ARS：基于文件行为的勒索软件主动防御技术研究

ARS： research on proactive defense technology of ransomware based on file behavior

摘要:

针对勒索软件（Ransomware）造成的安全威胁问题，本文在分析多种勒索软件家族攻击特点和传统恶意代码检测技术的基础上，提出一种基于文件行为的勒索软件主动防御技术（Anti-Ransomware System, ARS）。该技术采用基于文件行为统计异常的方法进行勒索软件检测，通过文件过滤驱动收集正常软件与勒索软件动态文件行为信息用作训练集，使用多种分类算法训练并生成勒索软件检测分类器，用于运行时检测勒索软件。利用写时复制技术动态备份程序运行时修改的文件，根据检测结果决定是否恢复文件。最后，设计实现原型系统并进行了测试。实验结果表明，在确保数据文件安全性的前提下，ARS能够有效地防御勒索软件，减小勒索软件攻击的危害。

Abstract:

In order to reduce the loss caused by the attack of ransomware, this paper proposed a framework (AntiRansomware System, ARS) based on the family characteristics and the traditional malicious code detection technology. Specifically, a method is proposed to detect ransomware based on file behavior statistics. It uses the minifilter to collect the file behavior information of benign and ransomware as train set, and uses a variety of supervised classification algorithms to train classifier for runtime detection. Then, the copyonwrite technology is utilized to dynamically backup modified files in the program at runtime, and the detection results are used to determine whether to restore files. Finally, a prototype system is developed and tested. The results show that, under the premise of ensuring the security of the data file, the ARS framework can effectively prevent the ransomware attack and reduce the harm of ransomware.