A Ransomware Variation Detection Method Based on Sequence Algorithm

Abstract

The invention provides a method for detecting variants of ransomware based on a sequence comparison algorithm. The specific process is: inputting a sample of ransomware, extracting a sample feature sequence, processing the sample feature sequence into a gene sequence, and detecting a variant of ransomware; the variant detection Specifically: cluster each gene sequence in the sample set, extract the clustering result information, and obtain various ransomware families; use the sequence comparison algorithm Needleman-Wunsch to calculate the clusters between the samples to be detected and various ransomware families The similarity of the central sample, select the clusters whose similarity is greater than the set threshold, and use the selected clusters to form a new ransomware training sample set; for the samples to be detected, use the newly selected training sample set, combined with the sequence comparison algorithm and KNN classification algorithm to determine the ransomware family category to which it belongs to realize variant detection. This method combines the sequence comparison algorithm with the existing classification algorithm to achieve the purpose of quickly realizing the detection of ransomware variants.

Description

technical field [0001] The invention relates to a method for detecting ransomware variants based on a sequence comparison algorithm, and belongs to the technical field of software detection. Background technique [0002] At present, there are not many detection and defense methods for ransomware at home and abroad, which are mainly divided into the following categories: detection methods based on network traffic analysis, detection methods based on dynamic and static characteristics of ransomware, and detection methods based on decoy files. [0003] In the prior art, the invention patent application "a detection method and system for blackmailer virus", application number: CN201611094356.1, judges whether the encryption operation is performed by comparing the entropy value of the modified file and the backup file, and collects if there is an encryption operation All encrypted files, and determine whether the proportion of files with the same extension exceeds the preset valu...

AI Technical Summary

Problems solved by technology

[0004] The above mainstream detection methods do not focus on ransomware or ransomware variants, and most of them are general detection methods for multi-category malware, and are not optimized for ransomware

Images