Method for ransomware strike detection and defense, and ransomware security operations center (SOC)
The application discloses a ransomware security operations center that execute a method for ransomware strike detection and defense. The ransom-SOC leverages honey folders and files, a decoy to detect whether an ongoing ransomware strike is occurring, and local data hiding, a technique that exploits the design flaw of ransomware to enable local data backup subtly, such that ransomware can be detect earlier, the impact of the ransomware infection on the target systems can be reduced, and the critical data survival time for server and workstation can be kept longer during a ransomware strike. The prototype and experiment results suggest that the ransomware security operations center is feasible and can achieve a high data recovery rate on critical files.
1. A method for ransomware defending, comprising:
creating a bait for attracting ransomware;
collecting logs of the bait;
recognizing an information entropy of the bait, according to the logs of the bait;
activating a backup operation, in response to the change of the information entropy reached the preset change threshold;
hiding a target data to a plurality of file protectors that are not encrypted by the ransomware;
wherein the whole target data is separated into several parts and hid to different file protectors; and the file protector is a file type that is not targeted by the ransomware under a file folder that is not targeted by the ransomware.
2. The method according to claim 1 , wherein the backup operation comprise:
encrypting the target data;
equally splitting the target data into n partitions;
appending n splits of the target data to a file header that are not targeted by the ransomware,
saving to targeted folder that are not targeted by the ransomware as backup.
3. The method according to claim 2 , wherein the file types and/or folders that are not targeted by the ransomware are recorded in an untargeted-object list which is generated by an analyze result of the ransomware.
4. The method according to claim 3 , wherein the method further comprises:
updating the untargeted-object list on a regular basis.
5. The method according to claim 1 , wherein the backup operation comprises:
transferring a target file to remote backup repository.
6. The method according to claim 1 , wherein the method further comprises:
activating the backup operation on a regular basis.
7. The method according to claim 1 , wherein the method further comprises:
activating a defense operation and sending a notice of ransomware strike, in response to the change of the information entropy reached the preset change threshold;
wherein the defense operation comprises: resetting password, disabling remote desktop connection, and unmounting and disconnecting all network drives.
8. The method according to claim 1 , wherein the bait comprises honeypot host and honey folders and files deployed in system.
9. A ransomware security operations center (SOC), comprises:
a logs collector configured to collect logs of the bait;
a logs analyzer configured to analyze file edition activities of the logs;
a comparison configured to monitor whether change of the information entropy is reached the preset change threshold and check whether a blacklisted ransomware file extension appear;
a data backup orchestra center configured to activate a backup operation, in response to the change of the information entropy reached the preset change threshold;
wherein the backup operation comprises:
hiding a target data to a plurality of file protectors that are not encrypted by the ransomware;
wherein the whole target data is separated into several parts and hid to different file protectors; and the file protector is a file type that is not targeted by the ransomware under a file folder that is not targeted by the ransomware.
10. The ransomware security operations center according to claim 9 , wherein the ransomware security operations center further comprise:
a ransomware sandbox;
a file protector definition generator configured to generate a untargeted-object list recording a plurality of file types and folders that are not encrypted by the ransomware.
11. The ransomware security operations center according to claim 10 , wherein the data backup orchestra center is configured to hide a target file to a plurality of file types that are not targeted by the ransomware under different file folders that are not targeted by the ransomware, when the backup operation is activated.
12. The ransomware security operations center according to claim 9 , wherein the data backup orchestra center is configured to transfer a target file to remote backup repository when the backup operation is activated.
13. The ransomware security operations center according to claim 9 , wherein the ransomware security operations center further comprise:
a defense command orchestra center configured to activate a defense operation, in response to the change of the information entropy reached the preset change threshold;
a notification center configured to send a notice of ransomware strike, in response to the change of the information entropy reached the preset change threshold.
14. The ransomware security operations center according to claim 9 , wherein the bait comprises honeypot host and honey folders and files deployed in system.
15. The ransomware security operations center according to claim 9 , wherein the data backup orchestra center is configured to activate a backup operation on a regular basis.
16. An electronic device, comprises:
a memory storing computer programs;
a processor coupled to the memory; wherein execution of the computer programs by the processor, causes the processor to:
creating a bait for attracting ransomware;
collecting logs of the bait;
recognizing an information entropy of the bait, according to the logs of the bait;
activating a backup operation, in response to the change of the information entropy reached the preset change threshold;
and activating a restoration;
wherein the backup operation comprises:
hiding a target data to a plurality of file protectors that are not encrypted by the ransomware;
wherein the whole target data is separated into several parts and hid to different file protectors; and the file protector is a file type that is not targeted by the ransomware under a file folder that is not targeted by the ransomware;
wherein the restoration comprises:
for every protected target data:
removing the file header from a protected file split
combining n splits of file
decrypting and outputting a restored file.
17. The electronic device according to claim 16 , wherein the backup operation comprises:
hiding a target data to a plurality of file protectors that are not encrypted by the ransomware.
18. The electronic device according to claim 17 , wherein the file protector is file types and/or folders that are not targeted by the ransomware, and the file types and folders are recorded in a untargeted-object list which is generated by an analyze result of the ransomware.