WO2024250745A1 - Ransomware detection method, distributed system, and computer-readable storage medium - Google Patents

Abstract

Provided in the present application are a ransomware detection method and a related device. The method is applied to a backup detection system, the backup detection system being used for performing ransomware detection on backup data in a backup storage system, and the backup data being the backup of service data. The method comprises: acquiring backup data; performing ransomware detection on the backup data; on the basis of a private key, acquiring target backup data and a signature of label information thereof, the label information of the target backup data being used for indicating that the target backup data has passed the ransomware detection; and sending the target backup data, the label information and the signature to an isolation storage system, the signature being used for the isolation storage system to verify the signature on the basis of a public key and store the target backup data after the verification succeeds, and the public key and the private key being a matched key pair. Therefore, signing the backup data by means of the backup detection system can ensure that the backup data which has passed the signature verification of the isolation storage system and is stored by same has not attacked by the ransomware, thus enabling a service system to perform data recovery after passing of the signature verification.

Description

Ransomware detection method, distributed system and computer-readable storage medium

This application claims priority to the Chinese patent application filed with the Chinese Patent Office on June 8, 2023, with application number 202310678119.3 and application name “A method, device and other equipment for virus detection”, and claims priority to the Chinese patent application filed with the Chinese Patent Office on October 26, 2023, with application number 202311405723.5 and application name “Ransomware detection method, distributed system and computer-readable storage medium”, the entire contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the field of security technology, and in particular to a ransomware detection method, a distributed system, and a computer-readable storage medium.

Background Art

Ransomware, also known as ransomware virus, is a type of malware, especially encryption ransomware, which hijacks the victim's data by encrypting files and requires the victim to pay a high ransom to restore the data.

Anti-ransomware attacks are achieved by quickly detecting and backing up the business data in the business system in the backup storage system. When the business data in the business system is attacked and contaminated by ransomware, the business data can be restored using the backup copy data in the backup storage system. However, once the backup copy data is encrypted and contaminated by ransomware, the business data cannot be restored, affecting business continuity. Therefore, it is necessary to detect ransomware attacks on the backup data in the backup storage system, and after confirming that the backup data is free of ransomware attacks, the backup data is transferred to a secure isolated storage system. However, when the backup data is transferred to the isolated storage system or to the business system for data recovery, it may be contaminated by ransomware, resulting in failure of business data recovery.

Summary of the invention

The present application provides a ransomware detection method, apparatus and other devices, which can ensure that backup data that has not been detected by ransomware is stored in an isolated storage system based on signature verification, so as to be used for data recovery in the business system and ensure business continuity.

In a first aspect, a ransomware detection method is provided, which is applied to a backup detection system. The backup detection system is used to perform ransomware detection on backup data in a backup storage system, wherein the backup data is a backup of business data, and the method comprises: the backup detection system obtains the backup data; the backup detection system performs ransomware detection on the backup data; the backup detection system obtains a signature of the target backup data and the label information of the target backup data based on a private key, wherein the label information of the target backup data is used to indicate that the target backup data passes the ransomware detection; the backup detection system sends the target backup data, the label information and the signature to an isolated storage system, wherein the signature is used by the isolated storage system to verify the signature based on a public key and store the target backup data after successful verification, wherein the public key is a key pair that matches the private key.

In this embodiment, the backup detection system performs ransomware detection on the backup data stored in the backup storage system. In order to prevent the backup data in the backup storage system from being attacked by ransomware, in addition to performing backup storage in the backup storage system, a separate physical isolation area can also be established to store the target backup data that has passed the ransomware detection of the backup detection system in the isolation storage system. After the backup detection system performs ransomware detection, the target backup data that has passed the ransomware detection is signed using a signature private key. Before the isolation storage system stores the target backup data, it uses a locally preset public key to verify the signature, which can ensure that the backup data stored in the isolation storage system has not been attacked by ransomware, so as to be used for data recovery in the business system and ensure business continuity.

In some possible implementations, the backup detection system obtains signatures of target backup data and label information of the target backup data based on a private key, including: the backup detection system calculates a first hash value of the target backup data and its label information.

In this implementation, before the backup detection system uses a private key to sign the target backup data and label information, the backup detection system first calculates the first hash value of the target backup data and its label information, and then sends the first hash value to the key management system for signing based on the private key, which can reduce network bandwidth and transmission overhead.

In some possible implementations, after the backup detection system calculates the first hash value of the target backup data and the tag information, it includes: the backup detection system sends the first hash value to a key management system, wherein the key management system is used to sign the first hash value based on a private key and send the signature to the backup detection system.

In this implementation, the backup detection system sends the first hash value to the key management system, which uses a digital signature algorithm to generate a private key and a public key for signature verification. The private key is used to sign the target backup data and label information, and the public key is used for signature verification.

In some possible implementations, after the backup detection system calculates the first Hash value of the target backup data and the tag information, the backup detection system obtains a private key from a key management system, and the backup detection system signs the first Hash value based on the private key.

In this implementation, after the backup detection system calculates the first hash value of the target backup data and label information, it can initiate a key acquisition request to the key management system. The key management system can generate a private key and a public key for signature verification, or send the private key imported by the user through a local trusted encryption machine and through the configuration interface or application programming interface (API) of the key management system to the backup detection system.

In some possible implementations, the signature is used to isolate the target backup data. When a second hash value calculated by the storage system based on the target backup data and the tag information is the same as a first hash value obtained by verifying the signature based on the public key, the target backup data is stored.

In this implementation, before storing the target backup data, the isolated storage system verifies the target backup data and the signature based on the public key, thereby verifying whether the target backup data has been attacked by ransomware during the process of being transmitted from the backup detection system to the isolated storage system. After the public key verification is successful, that is, it is determined that the target backup data has not been attacked by ransomware, the target backup data is stored in the isolated storage system, and after the business data of the business system is attacked by ransomware, it can be restored based on the target backup data stored in the isolated storage system. The ransomware detection method of signature verification can ensure that the backup data stored in the isolated storage system has not been attacked by ransomware.

In some possible implementations, the private key is generated by a key management system, or the private key is imported into the key management system by a user.

In this implementation, the key management system uses a certain digital signature algorithm to generate a private key and a public key for signature verification. The private key is used to sign the target backup data and label information, and the public key is used to verify the signature. Alternatively, the user generates a private key and a public key for signature verification through a local trusted encryption machine, and imports the private key and public key generated by the local encryption machine through the configuration interface or API of the key management system. The private key is used to sign the target backup data and label information, and the public key is used to verify the signature.

In a second aspect, a ransomware detection method is provided, which is applied to an isolated storage system, and the method includes: the isolated storage system receives target backup data, label information of the target backup data, and a signature of the target backup data, wherein the label information is used to indicate that the target backup data has passed the ransomware detection of the backup detection system, and the signature is obtained by the backup detection system signing the target backup data and the label information based on a private key; the isolated storage system verifies the signature based on a public key, and the public key is a key pair matching the private key; if the verification is successful, the isolated storage system stores the target backup data; the isolated storage system receives a recovery request from the business system, and the recovery request is used to obtain the target backup data; the isolated storage system sends the target backup data, the label information and the signature to the business system according to the recovery request, wherein the signature is used for the business system to verify based on the public key and to use the target backup data for data recovery after the verification is successful.

In this embodiment, in order to prevent the backup data in the backup storage system from being attacked by ransomware, in addition to backup storage in the backup storage system, a separate physically isolated area can also be established to store the backup data. The isolated storage system receives the target backup data and signature that have not been attacked by ransomware after detection by the ransomware, which are sent by the backup detection system. Before storing the target backup data, the isolated storage system verifies the target backup data and signature based on the public key, and stores the verified target backup data in the isolated storage system, so that the business data of the business system can be restored based on the target backup data after being attacked by ransomware. Before using the target backup data for data recovery, the business system also verifies the target backup data and signature based on the public key, and after determining that the target backup data has not been attacked by ransomware, it uses the target backup data for data recovery, thereby ensuring successful recovery of the business data.

In some possible implementations, the isolated storage system verifies the signature based on the public key, including: the isolated storage system calculates a first hash value of the target backup data and the tag information.

In this implementation, the isolated storage system located in the physically isolated area is disconnected from the Internet, and the isolated storage system calculates the first hash value of the target backup data and the label information.

In some possible implementations, after the isolated storage system calculates the first hash value of the target backup data and the tag information, the method further includes: the isolated storage system verifies the signature based on the public key and obtains a second hash value, and compares the second hash value with the first hash value.

In this implementation, the isolated storage system verifies the signature sent by the backup detection system based on the public key to obtain a second hash value, wherein the public key and the private key signed by the backup detection system are a matching key pair, and is compared with the first hash value. When the first hash value and the second hash value are the same, it means that the backup target data has not been destroyed or tampered with during the process of being sent from the backup detection system to the isolated storage system, that is, it has not been attacked by ransomware, that is, the signature verification is successful; when the first hash value and the second hash value are different, the backup target data may have been destroyed or tampered with, that is, it may have been attacked by ransomware, that is, the signature verification fails.

In some possible implementations, if the verification is successful, the isolated storage system stores the target backup data, including: if the second hash value is the same as the first hash value, the isolated storage system stores the target backup data.

In this implementation, after the isolated storage system successfully verifies based on the public key, that is, the target backup data has not been attacked by ransomware, the target backup data is stored in the isolated storage system. After the business data of the business system is attacked by ransomware, it can be restored based on the target backup data stored in the isolated storage system.

In some possible implementations, when the second hash value obtained by the signature based on the public key verification by the business system is the same as the third hash value calculated based on the target backup data and the tag information, the target backup data is used for data recovery.

In this implementation, the business system receives the target backup data, label information and signature sent by the isolated storage system, and then uses the target backup data, label information and signature to Before restoring the backup data, the target backup data and signature are verified based on the public key to verify whether the target backup data has been attacked by ransomware during the process of transferring from the isolated storage system to the business system for data recovery. The public key and the private key used by the backup detection system to obtain the signature are a matching key pair, which are generated based on the same signature algorithm. After the public key verification is successful, that is, after determining that the target backup data has not been attacked by ransomware, the target backup data is used for data recovery.

In some possible implementations, the private key is generated by a key management system, or the private key is imported into the key management system by a user.

In this implementation, the key management system uses a certain digital signature algorithm to generate a private key and a public key for signature verification. The private key is used to sign the target backup data and label information, and the public key is used to verify the signature. Alternatively, the user generates a private key and a public key for signature verification through a local trusted encryption machine, and imports the private key and public key generated by the local encryption machine through the configuration interface or API of the key management system. The private key is used to sign the target backup data and label information, and the public key is used to verify the signature.

In a third aspect, a ransomware detection device is provided, characterized in that the device is applied to a backup detection system, the backup detection system is used to perform ransomware detection on backup data in a backup storage system, the backup data is a backup of business data, and the device includes: an acquisition module, used to acquire backup data; a processing module, used to perform ransomware detection on backup data; the acquisition module is also used to acquire signatures of target backup data and label information of target backup data based on a private key, wherein the label information of the target backup data is used to indicate that the target backup data passes the ransomware detection; a sending module is used to send the target backup data, label information and signature to an isolated storage system, wherein the signature is used for the isolated storage system to verify the signature based on a public key and store the target backup data after successful verification, and the public key is a key pair matching the private key.

In a fourth aspect, a ransomware detection device is provided, characterized in that the device is applied to an isolated storage system, and the device includes: a receiving module, used to receive target backup data, label information of the target backup data, and a signature of the target backup data, wherein the label information is used to indicate that the target backup data has passed the ransomware detection of the backup detection system, and the signature is obtained by signing the target backup data and the label information by the backup detection system based on a private key; a processing module, used to verify the signature based on a public key, and the public key is a key pair matching the private key; if the verification is successful, the processing module is also used to store the target backup data; the receiving module is also used to receive a recovery request from the business system, and the recovery request is used to obtain the target backup data; the processing module is also used to send the target backup data, label information and signature to the business system according to the recovery request, and the signature is used for the business system to verify based on the public key and use the target backup data for data recovery after the verification is successful.

Regarding the technical principles and beneficial effects of the third and fourth aspects, reference may be made to the relevant descriptions of the first and second aspects, which will not be repeated here.

In a fifth aspect, the present application provides a computing device cluster, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method of the above-mentioned first aspect or any one of the implementation methods of the first aspect.

In a sixth aspect, the present application provides a computing device cluster, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method of the above-mentioned second aspect or any one of the implementation methods of the second aspect.

In a seventh aspect, the present application provides a computer program product comprising instructions, which, when executed by a computer device cluster, enables the computer device cluster to execute the method of the above-mentioned first aspect or any one of the implementation modes of the first aspect.

In an eighth aspect, the present application provides a computer program product comprising instructions, which, when executed by a computer device cluster, enables the computer device cluster to execute the method of the second aspect or any one of the implementation modes of the second aspect.

In a ninth aspect, the present application provides a computer-readable storage medium, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method of the above-mentioned first aspect or any one of the implementation methods of the first aspect.

In a tenth aspect, the present application provides a computer-readable storage medium, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method of the above-mentioned first aspect or any one of the implementation methods of the first aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

FIG1 is a schematic diagram of an architecture of ransomware detection involved in the present application.

FIG2 is a schematic diagram of an architecture of ransomware detection provided by the present application.

FIG3 is a flow chart of a ransomware detection method provided by the present application.

FIG4 is a flow chart of a ransomware detection method according to another embodiment of the present application.

FIG5 is a schematic diagram of a signature process according to an embodiment of the present application.

FIG6 is a flow chart of a ransomware detection method according to another embodiment of the present application.

FIG. 7 is a flow chart of a ransomware detection method according to another embodiment of the present application.

FIG8 is a schematic diagram of a signature verification process according to an embodiment of the present application.

FIG. 9 is a flow chart of a ransomware detection method according to another embodiment of the present application.

FIG. 10 is a flow chart of a ransomware detection method according to another embodiment of the present application.

FIG11 is a schematic diagram of the structure of a ransomware detection device provided by the present application.

FIG. 12 is a schematic diagram of the structure of another ransomware detection device provided in the present application.

FIG13 is a schematic diagram of the structure of a computing device provided by the present application.

FIG. 14 is a schematic diagram of the structure of a computing device cluster provided in the present application.

FIG. 15 is a schematic diagram of a structure in which computing devices are connected via a network provided by the present application.

DETAILED DESCRIPTION

The term "and/or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol "/" in this article indicates that the associated objects are in an or relationship, for example, A/B means A or B.

The terms "first", "second", etc. in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of objects. For example, a first request and a second request are used to distinguish different requests rather than to describe a specific order of requests.

In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

The present application provides a ransomware detection method, device and other equipment, which will be described below in conjunction with the accompanying drawings.

In order to make the technical solution provided by the present application clearer, before describing the technical solution provided by the present application in detail, the relevant terms are first explained.

(1) Ransomware: Also known as ransomware or ransomware, it is a special type of malware, usually classified as a "denial-of-access attack". The biggest difference between ransomware and other viruses lies in the method and the way they infect. Among them, a typical ransomware is to systematically encrypt files stored on a computing device, such as critical business/data files, which can be one or more of database files, office documents, compressed files, videos, images, and source code, and then require the victim to pay a ransom to retrieve the decryption password/tool that the victim has no way of obtaining on his own in order to decrypt the file.

(2) Signature: A signature is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also a valid proof of the authenticity of the information sent by the sender. A signature is an alphanumeric string obtained by processing the information to be transmitted through a one-way function. It is used to authenticate the source of the information and verify whether the information has changed during the transmission process. Common signature algorithms include: RSA (Rivest–Shamir–Adleman), DSA (Digital Signature Algorithm), and ECDSA (Elliptic Curve Digital Signature Algorithm). Signature verification is used to determine whether the data has been tampered with.

(3) Asymmetric cryptography: It is a cryptographic algorithm that requires two keys, one is a public key and the other is a private key. The public key is used for encryption and the private key is used for decryption. The ciphertext obtained by encrypting the plaintext with the public key can only be decrypted with the corresponding private key to obtain the original plaintext. The public key originally used for encryption cannot be used for decryption. Since encryption and decryption require two different keys, it is called asymmetric encryption; it is different from symmetric encryption that uses the same key for both encryption and decryption. The public key can be made public and can be released to the outside at will. The private key cannot be made public and must be kept strictly confidential by the user. It must never be provided to anyone through any means, nor disclosed to the trusted other party to communicate.

(4) Key Management Service (KMS): It is a secure, reliable, and easy-to-use key hosting service that can create and manage keys and protect the security of keys. KMS protects key security by using a hardware security module (HSM) to help users create and manage keys. All user keys are protected by the root key in the HSM to prevent key leakage.

Ransomware uses encryption and other security mechanisms to hijack user files and related resources, making it impossible for users to access data assets or use computing resources, and then uses this as a condition to extort ransom from users. This type of user data assets includes documents, databases, source code, images, compressed files and other file formats. The ransom is usually in the form of Bitcoin, and a few are real currencies or other virtual currencies.

Ransomware can be divided into three categories according to the severity of the damage it causes: scare-type ransomware, lock-type ransomware, and encryption-type ransomware. Ransomware. Intimidation-type ransomware is a type of false information warning that harms victims through accusatory words, using the victims' fear of being arrested by relevant government departments to make them pay. Locking-type ransomware hijacks one or more services on the victim's system, such as the desktop, input devices, or applications, preventing users from accessing these resources. The infected system has only limited functions. Encryption-type ransomware uses encryption algorithms to encrypt all file data in the system, forcing victims to pay a ransom in exchange for encrypted files. Without the decryption key, the attack of encryption ransomware is irreversible.

In order to avoid ransomware, traditional anti-ransomware attacks use firewalls, sandboxes, and other systems at the network layer to prevent ransomware intrusion and block the spread of ransomware. At the host layer, access control, security patches, antivirus software and other technologies are used to prevent ransomware attacks from being implanted. However, ransomware is concealed and disguised. Once it enters the network or host layer, the attacker will lurk until he obtains permission and has a large amount of key data before launching the ransomware. At this time, the network or host layer can no longer initiate and prevent the ransomware attack.

At this stage, storage anti-ransomware can be used to prevent ransomware attacks. Storage anti-ransomware measures include detecting abnormal IO of ransomware software, actively protecting data with anti-tampering technology, and preventing stored data leakage through encryption technology. Secondly, in addition to backing up data copies, data copies will be stored in physically isolated security protection areas to ensure that the copy files in the security protection area are data that has not been attacked by ransomware, and can be used to restore business data after the business data is attacked by ransomware, ensuring business continuity.

As shown in FIG1 , after the production host in the business system 110 generates business data and enters the production storage device, it can back up the generated business data and store it in the backup storage device of the backup storage system 120 in the same region (region), which can ensure that after the production host is attacked by ransomware, the business data can be restored according to the backup data in the backup storage device to ensure the normal operation of the production host. As shown in FIG1 , in region A, the production host generates business data and stores it in the production storage device. In the process of storing the business data in the production storage device, ransomware detection is performed based on the behavior of the ransomware to ensure that the business data stored in the production storage device is safe. After the business data is detected by ransomware, step 2 is performed regularly to back up the business data, and the backup data is stored in the backup storage device of the backup storage system 120 through the internal storage network. Although the internal storage network is closed and isolated from the external network, the ransomware is concealed and latent, and the production host cannot prevent the ransomware attack, resulting in that part of the business data stored in the production storage device may have been attacked by ransomware. In addition, during the backup process in step 2, the business data may also be attacked by ransomware, resulting in the backup data stored in the backup storage device being attacked by ransomware. Therefore, it is necessary to perform steps 3 and 4 so that the ransomware detection module of the backup detection system 130 regularly performs ransomware detection on the backup data stored in the backup storage device and returns the detection results, wherein the ransomware detection module can be deployed on the application server in region A. In order to avoid ransomware, in addition to performing backup storage in the backup storage system 120, step 5 can also be performed to establish a separate physical isolation area, and the backup data that has not been ransomed after ransomware detection can be copied to the isolated storage device of the isolated storage system 140 through the Air Gap automatic shutdown control. Secondly, in order to avoid data loss due to failures caused by natural disasters in region A, the business data can be backed up in step 6 and stored in the disaster recovery storage device in the disaster recovery storage device system 150 of region B. When the business data of the production storage device of the business system 110 in region A is attacked by ransomware, the business data can be restored using backup data through steps 7 to 9 shown in Figure 1 to ensure the normal operation of the business.

However, after being detected by the ransomware detection system, the backup data that has not been ransomed may be attacked by ransomware again when being stored in the isolated storage device of the isolated storage system 140, or when restoring business data from the isolated storage system to the production host of the business system 110, causing the backup data stored in the isolated storage device of the isolated storage system 140 to be contaminated by the ransomware, or causing the business data recovery in the production host of the business system 110 to fail.

In order to prevent the backup data that has not been ransomed from being attacked by ransomware during circulation, the embodiment of the present application proposes a ransomware detection method. By introducing a key management system, after the backup detection system performs ransomware detection, the backup data that has not been attacked by ransomware is signed. Before the isolated storage system stores the backup data, or before restoring the business data from the isolated storage system to the business system, it is necessary to verify the signature to ensure that the backup data is stored in the isolated storage system or the business data is restored in the business system after the signature verification is passed. In addition, based on the backup detection system, ransomware detection can be performed only on the backup data that has not been signed, avoiding the full detection of backup data or repeated detection of backup data, which leads to waste of computing and storage resources.

For ease of understanding, at least one application scenario of an embodiment of the present application is first introduced below.

Exemplarily, FIG2 shows a schematic diagram of at least one application scenario in an embodiment of the present application. As shown in FIG2, the business data of the user through the production host in the business system 110 will be stored in the production storage device, and the production storage device provides cloud storage services for the user's business data, wherein the production storage device can be deployed in a distributed storage system, and the user's business data can be distributed and stored on multiple independent storage nodes, and each storage node can communicate and interact with each other. It can be understood that a storage node is a device that has both computing and storage capabilities, such as a server, a desktop computer, etc. In terms of software, each storage device has an operating system that can support the provision of corresponding storage application services. For example, a service layer can be deployed to provide storage services such as object storage OBS, file storage SFS, or block storage EVS. Other storage nodes can deploy a data persistence layer to provide persistent data storage functions, and can also deploy an index layer to provide data indexing functions. It can be understood that The computing resources required by the software layer on each storage device come from the local processor and memory of the device, and the required storage resources can come from the local hard disk of the device or from the hard disk of other storage devices.

In order to prevent the business data in the business system 110 from being attacked by ransomware and affecting the normal business operation of users, the business data in the business system 110 will be regularly backed up to the backup storage device in the backup storage system 120 located in the same region regionA. The backup storage device is similar to the production storage device and will not be repeated here. Among them, the backup storage device and the production storage device can be located in the same availability zone (AZ) of the same region (region), or in different AZs of the same region, and there is no restriction here. However, since the business data in the business system 110 may have been attacked by ransomware, or the business data may be attacked by ransomware during the process of backing up to the backup storage system 120, the backup data stored in the backup storage system 120 will be backup data that has been attacked by ransomware. Therefore, the backup detection system 130 needs to perform ransomware detection on the backup data in the backup storage system 120 based on the file characteristics of the backup data. Among them, ransomware detection based on the file characteristics of the backup data is because the ransomware attack will leave ransomware prompt information in the backup data or affect the file characteristics of the backup data.

In order to prevent the backup data in the backup storage system 120 from being attacked by ransomware, in addition to performing backup storage in the backup storage system 120, a separate physical isolation area can also be established. Through the automatic shutdown control of Air Gap, the backup data in the backup storage system 120 that has not been attacked by ransomware after being detected by the ransomware can be copied to the isolated storage device of the isolated storage system 140 located in the same region A for storage. The isolated storage device is similar to the production storage device and will not be described here. Through Air Gap, the backup data in the isolated storage system 140 is disconnected from the Internet, which can prevent the backup data from being accessed online, thereby preventing the backup data from being attacked by ransomware. When the business data of the production storage device of the business system 110 is attacked by ransomware, it can be restored based on the backup data in the isolated storage device of the isolated storage system 140.

In some embodiments, in addition to backing up business data in the same region, a disaster recovery backup system or data center can also be established in another region regionB, that is, another geographical location, and the backup data that has been detected for ransomware can be copied across regions to the disaster recovery storage system 150 located in regionB to ensure that after a failure or disaster occurs in the business system 110 and the backup storage system 120 located in regionA, the production business can restore the business data based on the backup data in the disaster recovery storage device of the disaster recovery storage system 150 and continue to run the production business.

In some possible implementations, the disaster recovery storage system 150 may also establish a separate physically isolated area in region B, and use Air Gap to automatically shut down and control the backup data in the disaster recovery storage device that has not been attacked by ransomware, which is similar to the isolated storage system 140 and will not be described in detail here.

Since, after being detected by the ransomware detection system, the backup data that has not been ransomed is stored in the isolated storage device of the isolated storage system 140, or in the process of restoring business data from the isolated storage system to the production host of the business system 110, the backup data may be attacked by ransomware again, resulting in the backup data stored in the isolated storage device of the isolated storage system 140 being contaminated by ransomware, or causing the business data recovery in the production host of the business system 110 to fail. After the backup detection system 130 performs ransomware detection, the key management system 210 signs the backup data that has not been attacked by ransomware using the signature private key. Before the isolated storage system 140 stores the backup data, or before the business system 110 restores the backup data from the isolated storage system 140, the local preset public key is used or the key management system 210 is requested to perform signature verification, and the backup data is stored in the isolated storage system or the business data is restored in the business system after the signature verification is passed.

In this example, the backup detection system 130 can be implemented by software or hardware. As a specific example, the backup detection system 130 can be deployed on one or more execution machines, which can be physical machines, virtual machines, or containers.

In this embodiment, the storage device may also be deployed in a centralized storage system. For example, a user may store business data in a production storage device and store backup data of the business data in a backup storage device.

Next, based on the above description, a ransomware detection method provided by an embodiment of the present application is introduced. It can be understood that the method is proposed based on the above description, and part or all of the content of the method can be referred to the above description.

For example, FIG3 shows a flow chart of a ransomware detection method provided in an embodiment of the present application. It is understood that the method can be implemented in any suitable device, equipment, platform or device cluster with computing, processing and storage capabilities. As shown in FIG3, the method may include steps S301 to S306:

Step S301: The backup detection system obtains backup data.

In this embodiment, the backup detection system and the isolated storage system are independent systems. In the ransomware detection scenario, when the user's business data is backed up in the backup storage system, in order to ensure the security of the backup data, the backup detection system can be used to regularly perform ransomware detection on the backup data in the backup storage system, and then the backup data that has not been attacked by the ransomware is stored in the isolated storage system for storage, so as to perform data recovery after a failure occurs in the business data in the business system. In the example of the present application, the business system can be the business system 110 shown in FIG. 2, the backup storage system can be the backup storage system 120 shown in FIG. 2, the backup detection system can be the backup detection system 130 shown in FIG. 2, and the isolated storage system can be the isolated storage system 140 shown in FIG. 2, which is also used as an example for explanation below.

In the embodiment of the present application, the user sends the business data to the backup storage system 120 for backup storage, and the backup storage system 120 stores the business data in the backup storage system 120. The backup data of the business data is stored in the backup storage device. Before the user sends the business data to the backup storage system 120, the user will perform a ransomware detection in advance based on the behavior of the ransomware.

For example, ransomware uses an encryption algorithm to encrypt business data in the business system 110, forcing the user to pay a ransom in exchange for the encrypted business data. Without a decryption key, the attack of encryption ransomware is irreversible. When the ransomware encrypts the business data, it will be recorded in the system log of the business system 110. The business system 110 can determine how the ransomware attack occurred by checking the system log, and then identify the ransomware and determine whether the business system 110 has other malware.

For example, ransomware will create a large number of new files in a short period of time, corresponding to a large number of file names. The business system 110 can be designed to check the total number of new files created in a relatively small time window (for example, within 1 minute). When the number of new files exceeds the set threshold, it is determined that the business system 110 has been attacked by ransomware.

It is understandable that the business data sent by the user to the backup storage system 120 may be business data that has not been attacked by ransomware, or business data that has been attacked by ransomware. For example, the business system 110 does not detect that the business data has been attacked by ransomware, and during the process of the business system 110 sending the business data that has not been attacked by ransomware to the backup storage system 120, the business data is attacked by ransomware, and the backup storage system 120 stores the backup data of the business data that has been attacked by ransomware.

In this embodiment, the backup storage system 120 receives the business data sent regularly by the business system 110 as backup data and stores it in the backup storage device through the internal storage network. Although the internal storage network is closed and isolated from the external network, the ransomware is concealed and latent. The business system 110 cannot prevent the ransomware attack, resulting in that part of the business data in the production storage device may have been attacked by the ransomware. In addition, in the process of the business system 110 sending business data to the backup storage system, the business data will also be attacked by the ransomware, resulting in the backup data stored in the backup storage system 120 being attacked by the ransomware. Therefore, the backup detection system 130 is required to regularly perform ransomware detection on the backup data stored in the backup storage system 120 and return the detection results to the backup storage system.

Step S302: the backup detection system 130 performs ransomware detection on the backup data.

In this embodiment, the backup detection system 130 regularly performs ransomware detection based on the file features of the backup data stored in the backup storage device in the backup storage system 120. The ransomware detection based on the file features of the backup data is because the ransomware attack may leave ransomware prompt information in the backup data or affect the file features of the backup data.

Exemplarily, the ransomware detection based on the file features of the backup data may include file suffix detection, ransomware prompt information detection, or entropy value change detection of the previous and next backup data, but is not limited thereto.

In a specific example, the ransomware software will traverse the business data in the production storage device, or retrieve the business data in several specific directories for storing documents, and encrypt all or specific high-value business data. In addition, the ransomware software will directly modify the original business data, or write the ciphertext into another business data, and delete the original business data after encryption. Since the ransomware software usually traverses and encrypts files and reads and writes a large amount of business data, when the backup detection system 130 performs ransomware detection, if the number of business data files read and written in the process is small, the suspicion of ransomware software can be ruled out.

In a specific example, the ransomware software will place a ransomware prompt in the file directory after the encrypted ransomware attack. The ransomware prompt can be a text file or a web page file. In addition, most ransomware software will modify the desktop background or pop up a dialog box to inform the user that they have been attacked by ransomware after the ransomware encryption is completed. For example, a dialog box will pop up on the desktop to prompt the user "You have been encrypted by ransomware, do not try to decrypt, please pay the ransom." Therefore, if the backup detection system 130 observes the ransomware prompt, it can be determined that the business data may be attacked by ransomware.

In a specific example, after the ransomware software launches a ransomware attack on the business data, it will modify the file name of the business data and add a specific file suffix. Among them, adding a file suffix can be used to indicate that the business data has been encrypted to avoid repeated encryption by the ransomware software. It can also be used to prompt the user that the business data has been encrypted. It can also be used to facilitate the identification of business data that needs to be decrypted after receiving the ransom. After the ransomware software encrypts the business data, it generally adds a fixed suffix to the source file name of the business data. For example, if the source file name is report.docx, the encrypted file name is report.docx.lockbit0331. Therefore, if the backup detection system 130 detects that the file name of the business data contains a specific file suffix, it can be determined that the data has been attacked by ransom.

In a specific example, ransomware will modify the file content of business data. Since most of the files written by ransomware attack software are encrypted ciphertexts, the entropy value of ciphertexts is generally high, or ransomware attack software will write a large number of data files with different suffixes, and these data files are all high entropy values. Therefore, the backup detection system 130 can determine whether the business data is attacked by ransomware by the change of the entropy value of the business data. For example, the ransomware encrypts the original file content, and the encrypted file data has stronger randomness than the data plaintext, so the information entropy value is higher. The backup detection system 130 can determine whether it is attacked by ransomware by showing the characteristics of high entropy encrypted data.

Step S303 : the backup detection system 130 obtains the signature of the target backup data and the label information of the target backup data based on the private key.

In this embodiment, after the backup detection system 130 performs ransomware detection on the backup data, it will mark the target backup data that has passed the ransomware detection and determine the label information. In this way, the backup detection system 130 can know whether the target backup data has been ransomed based on the label information. Software attack, and then only the target backup data that has passed the ransomware detection, that is, has not been attacked by the ransomware, is sent to the isolated storage system 140.

For example, the label information may be a bit corresponding to the backup data. After the backup detection system 130 performs ransomware detection, if the backup data has not been attacked by ransomware, the bit corresponding to the backup data may be modified to "1"; if the backup data has been attacked by ransomware, the bit corresponding to the backup data may be modified to "0".

In the above example, after the backup detection system marks the backup data, it can determine whether the backup data has been attacked by ransomware based on the bit corresponding to the backup data, and then send the target backup data that has not been attacked by the ransomware to the isolated storage system 140 for isolated storage, that is, send the target backup data corresponding to the bit “1” to the isolated storage system 140.

In another example, after the backup detection system 130 performs ransomware detection, if the target backup data has not been attacked by ransomware, the target bit corresponding to the target backup data can be modified to "0"; if the target backup data has been attacked by ransomware, the target bit corresponding to the target backup data can be modified to "1", which is not specifically limited in the embodiments of the present application.

In some embodiments, when the backup detection system 130 detects that the bit corresponding to the backup data is "0", that is, the backup data is attacked by ransomware, it will issue an alarm message and send an alarm notification to remind the user that the backup data stored in the backup storage system 120 has been attacked by ransomware. Based on this alarm message, the user can re-backup the business data and store it in the backup storage system 120, or pay the ransom to decrypt the backup data.

In this embodiment, after the backup detection system 130 determines the label information of the target backup data that has passed the ransomware detection, the backup detection system 130 obtains the signature of the target backup data and its label information that has not been subjected to the ransomware detection attack, and the target backup data is calculated based on the private key. The private key can be pre-stored locally in the backup detection system, or generated by the key management system 210 based on an encryption algorithm, or the user can import his own private key into the key management system to sign the current backup data and label information.

Exemplarily, the signature algorithm may include RSA digital signature algorithm, DSA digital signature algorithm, ECDSA elliptic curve digital signature algorithm, but is not limited thereto.

In other embodiments, the signature algorithm may also include an AES256 quantum-resistant symmetric cryptographic algorithm to perform secondary protection on the signature, so that the signature integrity protection can resist quantum computing attacks.

Step S304 , the backup detection system 130 sends the target backup data, label information, and signature to the isolated storage system 140 .

In this embodiment, in order to prevent the backup data in the backup storage system 120 from being attacked by ransomware, in addition to performing backup storage in the backup storage system 120, a separate physical isolation area can also be established. Through the automatic shutdown control of Air Gap, the backup detection system sends the target backup data and signature that have not been attacked by ransomware after detection by the ransomware to the isolated storage system 140. Through Air Gap, the target backup data in the isolated storage system 140 is disconnected from the Internet, which can prevent the target backup data from being accessed online, thereby preventing the target backup data from being attacked by ransomware. When the business data of the production storage device of the business system 110 is attacked by ransomware, it can be restored based on the target backup data in the isolated storage device of the isolated storage system 140.

Step 305: The isolated storage system 140 verifies the signature based on the public key.

In this embodiment, before storing the target backup data, the isolated storage system 140 verifies the target backup data and the signature based on the public key, thereby verifying whether the target backup data is attacked by ransomware during the process of being transmitted from the backup detection system 120 to the isolated storage system 140. The public key and the private key used by the backup detection system 120 to obtain the signature are a matching key pair, which are generated based on the same signature algorithm.

Exemplarily, the private key ECDSAPrivateKey used for signing and the public key ECDSAPublicKey used for signature verification are a pair of key pairs that match each other. Accordingly, the key corresponds to a key ID (i.e., key identifier), and the key ID corresponds to a pair of public and private keys. The private key ECDSAPrivateKey is used to sign the target backup data to obtain the signature of the target backup data, and the public key ECDSAPublicKey is used to verify the signature of the target backup data, thereby verifying that the target backup data has not been attacked by ransomware.

Step S306: If the verification is successful, the isolated storage system 140 stores the target backup data.

In this embodiment, after the isolation storage system 140 successfully verifies the public key, that is, determines that the target backup data has not been attacked by ransomware, the target backup data is stored in the isolation storage system 140, so that after the business data of the business system 110 is attacked by ransomware, it can be restored based on the target backup data stored in the isolation storage system 140.

Thus, in this embodiment, the backup detection system obtains the signature of the backup data in the backup storage system, and the isolated storage system located in the physically isolated area verifies the signature based on the private key. After the signature verification is successful, the target backup data that has not been attacked by the ransomware is stored in the isolated storage system for use in restoring business data when the business system fails. The ransomware detection method of signature verification ensures that the backup data stored in the isolated storage system has not been attacked by the ransomware. In addition, when the backup detection system regularly performs ransomware detection on the backup data in the backup storage system, it only performs ransomware detection on the unsigned backup data, which can avoid the backup detection system consuming a large amount of resources for full ransomware detection, reduce computing overhead, and improve ransomware detection efficiency.

In some possible implementations, as shown in FIG. 4 , executing step S303 may specifically include steps S401 to S404:

Step S401 : the backup detection system 130 calculates a first hash value of target backup data and label information.

In this implementation, when the backup detection system 130 obtains the label information of the target backup data based on the private key, it first calculates the first hash value of the target backup data and the label information based on the digital signature algorithm.

Exemplarily, the backup detection system 130 may use a message digest algorithm (Message Digest, MD), a secure hash algorithm (Secure Hash Algorithm, SHA) or a message authentication code algorithm (Message Authentication Code, MAC) to calculate the first hash value of the target backup data and tag information, but is not limited thereto.

Step S402 : the backup detection system 130 sends the first hash value to the key management system 210 .

In this implementation, the backup detection system 130 sends the first hash value to the key management system 210, requesting the key management system 210 to sign the target backup data and label information based on the private key.

Step S403: The key management system 210 signs the first hash value based on the private key.

In this implementation, the key management system 210 receives the first hash value sent by the backup detection system 130 and signs the first hash value based on the private key.

Exemplarily, the key management system 210 generates a private key and a public key for signature verification using a certain digital signature algorithm, wherein the private key is used to sign the target backup data and label information, and the public key is used to verify the signature.

Exemplarily, the user generates a private key and a public key for signature verification through a local trusted encryption machine, and imports the private key and the public key generated by the local encryption machine through the configuration interface or API of the key management system 210. The private key is used to sign the target backup data and label information, and the public key is used for signature verification.

In step S404 , the key management system 210 sends the signature to the backup detection system 130 .

In this implementation, after the key management system 210 signs the first hash value based on the private key, the signature is sent to the backup detection system. The backup detection system 130 stores the target backup data, label information and signature in the backup detection system. In order to prevent the backup data in the backup storage system 120 from being attacked by ransomware, the target backup data and signature will be copied and stored in the isolated storage system 140, where the signature is used for the isolated storage system to verify the signature based on the public key. If the verification is successful, the isolated storage system 140 stores the target backup data, and the user business system 110 performs data recovery.

In a specific example, as shown in FIG5 , the backup detection system 130 uses the SHA-1 hash algorithm to calculate the first hash value of the target backup data and label information, also known as the message digest. The SHA-1 hash algorithm will hash the target backup data and label information of any length to obtain a pseudo-random result of a fixed length, namely the first hash value. The first hash value is unique and irreversible, and the original target backup data and label information cannot be restored from the first hash value. For example, the first hash value calculated using the SHA-1 hash algorithm is DFCD3454. The first hash value is then signed based on the private key.

In some possible implementations, as shown in FIG6 , executing step S303 may specifically include steps S601 to S603:

Step S601 : the backup detection system 130 calculates a first hash value of target backup data and label information.

In this implementation, similar to step S401, when the backup detection system 130 obtains the label information of the target backup data based on the private key, it first calculates the first hash value of the target backup data and the label information based on the digital signature algorithm.

In step S602 , the key management system 210 sends the private key to the backup detection system 130 .

In this implementation, the backup detection system 130 initiates a key acquisition request to the key management system 210. The key management system 210 can generate a private key and a public key for signature verification, or send the private key imported by the user through a local trusted encryption machine and through the configuration interface or API of the key management system 210 to the backup detection system 130.

Step S603: The backup detection system 130 signs the first hash value based on the private key.

In this implementation, the backup detection system 130 receives the private key sent by the key management system 210 and signs the first hash value.

In some possible implementation methods, as shown in FIG. 7 , executing step S305 may specifically include steps S701 to S703 .

Step S701 : The isolation storage system 140 calculates a second hash value of target backup data and tag information.

In this implementation, the isolation storage system 140 calculates the second hash value of the target backup data and the tag information. After receiving the target backup data and the tag information, the isolation storage system 140 calculates the second hash value of the target backup data and the tag information based on the same digital signature algorithm.

In the above example, the backup detection system 130 uses the SHA-1 hash algorithm to calculate the first hash value of the target backup data and the tag information. Accordingly, the isolation storage system 140 also uses the SHA-1 hash algorithm to calculate the second hash value of the target backup data and the tag information.

Step S702: The isolated storage system 140 performs signature verification based on the public key to obtain a first hash value.

In this implementation, the isolated storage system 140 verifies the signature sent by the backup detection system 130 based on the public key to obtain the first hash. Xi value, where the public key and the private key used to sign the backup detection system are a matching key pair.

Step S703 : The isolation storage system 140 compares the first hash value with the second hash value.

In this implementation, the isolated storage system 140 verifies the signature sent by the backup detection system 130 based on the public key, and after obtaining the first hash value, compares it with the calculated second hash value of the target backup data and label information. When the first hash value and the second hash value are the same, it means that the backup target data has not been destroyed or tampered with in the process of being sent from the backup detection system 130 to the isolated storage system 140, that is, it has not been attacked by ransomware, and the verification is successful; when the first hash value and the second hash value are different, the backup target data may have been destroyed or tampered with, that is, it may have been attacked by ransomware, and the verification fails.

In some implementations, when the isolated storage system 140 compares the first hash value with the second hash value, if it detects that the first hash value is different from the second hash value, that is, the target backup data is attacked by ransomware, an alarm message may be issued, and an alarm notification may be sent to remind the user that the target backup data stored in the isolated storage system 140 has been attacked by ransomware. Based on this alarm message, the user may re-backup the business data and store it in the isolated storage system 140, or pay a ransom to decrypt the target backup data.

In a specific example, as shown in FIG8 , the backup detection system 130 uses the SHA-1 hash algorithm to calculate the first hash value of the target backup data and the tag information, also known as the message digest. For example, the first hash value calculated using the SHA-1 hash algorithm is DFCD3454. The first hash value is then signed based on the private key. Next, the backup detection system 130 sends the target backup data, the tag information, and the signature to the isolated storage system 140. Similarly, the isolated storage system 140 uses the SHA-1 hash algorithm to calculate the second hash value of the target backup data and the tag information, and verifies the signature based on the public key to obtain the first hash value, and then compares the first hash value with the second hash value. If the two are the same, it means that the backup target data has not been destroyed or tampered with during the process of being sent from the backup detection system to the isolated storage system 140, that is, it has not been attacked by ransomware, that is, the verification is successful; if the two are different, the backup target data may have been destroyed and tampered with, that is, it may have been attacked by ransomware, that is, the verification failed.

In some possible implementations, in order to ensure that after the business data in the business system is attacked by ransomware, when the business data is restored based on the backup data in the isolated storage system, it is also necessary to perform signature verification to restore the business data to ensure the normal operation of the business. In this embodiment, as shown in FIG. 9, on the side of the isolated storage system 140, the ransomware detection method may also include:

Step S901 : The isolated storage system 140 receives target backup data, label information, and a signature.

In this implementation, in order to prevent the backup data in the backup storage system 120 from being attacked by ransomware, in addition to performing backup storage in the backup storage system 120, a separate physical isolation area can also be established. Through the automatic shutdown control of Air Gap, the isolation storage system 140 receives the target backup data and signature sent by the backup detection system 130 that have not been attacked by ransomware after detection by ransomware. Through Air Gap, the target backup data in the isolation storage system 140 is disconnected from the Internet, which can prevent the target backup data from being accessed online, thereby preventing the target backup data from being attacked by ransomware. When the business data of the production storage device of the business system 110 is attacked by ransomware, it can be restored based on the target backup data in the isolation storage device of the isolation storage system 140.

Step S902: The isolated storage system 140 verifies the signature based on the public key.

In this implementation, the isolated storage system 140 verifies the target backup data and the signature based on the public key before storing the target backup data, thereby verifying whether the target backup data is attacked by ransomware during the process of being transmitted from the backup detection system 120 to the isolated storage system 140. The public key and the private key used by the backup detection system 120 to obtain the signature are a matching key pair, which are generated based on the same signature algorithm.

Step S903: If the verification is successful, the isolated storage system 140 stores the target backup data.

In this implementation, after the isolated storage system 140 successfully verifies the public key, that is, the target backup data has not been attacked by ransomware, the target backup data is stored in the isolated storage system, so that after the business data of the business system 110 is attacked by ransomware, it can be restored based on the target backup data stored in the isolated storage system 140.

Step S904 : the business system 110 sends a recovery request to the isolated storage system 140 .

In this implementation, when the business data in the business system 110 is attacked by ransomware, a data recovery request is sent to the isolated storage system 140 to request to obtain target backup data for data recovery.

Step S905 : The isolated storage system 140 sends the target backup data, label information, and signature.

In this implementation, the isolated storage system 140 receives a recovery request sent by the business system 110, and sends the target backup data, label information and signature according to the recovery request, wherein the signature is used for data recovery based on the target backup data after the business system 110 verifies the signature.

Step S906: the business system 110 verifies the signature based on the public key.

In this implementation, the business system 110 receives the target backup data, label information and signature sent by the isolated storage system 140. Before using the target backup data for data recovery, the target backup data and signature are verified based on the public key to verify the target backup data. Whether it is attacked by ransomware during the data transmission from the isolated storage system 140 to the business system 110 for data recovery. The public key and the private key for obtaining the signature by the backup detection system 120 are a key pair that matches each other and are generated based on the same signature algorithm.

Step S907: If the verification is successful, the business system 110 uses the target backup data to perform data recovery.

In this implementation, after the business system 110 succeeds in public key verification, that is, after determining that the target backup data has not been attacked by ransomware, the target backup data is used for data recovery.

In some possible implementation methods, as shown in FIG. 10 , executing step S906 may specifically include steps S1001 to S1003 .

Step S1001 : the business system 110 calculates a third hash value of target backup data and tag information.

In this implementation, the business system 110 calculates the third Hash value of the target backup data and the label information. After receiving the target backup data and the label information, the business system 110 calculates the third Hash value of the target backup data and the label information based on the same digital signature algorithm.

In step S1002 , the business system 110 performs signature verification based on the public key to obtain a first hash value.

In this implementation, the business system 110 verifies the signature sent by the isolated storage system 140 based on the public key to obtain a first hash value, wherein the public key and the private key signed by the backup detection system are a matching key pair.

Step S1003 : the business system 110 compares the first Hash value with the third Hash value.

In this implementation, the business system 110 verifies the signature sent by the isolated storage system 140 based on the public key, and after obtaining the first hash value, compares it with the calculated third hash value of the target backup data and label information. When the first hash value and the third hash value are the same, it means that the backup target data has not been destroyed or tampered with in the process of being sent from the isolated storage system 140 to the business system 110, that is, it has not been attacked by ransomware, and the verification is successful; when the first hash value and the third hash value are different, the backup target data may have been destroyed or tampered with, that is, it may have been attacked by ransomware, and the verification fails.

In some implementations, when the business system 110 compares the first hash value with the third hash value, if it detects that the first hash value and the third hash value are different, that is, the target backup data is attacked by ransomware, an alarm message may be issued, and an alarm notification may be sent to remind the user that the target backup data stored in the isolated storage system 140 has been attacked by ransomware. Based on this alarm message, the user may re-backup the business data and store it in the isolated storage system 140, or pay the ransom to decrypt the target backup data. The process of the business system 110 isolating the storage system 140 to verify the signature is similar and will not be repeated here.

The present application also provides a ransomware detection device, as shown in FIG11 , the device 1100 includes:

An acquisition module 1101 is used to acquire backup data;

The processing module 1102 is used to perform ransomware detection on the backup data;

The acquisition module 1101 is further used to acquire the signature of the target backup data and the tag information of the target backup data based on the private key, and the tag information of the target backup data is used to indicate that the target backup data has passed the ransomware detection;

The sending module 1103 is used to send the target backup data, label information and signature to the isolated storage system. The signature is used by the isolated storage system to verify the signature based on the public key and store the target backup data after the verification is successful. The public key is a key pair that matches the private key.

In some possible implementations, the acquisition module 1101 is specifically configured to calculate a first hash value of the target backup data and the tag information.

In some possible implementations, after the acquisition module 1101 calculates the first hash value of the target backup data and label information, the sending module 1103 is also used to send the first hash value to the key management system, and the key management system is used to sign the first hash value based on the private key and send the signature to the backup detection system.

In some possible implementations, after the acquisition module 1101 calculates the first hash value of the target backup data and the tag information, it includes: the acquisition module 1101 is also used to obtain a private key from the key management system; the processing module 1103 is also used to sign the first hash value based on the private key.

In some possible implementations, the signature is used to isolate the target backup data. When a second hash value calculated by the storage system based on the target backup data and the tag information is the same as a first hash value obtained by verifying the signature based on the public key, the target backup data is stored.

In some possible implementations, the private key is generated by a key management system, or the private key is imported into the key management system by a user.

Among them, the acquisition module 1101, the processing module 1102 and the sending module 1103 can all be implemented by software, or can be implemented by hardware. Exemplarily, the implementation of the processing module 1102 is described below by taking the processing module 1102 as an example. Similarly, the implementation of the acquisition module 1101 and the sending module 1103 can refer to the implementation of the processing module 1102.

As an example of a software functional unit, processing module 1102 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, processing module 1102 may include code running on multiple hosts/virtual machines/containers. It should be noted that the multiple hosts/virtual machines/containers used to run the code may be distributed in the same region or in different regions. Furthermore, multiple hosts/virtual machines/containers for running the code may be distributed in the same AZ or in different AZs, each AZ including a data center or multiple geographically close data centers. Generally, a region may include multiple AZs.

Similarly, multiple hosts/virtual machines/containers used to run the code can be distributed in the same virtual private cloud VPC or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

As an example of a hardware functional unit, the processing module 1102 may include at least one computing device, such as a server, etc. Alternatively, the processing module 1102 may also be a device implemented using an application specific integrated circuit ASIC, or a programmable logic device PLD, etc. The PLD may be implemented using a CPLD, FPGA, GAL, or any combination thereof.

The multiple computing devices included in the processing module 1102 can be distributed in the same region or in different regions. The multiple computing devices included in the processing module 1102 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the processing module 1102 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

It should be noted that, in other embodiments, the acquisition module 1101 can be used to execute any step in the ransomware detection method, the processing module 1102 can be used to execute any step in the ransomware detection method, and the sending module 1103 can be used to execute any step in the ransomware detection method. The steps that the acquisition module 1101, the processing module 1102, and the sending module 1103 are responsible for implementing can be specified as needed. The acquisition module 1101, the processing module 1102, and the sending module 1103 respectively implement different steps in the ransomware detection method to realize all the functions of the data processing device.

The present application also provides a ransomware detection device, as shown in FIG12 , the device 1200 includes:

The receiving module 1201 is used to receive target backup data, label information of the target backup data, and a signature of the target backup data, where the label information is used to indicate that the target backup data has passed the ransomware detection of the backup detection system, and the signature is obtained by signing the target backup data and the label information by the backup detection system based on a private key;

A processing module 1202 is used to verify the signature based on a public key, where the public key is a key pair that matches the private key;

If the verification is successful, the processing module 1202 is also used to store the target backup data;

The receiving module 1202 is further used to receive a recovery request from the business system, where the recovery request is used to obtain target backup data;

The processing module 1202 is also used to send the target backup data, label information and signature to the business system according to the recovery request. The signature is used by the business system to verify based on the public key and to use the target backup data for data recovery after successful verification.

In some possible implementations, the processing module 1202 is specifically configured to calculate a first hash value of the target backup data and the tag information.

In some possible implementations, after the processing module 1202 calculates the first hash value of the target backup data and the tag information, the processing module 1202 is further configured to compare a second hash value obtained by verifying the signature based on the public key with the first hash value.

In some possible implementations, after the processing module 1202 calculates the first hash value of the target backup data and the tag information, the processing module 1202 further includes: if the second hash value is the same as the first hash value, the processing module 1202 is further configured to store the target backup data.

In some possible implementations, when the second hash value obtained by the signature based on the public key verification by the business system is the same as the third hash value calculated based on the target backup data and the tag information, the target backup data is used for data recovery.

In some possible implementations, the private key is generated by a key management system, or the private key is imported into the key management system by a user.

The receiving module 1201 and the processing module 1202 can be implemented by software or hardware. For example, the implementation of the processing module 1202 is described below by taking the processing module 1202 as an example. Similarly, the implementation of the receiving module 1201 can refer to the implementation of the processing module 1202.

As an example of a software functional unit, the processing module 1202 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the processing module 1202 may include code running on multiple hosts/virtual machines/containers. It should be noted that the multiple hosts/virtual machines/containers used to run the code can be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts/virtual machines/containers used to run the code can be distributed in the same AZ or in different AZs, and each AZ includes a data center or multiple data centers with similar geographical locations. Among them, usually a region can include multiple AZs.

Similarly, multiple hosts/virtual machines/containers used to run the code can be distributed in the same virtual private cloud VPC or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

As an example of a hardware functional unit, the processing module 1202 may include at least one computing device, such as a server, etc. Alternatively, the processing module 1202 may also be a device implemented using an application specific integrated circuit ASIC, or a programmable logic device PLD, etc. The PLD may be implemented using a CPLD, FPGA, GAL, or any combination thereof.

The multiple computing devices included in the processing module 1202 can be distributed in the same region or in different regions. The multiple computing devices included in the processing module 1202 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the processing module 1202 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

It should be noted that, in other embodiments, the receiving module 1201 can be used to execute any step in the ransomware detection method, and the processing module 1202 can be used to execute any step in the ransomware detection method. The steps that the receiving module 1201 and the processing module 1202 are responsible for implementing can be specified as needed. The receiving module 1201 and the processing module 1202 respectively implement different steps in the ransomware detection method to realize all the functions of the data processing device.

The present application also provides a computing device 100. As shown in FIG. 13 , the computing device 100 includes: a bus 102, a processor 104, a memory 106, and a communication interface 108. The processor 104, the memory 106, and the communication interface 108 communicate with each other through the bus 102. The computing device 100 may be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 100.

The bus 102 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG. 13 is represented by only one line, but does not mean that there is only one bus or one type of bus. The bus 104 may include a path for transmitting information between various components of the computing device 100 (e.g., the memory 106, the processor 104, the communication interface 108).

The processor 104 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP) or a digital signal processor (DSP).

The memory 106 may include a volatile memory, such as a random access memory (RAM). The processor 104 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

The memory 106 stores executable program codes, and the processor 104 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module 1101, the processing module 1102, and the sending module 1103, thereby implementing the ransomware detection method. That is, the memory 106 stores instructions for executing the ransomware detection method. FIG. 13 only exemplarily shows that the memory 106 stores program codes for implementing the functions of the aforementioned acquisition module 1101, the processing module 1102, and the sending module 1103 as an example.

The communication interface 103 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 100 and other devices or a communication network.

The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

As shown in Fig. 14, the computing device cluster includes at least one computing device 100. The memory 106 in one or more computing devices 100 in the computing device cluster may store the same instructions for executing the ransomware detection method.

In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing the ransomware detection method. In other words, the combination of one or more computing devices 100 may jointly execute instructions for executing the ransomware detection method.

It should be noted that the memory 106 in different computing devices 100 in the computing device cluster may store different instructions, which are respectively used to execute part of the functions of the data processing apparatus. That is, the instructions stored in the memory 106 in different computing devices 100 may implement the functions of one or more of the acquisition module 1101, the processing module 1102 and the sending module 1103, or implement the functions of one or more of the receiving module 1201 and the processing module 1202.

In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network. The network may be a wide area network or a local area network, etc. FIG. 15 shows a possible implementation. As shown in FIG. 15 , two computing devices 100A and 100B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 106 in the computing device 100A stores instructions for executing the functions of the acquisition module 1101. In FIG. 15 , the computing device 100A and the computing device 100B are connected via a network. Specifically, the computing device 100A and the computing device 100B are connected via a communication interface in each computing device. In this type of possible implementation, the memory 106 in the computing device 100A stores instructions for executing the functions of the acquisition module 1101. In the example, the memory 106 in the computing device 100A stores instructions for executing the functions of the acquisition module 1101. At the same time, the memory 106 in the computing device 100B stores instructions for executing the functions of the processing module 1102 and the sending module 1103. In FIG. 15 , the memory 106 in the computing device 100B stores instructions for executing the functions of the processing module 1102 and the sending module 1103 as an example.

The connection method between the computing device clusters shown in Figure 15 can be considered that the ransomware detection method provided in this application requires a large amount of computing data, so the functions implemented by the processing module 1102 and the sending module 1103 are considered to be executed by the computing device 100B.

It should be understood that the functions of the computing device 100A shown in FIG15 may also be completed by multiple computing devices 100. Similarly, the functions of the computing device 100B may also be completed by multiple computing devices 100.

The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes a ransomware detection method or a ransomware detection method.

The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct a computing device to execute a ransomware detection method, or instructs a computing device to execute a ransomware detection method.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims (30)

A ransomware detection method, characterized in that the method is applied to a backup detection system, the backup detection system is used to perform ransomware detection on backup data in a backup storage system, the backup data is a backup of business data, and the method comprises: The backup detection system obtains the backup data; The backup detection system performs ransomware detection on the backup data; The backup detection system obtains the signature of the target backup data and the tag information of the target backup data based on the private key, and the tag information of the target backup data is used to indicate that the target backup data passes the ransomware detection; The backup detection system sends the target backup data, the label information and the signature to the isolated storage system, and the signature is used by the isolated storage system to verify the signature based on a public key and store the target backup data after successful verification. The public key is a key pair that matches the private key. The method according to claim 1 is characterized in that the backup detection system obtains the signature of the target backup data and the label information of the target backup data based on the private key, comprising: The backup detection system calculates a first hash value of the target backup data and the tag information. The method according to claim 1 or 2, characterized in that after the backup detection system calculates the first hash value of the target backup data and the label information, it comprises: The backup detection system sends the first Hash value to a key management system, and the key management system is used to sign the first Hash value based on the private key and send the signature to the backup detection system. The method according to claim 1 or 2, characterized in that after the backup detection system calculates the first hash value of the target backup data and the label information, it comprises: The backup detection system obtains the private key from the key management system; The backup detection system signs the first hash value based on the private key. The method according to any one of claims 1 to 4 is characterized in that the signature is used for storing the target backup data when the second hash value calculated by the isolated storage system based on the target backup data and the tag information is the same as the first hash value obtained by verifying the signature based on the public key. The method according to any one of claims 1 to 5 is characterized in that the private key is generated by the key management system, or the private key is imported into the key management system by a user. A ransomware detection method, characterized in that the method is applied to an isolated storage system, and the method comprises: The isolated storage system receives target backup data, label information of the target backup data, and a signature of the target backup data, wherein the label information is used to indicate that the target backup data passes the ransomware detection of the backup detection system, and the signature is obtained by the backup detection system signing the target backup data and the label information based on a private key; The isolated storage system verifies the signature based on a public key, where the public key is a key pair that matches the private key; If the verification is successful, the isolated storage system stores the target backup data; The isolated storage system receives a recovery request from the business system, where the recovery request is used to obtain the target backup data; The isolated storage system sends the target backup data, the label information and the signature to the business system according to the recovery request, and the signature is used by the business system to perform verification based on the public key and to perform data recovery using the target backup data after successful verification. The method according to claim 7, characterized in that the isolated storage system verifies the signature based on the public key, comprising: The isolation storage system calculates a first hash value of the target backup data and the tag information. The method according to claim 7 or 8, characterized in that after the isolated storage system calculates the first hash value of the target backup data and the tag information, it comprises: The isolated storage system verifies the signature based on the public key, obtains a second hash value, and compares the second hash value with the first hash value. The method according to any one of claims 7 to 9, characterized in that if the verification is successful, the isolated storage system stores the target backup data, comprising: If the second hash value is the same as the first hash value, the isolated storage system stores the target backup data. The method according to claim 7 is characterized in that when the second hash value obtained by the signature based on the public key verification by the business system is the same as the third hash value calculated based on the target backup data and the tag information, the target backup data is used for data recovery. The method according to any one of claims 7 to 10 is characterized in that the private key is generated by the key management system, or the private key is imported into the key management system by a user. A ransomware detection device, characterized in that the device is applied to a backup detection system, the backup detection system is used to perform ransomware detection on backup data in a backup storage system, the backup data is a backup of business data, and the device comprises: An acquisition module, used for acquiring the backup data; A processing module, used for performing ransomware detection on the backup data; The acquisition module is further used to acquire the signature of the target backup data and the tag information of the target backup data based on the private key, and the tag information of the target backup data is used to indicate that the target backup data has passed the ransomware detection; A sending module is used to send the target backup data, the label information and the signature to the isolated storage system, the signature is used by the isolated storage system to verify the signature based on a public key and store the target backup data after successful verification, and the public key is a key pair that matches the private key. The device according to claim 13, characterized in that the acquisition module is specifically used to: A first hash value of the target backup data and the tag information is calculated. The device according to claim 13 or 14, characterized in that after the acquisition module calculates the first hash value of the target backup data and the label information, the sending module is further used to: The first hash value is sent to a key management system, and the key management system is used to sign the first hash value based on the private key and send the signature to the backup detection system. The device according to claim 13 or 14, characterized in that after the acquisition module calculates the first hash value of the target backup data and the label information, it includes: The acquisition module is further used to obtain the private key from the key management system; The processing module is further configured to sign the first hash value based on the private key. The device according to any one of claims 13 to 16 is characterized in that the signature is used for storing the target backup data when the second hash value calculated by the isolated storage system based on the target backup data and the label information is the same as the first hash value obtained by verifying the signature based on the public key. The device according to any one of claims 13 to 17 is characterized in that the private key is generated by the key management system, or the private key is imported into the key management system by a user. A ransomware detection device, characterized in that the method is applied to an isolated storage system, and the device comprises: A receiving module, used to receive target backup data, label information of the target backup data, and a signature of the target backup data, wherein the label information is used to indicate that the target backup data has passed the ransomware detection of a backup detection system, and the signature is obtained by signing the target backup data and the label information by the backup detection system based on a private key; a processing module, configured to verify the signature based on a public key, wherein the public key is a key pair that matches the private key; If the verification is successful, the processing module is further used to store the target backup data; The receiving module is further used to receive a recovery request from the business system, where the recovery request is used to obtain the target backup data; The processing module is also used to send the target backup data, the label information and the signature to the business system according to the recovery request, and the signature is used by the business system to verify based on the public key and to use the target backup data for data recovery after successful verification. The device according to claim 19, characterized in that the processing module is specifically used to: A first hash value of the target backup data and the tag information is calculated. The device according to claim 19 or 20, characterized in that after the processing module calculates the first hash value of the target backup data and the label information, it includes: The processing module is further configured to compare a second hash value obtained by verifying the signature based on the public key with the first hash value. The device according to any one of claims 19 to 21, characterized in that after the processing module calculates the first hash value of the target backup data and the label information, it comprises: If the second Hash value is the same as the first Hash value, the processing module is further configured to store the target backup data. The device according to claim 19 is characterized in that when the second hash value obtained by the signature based on the public key verified by the business system is the same as the third hash value calculated based on the target backup data and the tag information, the target backup data is used for data recovery. The device according to any one of claims 19 to 23 is characterized in that the private key is generated by the key management system, or the private key is imported into the key management system by a user. A computing device cluster, characterized in that it includes at least one computing device, each computing device including a processor and a storage Device; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 6. A computing device cluster, characterized in that it includes at least one computing device, each computing device includes a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 7 to 12. A computer program product comprising instructions, characterized in that when the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 6. A computer program product comprising instructions, characterized in that when the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 7 to 12. A computer-readable storage medium, characterized in that it includes computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 6. A computer-readable storage medium, characterized in that it includes computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 7 to 12.