ARS:基于文件行为的勒索软件主动防御技术研究  

ARS:research on proactive defense technology of ransomware based on file behavior

作　　者：田锋 周安民 刘亮 张磊 TIAN Feng;ZHOU An-Min;LIU Liang;ZHANG Lei(College of Cybersecurity,Sichuan University,Chengdu 610065,China)

机构地区：[1]四川大学网络空间安全学院,成都610065

出　　处：《四川大学学报（自然科学版）》2021年第2期91-99,共9页Journal of Sichuan University(Natural Science Edition)

基　　金：国家重点研发计划(2017YFB0802900)。

摘　　要：针对勒索软件(Ransomware)造成的安全威胁问题,本文在分析多种勒索软件家族攻击特点和传统恶意代码检测技术的基础上,提出一种基于文件行为的勒索软件主动防御技术(Anti-Ransomware System,ARS).该技术采用基于文件行为统计异常的方法进行勒索软件检测,通过文件过滤驱动收集正常软件与勒索软件动态文件行为信息用作训练集,使用多种分类算法训练并生成勒索软件检测分类器,用于运行时检测勒索软件.利用写时复制技术动态备份程序运行时修改的文件,根据检测结果决定是否恢复文件.最后,设计实现原型系统并进行了测试.实验结果表明,在确保数据文件安全性的前提下,ARS能够有效地防御勒索软件,减小勒索软件攻击的危害.In order to reduce the loss caused by the attack of ransomware,this paper proposed a framework(Anti-Ransomware System,ARS)based on the family characteristics and the traditional malicious code detection technology.Specifically,a method is proposed to detect ransomware based on file behavior statistics.It uses the minifilter to collect the file behavior information of benign and ransomware as train set,and uses a variety of supervised classification algorithms to train classifier for run-time detection.Then,the copy-on-write technology is utilized to dynamically backup modified files in the program at runtime,and the detection results are used to determine whether to restore files.Finally,a prototype system is developed and tested.The results show that,under the premise of ensuring the security of the data file,the ARS framework can effectively prevent the ransomware attack and reduce the harm of ransomware.

关 键 词：勒索软件 文件行为 主动防御 分类算法 文件过滤驱动 

分 类 号：TP391.1[自动化与计算机技术—计算机应用技术]