne.bin. After setting, the 3 files with the extension "log" are protected files. It should be noted that in the embodiment, only one protected directory and one protected file with a specified extension are used for illustration, but in practice, there may be multiple protected directories and multiple specified extensions at the same time.

The second step of this method is to create a target directory in the root directory or user directory where the protected directory is located. The first character of the name of the target directory is higher than that of all directories in the root directory or user directory. The first character of the name is first in the list of Unicode characters (S02). According to step S02, the computer program creates a target directory 221 named "!!!" in the file slot 22 (the root directory where the "document" directory is located). The first character of the name of the target directory 221 is "!", and its order in the Unicode character list is higher than the first character of the existing directory names "document" and "figure". However, the first character of the "!!important" directory name also happens to be "!". If no "!!important" directory exists, the name of the target directory 221 created by the computer program can simply use "!". In order to solve the problem of the name of the "!!important" directory, that is, if there is a special name directory ("!!important" directory) in the root directory, the first character of the name and the first character of the name of the target directory 221 If a character is in the same order in the Unicode character list, then the second character of the name of the target directory 221 will use the symbol that is sorted first in the Unicode character list (excluding control codes and spaces, etc. symbol"), until a certain character after the second character of the name of the target category 221 is sorted before the character in the same position of the unique name category in the Unicode character list. Since the first two characters of the "!!important" directory name are both "!", the target directory 221 must be extended to the third character with "!" to meet the above requirements. The purpose of creating the target directory 221 is to create an object that is first attacked by the hacker kidnapping software. Generally speaking, if the hijacking software wants to encrypt and hijack the files in the hard disk 2, its priority should follow the reading priority defined by the operating system, that is, the Unicode character list of the first character of the directory name. The files in the directory with the earlier sorting will be attacked first. It should be noted that the distinguished name directory may also be a protected directory. In addition, according to the present invention, if the protected directory is in the logical slot divided by the operating system, under the user directory, the target directory can also be created in the user directory. If there are more than two users who can control the computer 1 according to their accounts under the operation of the operating system, there will be more than two user directories, and the two user directories can be the application objects of the second step of the method.

Next, the third step of the method is to create at least 100 target files with the designated extension in the target directory 221 ( S03 ). For a better understanding of this step, please refer to FIG. 3 , which shows the status of the target file in the target directory 221 . In this embodiment, 1000 target files with the extension name log are created, !0000001.log, !0000002.log, ..., !0001000.log. The naming method of the target files is not limited, because these target files will be determined by the operating system when they are read in priority, and it is not necessary to specify which files will be read first, and which will be later. According to the practice of kidnapping software attacks, the files read earlier may be attacked first, and the files read later may be attacked first. It should be noted that the purpose of creating numerous target files in this step is to lure the kidnapping software to attack (encryption kidnapping), and determine whether the computer 1 is attacked by the kidnapping software by monitoring the status of these target files. When attacked by kidnapping software, the encryption time of these target files will delay the time point when the kidnapping software attacks the protected files, so that some special protection can be performed on these protected files. In terms of strategy, it is a way of confrontation in which time is exchanged for space. Since the time for encrypting a file is positively related to the file size, the size of the target file should preferably be limited to a minimum value without affecting the operation of the computer 1 and occupying too much storage space. According to the present invention, the size of each target file is preferably not less than 64kB.

In the fourth step of the method, all protected files in the protected directory are cyclically made into image files at a first frequency, and stored in a designated space (S04). In order to have a better understanding of this step, please refer to Figure 4, which shows the appearance of the image file and its storage method. According to the present invention, the designated space for storing protected files can be a storage device not attached to the computer 1 (such as a network hard disk or a portable solid-state disk), or a cloud storage platform (such as Google Drive), Save over the network. The specified space must not be attacked by hijacking software. In this embodiment, the designated space is a cloud storage platform 4 , which is connected to the computer 1 through the network 3 . The first level of protection of the protected files in the present invention is to keep them in the form of image files, and after a period of time (the first frequency), make another image file for these protected files, and restore them when necessary. According to the invention, the first frequency is at least once every 10 minutes. However, according to actual needs, it may also be once every hour, depending on the workload of the computer 1 and the possibility of being attacked.

Then, the fifth step of the method is to check with a second frequency whether the first A and the last B read target files according to the file names in the target directory have been modified or deleted, wherein A and B are positive integers (S05 ). This step is mainly to continuously observe whether the target files that are most likely to be attacked by the kidnapping software are subjected to encryption attacks in a very short period of time. In practice, the second frequency is at least once every 100 microseconds. This is a very fast speed, so the number of target directories that can be monitored will not be too many without affecting the performance of the computer 1 . In this embodiment, A is 5 and B is 5, that is, whether the first 5 and the last 5 read target files (shown by the dotted line in FIG. 3 ) are modified or deleted according to the file name. If these target files are modified or deleted, it may be attacked by hijacking software. It is worth noting that although this step is executed after the image file is created, step S04 is continuously performed simultaneously with this step, and there is only a difference in the start-up time. This step is also continuously repeated.

The last step of this method is to set the control codes (handles) of these protected files to restrict writing if the total number of the checked target files has been modified or deleted in step S05, and stop making images file, wherein C is a positive integer not greater than A and not greater than B (S06). In this embodiment, the value of C is 3 (it is not limited to this in practice, but can vary with A and B). That is, when the computer program finds that 3 of the top 5 or bottom 5 read target files according to the file name have been modified or deleted during an observation, it is determined that the kidnapping software is already attacking. At this time, since the kidnapping software has to encrypt other target files in the target directory 221 within a short period of time, and there is still time to protect the protected files in the computer 1, the computer program will obtain the protected files through the operating system. Control codes are quickly locked to restrict writing. In this way, the kidnapping software cannot encrypt these protected files afterwards. Here it is the second protection of the present invention to protected archives. The purpose of stopping the production of image files is that if the attack speed of the kidnapping software is still too fast, causing some protected files to be encrypted, and unfortunately the image file is being produced at this time, the latest image file may contain Part of the kidnapped protected file. In order to prevent this from happening, the best way to do it is to stop making image files. After all the attacked situations are cleared up, this method is enabled, and the image file will continue to be made cyclically.

According to the present invention, if a protected file is accidentally deleted or rewritten by the user or the file is lost due to damage to the magnetic sector of the storage device, the storage method in the image file can be slightly modified to determine the cause and take appropriate measures . Therefore, the method may further include two steps after step S04. First, check whether the protected files have been modified or deleted, and if so, list the modified or deleted protected files in an area 4a to be deleted in the image file made in the next cycle (S041). For details on this step, please refer to Figure 4 again. When the current image file is created, the image file including mydata.log, time1937.log and time245.log is stored in the first storage area 41 (physical storage area) of the cloud storage platform 4 . Before the next round of image file is made, the computer program finds that time1937.log has been modified through the operating system, and the new time1937.log will be pulled into the area 4a to be deleted for storage in the next round of image file, and the next round of image file will be The whole is stored in the second storage area 42 (logically, the image file of the next round will overwrite the image file of the current round). Then, repeat step S04, and judge whether this modified or deleted target file is restored to its original state before the image file is made in the next next round: if not, then the modified or deleted target file is deleted from the area 4a to be deleted , move back to the original position; if so, delete the modified or deleted target file from the to-be-deleted area 4a and make an image file according to the current status of all protected files at that time (S042). In the case of "No", that is, it is confirmed that time1937.log has disappeared or been modified due to non-hacker attacks, and the new time1937.log file will be deleted from the area 4a to be deleted, and moved back to the one made in the next round In the image file (in the case of disappearance, the area 4a to be deleted is empty, and the position of the original time1937.log file in the image file made in the next round is also empty). In the case of "Yes", that is, it is confirmed that the time1937.log disappears or the reason for the modification does not exist. At this time, the computer program deletes the new time1937.log file in the area 4a to be deleted, and continues to follow the step S04 for the protected file. Make an image file. As shown in Figure 4, now the user has added a protected file time359. image file overwrite).

It should be noted that steps S041 and S042 may occur before step S05 , between step S05 and step S06 , or even after step S06 , and there is no fixed timing.

The aforementioned computer program includes readable codes and is installed in the computer 1. When the readable codes are run in the computer 1, the processor of the computer 1 can execute the above-mentioned method for preventing data hijacking. Preferably, when the aforementioned readable codes are running in the computer 1, the processor of the computer 1 can also display an operation interface on a screen (not shown), the operation interface can guide the user to set the protected directory and the protected directory. file.

Although the present invention has been disclosed above in terms of implementation, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, The scope of protection of the present invention should be defined by the scope of the appended patent application.

1: computer 2: hard disk 21: System slot 22: File slot 221: Target directory 3: Internet 4: Cloud storage platform 4a: area to be deleted 41: The first storage area 42: The second storage area 43: The third storage area S01~S06: Steps

FIG. 1 is a flowchart of a method for preventing data hijacking according to an embodiment of the present invention.

FIG. 2 shows an application scenario of the method for preventing data hijacking.

FIG. 3 shows the appearance of object files in an object directory.

FIG. 4 shows the appearance of the image file and its storage method.

S01~S06: Steps

Claims (10)

A method for preventing data hijacking, comprising steps: a) Setting up a protected directory and a protected file with a designated extension in the protected directory in the file system of a computer; b) Create a target directory in the root directory or user directory where the protected directory is located. The first character of the name of the target directory is higher than the first character of the names of all directories in the root directory or user directory. Elements are sorted first in the list of Unicode characters; c) Create at least 100 target files with the specified extension in the target directory; d) All protected files in the protected directory are cycled into image files at a first frequency and stored in a designated space; e) Check with a second frequency whether the first A and last B target files read according to the file name in the target directory have been modified or deleted, wherein A and B are positive integers; and f) If the total number of modified or deleted target files under inspection in step e) reaches C, set the control codes of these protected files to restrict writing, and stop making image files, where C is a positive integer Not greater than A and not greater than B. The method for preventing data hijacking as described in claim item 1 further includes steps after step d): d1) Check if any of the protected files has been modified or deleted, and if so, list the modified or deleted protected files in an area to be deleted in the image file made in the next cycle; and d2) Repeat step d), and judge whether the modified or deleted target file is restored to its original state before the image file is made in the next round: if not, then delete the modified or deleted target file from the area to be deleted , move back to the original position; if so, delete the modified or deleted target file from the area to be deleted and make an image file according to the status of all protected files at that time. The method for preventing data hijacking as described in claim item 1, if the first character of the name of a special name directory and the first character of the name of the target directory exist in the Unicode character in the root directory or user directory If the ordering in the meta list is the same, the first character in the Unicode character list will be used from the second character of the name of the target directory until a character after the second character of the name of the target directory is more specific than the character Characters at the same position in the name directory are sorted first in the Unicode character list. The method for preventing data hijacking as described in Claim 1, wherein A is 5, B is 5, and C is 3. The method for preventing data hijacking as described in Claim 1, wherein the size of each target file is not less than 64kB. The method for preventing data hijacking as described in Claim 1, wherein the designated space is a storage device not attached to the computer or a cloud storage platform. The method for preventing data hijacking according to claim 1, wherein the first frequency is at least once every 10 minutes. The method for preventing data hijacking according to claim 1, wherein the second frequency is at least once every 100 microseconds. A computer program, including readable codes, installed in a computer, when the aforementioned readable codes are run in the computer, the processor of the computer executes the anti-data hijacking described in any of the request items 1 to 8 Methods. The method for preventing data hijacking as described in claim 9, wherein when the aforementioned readable code is running in the computer, the processor of the computer displays an operation interface on a screen, and the operation interface guides the user to set the protected directory and the protected file.

Images