Method and system of preventing files from being damaged by malicious operation behaviors

Abstract

The invention discloses a method and a system of preventing files from being damaged by malicious operation behaviors. if a process of deleting the file exists, the process is released if the process is a white-list process, is directly blocked if the process is a black-list file reading or writing operation process, and is suspended if the process is a gray-list process, and released after backing up the file to a readable protected area is completed; if a process of modifying the file exists, the process is released if the process is a white-list process, is directly blocked if the process is a black-list process, and is suspended if the process is a gray-list process, and released after backing up the file to the readable protected area is completed; and if an encryption / compression encryption operation exists, whether operation frequency of a process for the file in a preset time exceeds a set threshold value is judged, and if yes, it is determined that the operation is a suspected malicious file operation behavior. According to the technical solution of the invention, the malicious file operation behaviors can be effectively identified, and risk frequency of maliciously deleting and modifying important files can be reduced at the same time.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for preventing files from being damaged by malicious operations. Background technique [0002] With the rapid popularization and vigorous development of the Internet, text files, document files, picture files, installed program-related files, movie files, etc. that illegally operate computer systems such as various extortion, encryption software, and illegal programs have resulted in the illegal deletion of a large number of computer files. , Illegal encryption. When encountering an illegal blackmailer, it will use a high-digit asymmetric encryption algorithm to encrypt the file. Only after paying a high amount of data recovery can the illegal person decrypt and restore the file. For ordinary users, these data may not be important at all, but for a large commercial company, relevant data and files are the core assets of a company and are crucial....

AI Technical Summary

Problems solved by technology

[0003] At present, many mainstream security guards and antivirus software include the file protection function, but many ordinary users have not turned it on. Even if it is turned on to ensure that the file is not maliciously tampered with, it will still affect the operation of normal software on the file. The list mechanism is used to ensure the operation behavior of normal programs on files, but it still cannot guarantee the normal operation behavior of all whitelisted programs on files, and at the same time, it cannot control the illegal operations of all illegal programs on files.

For many Linux servers, security guards and anti-virus software are not installed, and the core applications of many enterprise units are deployed on Linux servers. Once the server is attacked, the data files will be encrypted and deleted, causing heavy losses and disastrous consequences.

Images