基于学习集成的备份系统勒索软件检测框架研究  

Researchon ransomware detection framework for backup system based on learning integration

作　　者：王伟 钟保强 谭毅恺 蔡泽晗 何倩 WANG Wei;ZHONG Baoqiang;TAN Yikai;CAI Zehan;HE Qian(Information Communication Branch of China Southern Power Grid Peak shaving Frequency Modulation Power Generation Co.,Ltd.,Guangzhou 510630,China;China Southern Power Grid Peak shaving Frequency Modulation Power Generation Co.,Ltd.,Guangzhou 511400,China)

机构地区：[1]南方电网调峰调频发电有限公司信息通信分公司,广州510630 [2]南方电网调峰调频发电有限公司,广州511400

出　　处：《自动化与仪器仪表》2023年第9期74-77,共4页Automation & Instrumentation

基　　金：信息系统建设灾备系统采购及实施(ZCNT00351-P-CT-0022-0)。

摘　　要：当前,勒索软件攻击被全球企业和机构视为最大的网络威胁之一。针对备份系统的勒索软件检测问题,融合勒索软件的静态特征和动态特征,结合多种机器学习的相关智能计算算法方法,对机器学习算法进行集成,提出了基于学习集成的勒索检测框架,智能化地对海量数据的云备份系统进行勒索检测与识别,总体上提高了备份系统的勒索软件的识别速率和系统整体安全性。可应用于大规模虚拟化和云数据中心的防勒索备份和恢复,连续数据保护。Currently,ransomware attacks are considered one of the biggest cyber threats by businesses and institutions around the world.Aiming at the ransomware detection problem of the backup system,integrating the static and dynamic characteristics of the ransomware,combining the relevant intelligent computing algorithm methods of a variety of machine learning,the machine learning algorithm is integrated,and the ransomware detection framework based on learning integration is proposed,which intelligently detects and identifies the cloud backup system of massive data,and generally improves the recognition rate of the ransomware of the backup system and the overall security of the system.The proposed framework can be applied to anti-ransomware backup and recovery for large-scale virtualized and cloud data centers,as well as continuous data protection.

关 键 词：勒索软件 学习集成 备份系统 检测框架 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]