CN118862069A - Industrial control host ransomware protection method, device and storage medium - Google Patents

Abstract

The present application discloses a method, device and storage medium for protecting industrial control hosts from ransomware, and belongs to the field of network technology. The method implements a trusted program whitelist library and a ransomware virus library, so that the host protection system can effectively prevent unauthorized program operation and malware, especially ransomware damage to sensitive data, reduce the risk of data leakage and damage, and only allow verified trusted programs to run, reducing the possibility of system crashes and performance degradation, thereby improving the overall stability and reliability of the system. The design of the audit mode and protection mode allows users to choose the appropriate operation mode according to specific needs. In addition, the system can monitor file write operations in real time, quickly respond to suspicious behaviors, and effectively prevent malware activities.

Description

Industrial control host ransomware protection method, device and storage medium

Technical Field

The embodiments of the present application relate to the field of network technology, and in particular to a method, device and storage medium for protecting an industrial control host from ransomware.

Background Art

Currently, the field of information security is particularly focused on developing efficient system security solutions to protect computing devices and networks from malware attacks. System monitoring and threat detection technology is an important part of network security, which aims to monitor system activities in real time, detect and respond to security threats in a timely manner. Mainstream security systems use signature-based detection mechanisms, behavioral analysis techniques, and heuristic analysis to identify and block malware activities.

Current security solutions can provide effective protection against known threats, but they have some shortcomings in several key areas. First, signature-based approaches cannot effectively identify zero-day attacks or unknown new malware because there is no corresponding signature information for these attacks. Second, existing behavioral monitoring systems often require complex configuration and continuous updates to cope with the ever-changing threat landscape, which increases the complexity and cost of maintenance. In addition, traditional defense systems often detect malicious activities only when they are actually attacked, which is not enough to prevent damage before it occurs. For example, many existing systems cannot effectively identify and stop the activities of ransomware before it encrypts files. This delayed response leads to the risk of data loss and business interruption.

In this context, it is necessary to develop a new generation of security solutions to improve protection against new and complex threats, which can analyze and respond to activities within the system more intelligently and update in real time to respond to emerging security threats.

Summary of the invention

The present application provides a method, device and storage medium for protecting an industrial control host from ransomware. The technical solution is as follows:

On the one hand, a method for protecting an industrial control host from ransomware is provided, the method comprising:

Real-time monitoring of file writing operations by programs in the host;

In response to the current program that triggers the file writing not being in the trusted program whitelist library, detecting whether the current program is in the ransomware virus library;

In response to the current program being in the ransomware virus library, prohibiting the current program from accessing files;

In response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files and prompting a user to manage whether the current program is trustworthy;

In response to the current program that triggers the file writing being in the trusted program whitelist library, the current program is allowed to access the file.

Optionally, in response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files and prompting the user to manage whether the current program is trustworthy includes:

In response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files;

Providing an interface to the user to confirm whether to allow the current program to run;

In response to receiving an operation of allowing the current program to run, the current program is added to the trusted program whitelist library.

Optionally, the method further includes:

Initializing the host protection system to obtain the trusted program whitelist library, wherein the trusted program whitelist library is used to indicate a list of executable programs and digital fingerprints of the executable programs;

An operating mode of the host protection system is set, wherein the operating mode includes an audit mode and a protection mode.

Optionally, the initializing the host protection system to obtain the trusted program whitelist library includes:

Scanning the host protection system to obtain all executable programs;

Extract digital fingerprints from scanned executable programs;

The extracted digital fingerprint is associated with the corresponding executable program and stored to obtain the trusted program whitelist library.

Optionally, in the audit mode, the host protection system is used to record the running logs of all programs and generate an alarm message when running a program in the untrusted program whitelist library;

In the protection mode, the host protection system is used to allow the programs in the trusted program whitelist library to run, and prevent the programs in the untrusted program whitelist library from running.

Optionally, the method further includes:

Collect and update the characteristic information of the ransomware virus to build the ransomware virus library;

The ransomware virus library is integrated into the host protection system.

On the other hand, a ransomware protection device for an industrial control host is also provided, the device comprising:

The program monitoring module is used to monitor the writing operation of the program on the host in real time;

A list determination module, configured to detect whether the current program that triggers file writing is in the ransomware virus library in response to the current program that triggers file writing not being in the trusted program whitelist library;

A first processing module, configured to prohibit the current program from accessing files in response to the current program being in the ransomware virus library;

A second processing module is used for prohibiting the current program from accessing files and prompting a user to manage whether the current program is trustworthy in response to the current program not being in the ransomware virus library;

The third processing module is used for allowing the current program that triggers the file writing to access the file in response to the current program being in the trusted program whitelist library.

On the other hand, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and the at least one instruction is used to be executed by a processor to implement the industrial control host ransomware protection method as described in the above aspects.

On the other hand, a computer program product is also provided, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the industrial control host ransomware protection method described in the above aspect.

This patent application includes at least the following technical effects.

Achieve high data security. By implementing a trusted program whitelist library and a ransomware library, the host protection system can effectively prevent unauthorized program execution and malware, especially ransomware, from damaging sensitive data. This protection mechanism greatly reduces the risk of data leakage and damage.

Enhanced system stability and reliability. Only verified and trusted programs are allowed to run, reducing the possibility of system crashes and performance degradation, thereby improving the overall stability and reliability of the system.

Flexible operation mode selection. The design of audit mode and protection mode allows users to choose the appropriate operation mode according to specific needs. Audit mode allows users to monitor the behavior of all programs, while protection mode provides strict protection.

Realize real-time monitoring and immediate response. The system can monitor file write operations in real time, quickly respond to suspicious behaviors, and effectively prevent malware activities. At the same time, timely user prompts and management ensure that users can make decisions at critical moments.

Implement user-participated security strategies. User prompts and management mechanisms allow users to directly participate in the security decision-making process, enhancing users' control and understanding of system security.

Implement audit logs and compliance support. Detailed security log records help enterprises meet compliance requirements and provide the necessary audit trails to meet the needs of external audits and internal reviews.

Improve defense adaptability and foresight. Regularly updated ransomware and whitelist libraries ensure that the system can fight the latest threats, keeping defense measures current and effective.

In summary, this application not only enhances the host's security protection capabilities, but also provides flexibility and user control to help enterprises and individuals effectively protect their critical assets from the threats of malware and network attacks.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 shows a schematic diagram of a system execution of a method for protecting an industrial control host from ransomware provided by an exemplary embodiment of the present application;

FIG2 shows a flow chart of a method for protecting an industrial control host from ransomware provided by an exemplary embodiment of the present application;

FIG3 shows a structural block diagram of an industrial control host ransomware protection device provided by an exemplary embodiment of the present application.

DETAILED DESCRIPTION

In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

The term "multiple" as used herein refers to two or more than two. "And/or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the related objects are in an "or" relationship.

First, the terms in the technical field involved are defined.

Audit mode: Audit mode generally refers to a system setting that allows all programs to run, but records and monitors the activities of these programs. In this mode, the system does not block the execution of any program, but instead records detailed log information about the program's operation, such as when it was run, what operations were run, etc. These records can be used for later analysis to check whether any unusual or potentially malicious activities have occurred. In this application, the main role of audit mode is to allow administrators to monitor and record all programs running on the system, while providing an alert mechanism to warn system administrators that unauthorized or unknown programs are running. This mode is very useful for discovering new or unidentified threats, understanding software behavior and system usage patterns, but it does not directly prevent any possible malicious behavior. Therefore, in audit mode, even if the ransomware is running, its behavior will only be recorded and will not be blocked.

Host Protection System: A host protection system is defined in this application as an integrated security solution designed to protect computer hosts from unauthorized access and malware attacks through multi-layered protection measures. Such a system includes the following key components and functions in this application.

1. Whitelist management: The host protection system implements a whitelist mechanism to allow only pre-approved trusted programs to run, thereby effectively preventing the execution of unknown or malicious software. Ransomware signature library: The system's built-in or regularly updated ransomware signature library helps identify and block known ransomware attacks, enhancing protection against emerging threats.

2. Operation mode selection. Two operation modes are provided: audit mode and protection mode. Users can choose the appropriate mode according to their needs and security policies. Audit mode is used to monitor and record program behavior, while protection mode provides actual security protection.

3. Real-time monitoring and response: The system monitors key system activities and file writing operations in real time, and can immediately detect and respond to suspicious behaviors and potential security threats.

4. User interactive prompts and management. By providing users with security prompts and decision-making support, the system strengthens the user's initiative and sense of participation in maintaining host security.

5. Detailed audit logs: Record detailed security logs to support compliance requirements and provide enterprises with the detailed data and evidence needed to resist audits and compliance inspections.

6. Regular updates and adaptive protection. The system constantly adapts to new security threats and vulnerabilities by regularly updating software and malware libraries to ensure the forward-looking and effective protection measures.

In general, the host protection system is a comprehensive security protection mechanism designed to prevent various network and software threats, ensuring the integrity, availability and confidentiality of computer systems are not compromised.

Please refer to Figures 1 and 2. Figure 1 shows a schematic diagram of a system execution under a method for protecting an industrial control host from ransomware provided by an exemplary embodiment of the present application, and Figure 2 shows a flow chart of a method for protecting an industrial control host from ransomware provided by an exemplary embodiment of the present application. The method for protecting an industrial control host from ransomware includes:

Step 201, monitor in real time the write operation of the program in the host to the file.

In this step, the host protection system monitors all running programs in real time, paying special attention to the write operations of these programs to system files or critical data files. The system uses advanced monitoring technology to capture every file operation event to ensure that no write behavior is missed.

In an example, suppose a user is running a text editing software to edit an important work report. The system will monitor all write operations of the editing software to the report file, including saving changes, adding data, etc. This monitoring helps ensure that the file writing behavior is as expected and there are no unauthorized changes.

Step 202: In response to the current program that triggers file writing not being in the trusted program whitelist library, detecting whether the current program is in the ransomware virus library.

When a program starts writing files, but it is not included in the trusted whitelist, the system identifies it as a potential risk. The system then checks whether the program exists in the known ransomware signature library. This is a two-factor verification process designed to quickly identify and respond to possible malicious behavior.

In one example, if an unknown new software attempts to modify system files, the system first confirms that the software is not in the whitelist, and then checks it against the ransomware library. If the characteristics of the software match a ransomware in the library, the system will proceed to the next step of security defense measures.

Step 203: In response to the current program being in the ransomware virus library, prohibiting the current program from accessing the file.

Once it is confirmed that the behavior pattern of the current program matches the record in the ransomware virus library, the system immediately blocks all file access permissions of the program. This measure is to prevent data from being encrypted or damaged and is an urgent security response.

In one example, if a program is detected as the "WannaCry" ransomware, the system will immediately interrupt all its file writing operations to prevent it from encrypting user documents and system files.

Step 204: In response to the current program not being in the ransomware virus library, the current program is prohibited from accessing files and the user is prompted to manage whether the current program is trustworthy.

In one possible implementation, step 204 includes, in response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files, providing an interface to the user to confirm whether to allow the current program to run, and in response to receiving an operation to allow the current program to run, adding the current program to a trusted program whitelist library.

This step involves blocking programs that are not in the ransomware database but behave suspiciously, and presenting a warning and action choice to the user. The user can decide whether to trust the program, allow it to continue running, or whether it should be added to the whitelist.

In one example, if a video editing software attempts to perform a large number of file write operations at an unusual time, the system will block these operations and prompt the user. The user can choose to trust and allow the software to continue running, or remain blocked until further investigation.

Step 205 , in response to the current program that triggers the file writing being in the trusted program whitelist library, the current program is allowed to access the file.

For verified and whitelisted programs, the system allows them to write files, which means that the system has enough trust in the behavior of these programs and believes that their operations are safe.

In one example, a verified database management software needs to perform a data backup operation. After the system identifies the software as a whitelist program, it allows it to perform a file write operation to complete the backup process.

This patent application includes at least the following technical effects.

Achieve high data security. By implementing a trusted program whitelist library and a ransomware library, the host protection system can effectively prevent unauthorized program execution and malware, especially ransomware, from damaging sensitive data. This protection mechanism greatly reduces the risk of data leakage and damage.

Enhanced system stability and reliability. Only verified and trusted programs are allowed to run, reducing the possibility of system crashes and performance degradation, thereby improving the overall stability and reliability of the system.

Flexible operation mode selection. The design of audit mode and protection mode allows users to choose the appropriate operation mode according to specific needs. Audit mode allows users to monitor the behavior of all programs, while protection mode provides strict protection.

Realize real-time monitoring and immediate response. The system can monitor file write operations in real time, quickly respond to suspicious behaviors, and effectively prevent malware activities. At the same time, timely user prompts and management ensure that users can make decisions at critical moments.

Implement user-participated security strategies. User prompts and management mechanisms allow users to directly participate in the security decision-making process, enhancing users' control and understanding of system security.

In addition, before executing the industrial control host ransomware protection method of the embodiment of the application, the embodiment of the present application also includes building a trusted program whitelist library and a ransomware virus library.

Preparation 1: Build a trusted program whitelist library.

First, the host protection system is initialized to obtain a trusted program whitelist library, where the trusted program whitelist library is used to indicate a list of executable programs and digital fingerprints of the executable programs.

Specifically, the host protection system is scanned to obtain all executable programs; digital fingerprints are extracted from the scanned executable programs; the extracted digital fingerprints are associated with corresponding executable programs and stored to obtain a trusted program whitelist library.

Secondly, set the operating mode of the host protection system, which includes audit mode and protection mode.

Preparation 2: Build a ransomware virus library.

First, collect and update the characteristic information of the ransomware to build a ransomware library.

Secondly, integrate the ransomware virus library into the host protection system.

Please refer to FIG3 , which shows a structural block diagram of an industrial control host ransomware protection device provided by an exemplary embodiment of the present application, the device comprising:

The program monitoring module 301 is used to monitor the writing operation of the program in the host to the file in real time;

The list determination module 302 is used to detect whether the current program is in the ransomware virus library in response to the current program that triggers the file writing not being in the trusted program whitelist library;

The first processing module 303 is used to prohibit the current program from accessing the file in response to the current program being in the ransomware virus library;

The second processing module 304 is used for prohibiting the current program from accessing files and prompting the user to manage whether the current program is trustworthy in response to the current program not being in the ransomware virus library;

The third processing module 305 is used to allow the current program to access the file in response to the current program that triggers the file writing being in the trusted program whitelist library.

Optionally, the second processing module 304 includes:

A first processing subunit is configured to prohibit the current program from accessing the file in response to the current program not being in the ransomware virus library;

The second processing subunit is used to provide an interface for the user to confirm whether to allow the current program to run;

The third processing sub-unit is configured to, in response to receiving an operation to allow the current program to run, add the current program to a trusted program whitelist library.

Optionally, the device further comprises:

A fourth processing module, used for initializing the host protection system to obtain a trusted program whitelist library, where the trusted program whitelist library is used to indicate a list of executable programs and digital fingerprints of the executable programs;

The fifth processing module is used to set the operation mode of the host protection system, and the operation mode includes an audit mode and a protection mode.

Optionally, the fourth processing module includes:

The fourth processing sub-unit is used to scan the host protection system to obtain all executable programs;

A fifth processing subunit, used for extracting a digital fingerprint from the scanned executable program;

The sixth processing sub-unit is used to associate and store the extracted digital fingerprint with the corresponding executable program to obtain a trusted program whitelist library.

Optionally, in audit mode, the host protection system is used to record the running logs of all programs and generate alarm messages when running programs in the untrusted program whitelist library;

In protection mode, the host protection system is used to allow programs in the trusted program whitelist library to run and prevent the running of programs in the untrusted program whitelist library.

Optionally, the device further comprises:

The sixth processing module is used to collect and update the characteristic information of the ransomware virus to build a ransomware virus library;

The seventh processing module is used to integrate the ransomware virus library into the host protection system.

An embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction is stored, and the at least one instruction is loaded and executed by a processor to implement the industrial control host ransomware protection method provided in the above embodiments.

Optionally, the computer readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a solid state drive (SSD), or an optical disk, etc. Among them, the random access memory may include a resistance random access memory (ReRAM) and a dynamic random access memory (DRAM).

A computer program product is also provided, which stores at least one instruction, and the at least one instruction is loaded and executed by a processor to implement the industrial control host ransomware protection method described in the above aspect.

The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims (8)

1. A method for protecting an industrial control host from ransomware, characterized in that the method comprises: Real-time monitoring of file writing operations by programs in the host; In response to the current program that triggers the file writing not being in the trusted program whitelist library, detecting whether the current program is in the ransomware virus library; In response to the current program being in the ransomware virus library, prohibiting the current program from accessing files; In response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files and prompting a user to manage whether the current program is trustworthy; In response to the current program that triggers the file writing being in the trusted program whitelist library, the current program is allowed to access the file. 2. The method according to claim 1, characterized in that, in response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files and prompting the user to manage whether the current program is trustworthy, comprises: In response to the current program not being in the ransomware virus library, prohibiting the current program from accessing files; Providing an interface to the user to confirm whether to allow the current program to run; In response to receiving an operation of allowing the current program to run, the current program is added to the trusted program whitelist library. 3. The method according to claim 1, characterized in that the method further comprises: Initializing the host protection system to obtain the trusted program whitelist library, wherein the trusted program whitelist library is used to indicate a list of executable programs and digital fingerprints of the executable programs; An operating mode of the host protection system is set, wherein the operating mode includes an audit mode and a protection mode. 4. The method according to claim 3, wherein the initializing the host protection system to obtain the trusted program whitelist library comprises: Scanning the host protection system to obtain all executable programs; Extract digital fingerprints from scanned executable programs; The extracted digital fingerprint is associated with the corresponding executable program and stored to obtain the trusted program whitelist library. 5. The method according to claim 3, characterized in that: In the audit mode, the host protection system is used to record the running logs of all programs and generate an alarm message when running a program in the untrusted program whitelist library; In the protection mode, the host protection system is used to allow the programs in the trusted program whitelist library to run, and prevent the programs in the untrusted program whitelist library from running. 6. The method according to claim 1, characterized in that the method further comprises: Collect and update the characteristic information of the ransomware virus to build the ransomware virus library; The ransomware virus library is integrated into the host protection system. 7. A ransomware protection device for an industrial control host, characterized in that the device comprises: The program monitoring module is used to monitor the writing operation of the program on the host in real time; A list determination module, configured to detect whether the current program that triggers file writing is in the ransomware virus library in response to the current program that triggers file writing not being in the trusted program whitelist library; A first processing module, configured to prohibit the current program from accessing files in response to the current program being in the ransomware virus library; A second processing module is used for prohibiting the current program from accessing files and prompting a user to manage whether the current program is trustworthy in response to the current program not being in the ransomware virus library; The third processing module is used for allowing the current program that triggers the file writing to access the file in response to the current program being in the trusted program whitelist library. 8. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and the computer program is loaded and executed by a processor to implement the industrial control host ransomware protection method as described in any one of claims 1 to 6 above.