A method and system for preventing ransomware attacks based on solid-state storage devices

Abstract

The invention discloses a method and system for preventing ransomware attacks based on solid-state storage devices, which realizes detection of ransomware in the firmware flash memory conversion layer of the solid-state storage devices, and utilizes the characteristics of non-in-situ update of solid-state storage devices to realize data lightweight backup and data backup. recover. The ransomware detection module establishes a fine-grained access model according to the special data access mode when the ransomware attacks the user; the data backup module adopts the method of periodic backup when the detection module does not detect the ransomware. The important metadata including the page usage table is backed up, and the garbage collection strategy is used to ensure that the data of the current backup version will not be physically deleted; the data recovery module adds the backup data version and the write operation by adding the backup data version in the OOB area of ​​the corresponding physical page during the write operation. The serial number and target logical block address information are used to reconstruct the backup metadata by the dichotomy method, thereby realizing the rapid recovery of user data.

Description

technical field [0001] The present invention relates to ransomware detection technology and data backup and data recovery technology, in particular to a solid-state storage device-based detection technology and data backup and data recovery method for encrypted ransomware. Background technique [0002] In recent years, ransomware, a kind of malware that extorts ransom by restricting users' normal access to files or systems, has become popular and has been widely used in various cybercrimes. Sales were up about 2502%. In 1996, Young and others first proposed the concept of encryption virus, and named it Cryptovirology, and then proposed that by combining encryption algorithms and computer viruses, users can access key data and encrypt user files to extort money. This is the purpose of ransomware prototype. With the development of network technology, this type of encrypted virus continues to develop, its transmission methods are increasingly diverse, its scope of influence i...

AI Technical Summary

Problems solved by technology

Symmetric encryption ransomware uses symmetric encryption algorithm to encrypt files, but it is easy to be reversed or brute force to recover the symmetric key

Public-key encryption ransomware uses public-key encryption algorithms to encrypt files. Generally, the public key will be embedded in the user’s host to encrypt files, while the private key will be stored on the server side of the ransomware. The disadvantage of this type of ransomware is encryption The speed is slow, and a public-private key pair needs to be maintained for each infected host, resulting in high key management overhead

Images