KR101995944B1 - Method for preventing randomware - Google Patents

Abstract

In order to access a file included in a security folder of a file system, the present invention can be accessed only through a preset security explorer, instant backup of a file requested to be accessed to recover a file, The present invention relates to a method for preventing random software by providing a file to determine whether or not the software is infected with the random software.

Description

METHOD FOR PREVENTING RANDOMWARE

One embodiment below relates to a method for preventing random software.

Ransomware is typically a worm, such as a trojan horse, that spreads via network vulnerabilities or downloaded files. There are several ways to prevent system access after an intrusion, the simplest way is to display false warning notices. It is a way to mark a system as allegedly used by illegal activities or that it contains illegal content, as if it were issued by a related company or a judicial authority. The second way is to limit the system so that the system can not run the operating system and locks (usually a Windows shell). The final solution is to encrypt the files in the most complex form, preventing them from opening.

Ransomware was first created using symmetric cryptography by Joseph Popp in 1989 and by public key cryptography in 1996 by Adam L. Young and Moti Yung. The form was also made. Ransomware, such as Gpcode, TROJ.RANSOM.A, and Archiveus, which have taken a huge amount of corruption, have been raging since 2005, and they have taken a more complex cryptosystem.

As encryption becomes more sophisticated, it becomes even more likely that Ransomware will be infected, giving up infected files and paying Ransom. Therefore, there is a need for a method for preventing infection.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method for preventing random software.

More specifically, the present invention aims to provide a method for preventing a random software by accessing a file included in a security folder of a file system only through a predetermined security explorer in order to prevent random software.

It is another object of the present invention to provide a method for preventing random software by allowing an untrusted process to instantly back up a file to recover a file when accessing the file of the file system.

It is also an object of the present invention to provide a method for preventing random software by providing a decoy file when an untrusted process accesses a file in a file system, thereby determining whether or not it is infected with the Ransomware.

According to an aspect of the present invention, there is provided a method of preventing random software in a file system, the method comprising: receiving a file system access request; Confirming that the file requested to be accessed is a file included in the secure folder; Checking whether the access requested file is a file included in the security folder or not if the process requesting access is a security explorer; And allowing access to the requested file if the process requesting the access is a security explorer.

At this time, the method for preventing the random software may further include the step of not allowing access to the file requested for access unless the process requesting the access is a safety explorer.

In this case, the step of allowing access to the file requested access may include: backing up the file requested to be accessed to a preset storage location for a predetermined time, or backing up the file requested to be accessed until the access requested file is accessed for a predetermined number of times Backing up to the storage location.

At this time, the preset storage location is a safe area managed by making a database of a part of the storage device as a database, the capacity can be set by the user in the secure area, the storage period of the backed up file is preset , And can be managed to delete backup files exceeding a predetermined period.

In this case, the step of backing up may include a step of backing up the data to be transferred to the process requesting access from the entire data constituting the access requested file.

At this time, the step of allowing access to the access requested file includes: copying the access requested file to generate a bait file; Providing the bait file to a process requesting the access; Confirming that the bait file is infected with the Ramsomeware when the bait file is updated; And if the bait file is infected with Ransomware, it may be informed that the user is infected and delete the Bait file infected.

In this case, if the bait file is not infected with the Ramsomware, the method may include replacing the requested file with the bait file.

In this case, the method for preventing the random software may further include, before the step of receiving the access request for the file of the file system, the safety search device driver which is a path for accessing the file system by the safety explorer and all processes And a step of installing the image data.

In this case, the method for preventing the random software may include detecting whether the device driver for safety search is installed in the monitoring process, and reinstalling the device driver for safety search if the device driver for safety search is not installed As shown in FIG.

At this time, a method for preventing random software may include: attempting to access a file stored in the file system at a predetermined time interval in the monitoring process; And if the access to the file stored in the file system does not occur even after the predetermined time interval elapses in the device driver for searching for safety, it is determined that the monitoring process is stopped, and access to the file system is blocked Step < / RTI >

The method may further include blocking the access request if the access requested file is a file included in a boot area of the operating system.

In this case, the step of allowing access to the file requested access includes: requesting a predetermined password when installing the security explorer; And blocking access to the file requested to be accessed when an unauthorized password is input, and allowing access to the file requested to be accessed when a valid password is input.

According to another embodiment of the present invention, there is provided a method for preventing random software, comprising: receiving an access request for a file in a file system; Confirming that the process requesting access to the file is a trusted process; And if the process requesting the access is not a trusted process, the file requested to be accessed is backed up to a preset storage location for a predetermined time, or the file requested for access is backed up for a predetermined number of times, Backing up to the storage location.

In this case, the method for preventing random software further includes classifying the process as a trusted process when the number of times that a file accessed and backed up is not recovered and deleted is more than a predetermined number of times within a predetermined period .

In this case, the step of backing up may include a step of backing up the data to be transferred to the process requesting access from the entire data constituting the access requested file.

According to another embodiment of the present invention, there is provided a method of preventing random software, comprising: receiving a request for access to a file of a file system; Confirming that the process requesting access to the file is a trusted process; And if the process requesting the access is not a trusted process, copying the access requested file to generate a bait file; Providing the bait file to a process requesting the access; Confirming that the bait file is infected with the Ramsomeware when the bait file is updated; And if the bait file is infected with Ransomware, it is notified that the bait file is infected to the user and the infected bait file is deleted.

At this time, when the process determines that the decrypted bait file is not infected with the random software, the process is classified as a trusted process if the process occurs more than a predetermined number of times within a predetermined period Step < / RTI >

In this case, if the bait file is not infected with the Ramsomware, the method may include replacing the requested file with the bait file.

In order to access a file included in a security folder of a file system, the present invention can be accessed only through a preset security explorer, instant backup of a file requested to be accessed to recover a file, By providing a file to determine whether or not it is infected with Ransomware, Ransomware can be prevented.

FIG. 1 is a flowchart illustrating a process of preventing random software using a security explorer in a random access protection apparatus according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 2 is a flowchart illustrating a procedure for preventing Ransomware using a security explorer, an instant backup, and a password in an Ransomware protection apparatus according to an exemplary embodiment of the present invention.
FIG. 3 is a flowchart illustrating a procedure for preventing Ransomware using the security explorer and instant backup in the Ransomware protection apparatus according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating a process for preventing Ransomware using a security explorer and a bait file in a Ransomware prevention apparatus according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 5 is a flowchart illustrating a process for preventing the disabling of the device driver for safety search in the random access protection device according to the embodiment of the present invention.
FIG. 6 is a flowchart illustrating a procedure for preventing Ransomware using instant backup in the Ransomware prevention apparatus according to another embodiment of the present invention.
FIG. 7 is a flowchart illustrating a process for preventing Ransomware using a bait file in a Ransomware prevention apparatus according to another embodiment of the present invention.
FIG. 8 is a diagram illustrating an example of setting a security folder using a security explorer in an anti-threat agent according to an exemplary embodiment of the present invention.
FIG. 9 is a diagram showing a schematic configuration of an anti-random software device according to an embodiment of the present invention.

It is to be understood that the specific structural or functional descriptions of embodiments of the present invention disclosed herein are only for the purpose of illustrating embodiments of the inventive concept, But may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein.

Embodiments in accordance with the concepts of the present invention are capable of various modifications and may take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. However, it is not intended to limit the embodiments according to the concepts of the present invention to the specific disclosure forms, but includes changes, equivalents, or alternatives falling within the spirit and scope of the present invention.

The terms first, second, or the like may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example without departing from the scope of the right according to the concept of the present invention, the first element being referred to as the second element, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Expressions that describe the relationship between components, for example, "between" and "immediately" or "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises ", or" having ", and the like, are used to specify one or more other features, numbers, steps, operations, elements, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference symbols in the drawings denote like elements.

Hereinafter, a method and apparatus for preventing random software according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 9 attached hereto.

FIG. 1 is a flowchart illustrating a process of preventing random software using a security explorer in a random access protection apparatus according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIG. 1, the anti-virus protection device installs a safety searcher and a device driver for safety search, which is a path through which all processes access the file system (110).

When the device driver for safety search receives an access request for a file in the file system (120), it determines whether the file requested for access is a file included in the secure folder (130). At this time, a read request, a write request, an access request, and the like may exist in the access request to the file of the file system.

The security folder can be set using the security explorer as shown in the example of FIG. 8 below.

FIG. 8 is a diagram illustrating an example of setting a security folder using a security explorer in an anti-threat agent according to an exemplary embodiment of the present invention.

8, the security explorer 800 can set a secure folder such as a "DDD" folder and a "CCC" folder by using the " Set secure folder "command 822 included in the menu 820. [ At this time, the security folder 810 of "CCC " may be distinguished from other general folders by different shades or colors.

If it is determined in step 130 that the file is not included in the file security folder requested for access, the device driver for security search permits access to the file requested to be accessed (150).

If it is determined in step 130 that the file is included in the file security folder requested to be accessed, the device driver for security search determines whether the process requesting access is a security explorer (step 140).

If it is determined in step 140 that the process requesting access is a safety explorer, the device driver for security exploration permits access to the file requested to be accessed (150).

If it is determined in step 140 that the process requesting access is not a security explorer, the device driver for security search does not allow access to the file requested to be accessed (160).

That is, the device driver for security search shown in Fig. 1 does not allow access to the secure folder without going through the security explorer.

FIG. 2 is a flowchart illustrating a procedure for preventing Ransomware using a security explorer, an instant backup, and a password in an Ransomware protection apparatus according to an exemplary embodiment of the present invention.

Referring to FIG. 2, the anti-camping device includes a safety searcher and a device driver for searching for safety (210), which is a path through which all processes access the file system.

When the device driver for safety search receives an access request for a file in the file system (212), it determines whether the file requested for access is a file included in the boot area of the operating system (214).

If it is determined in step 214 that the file requested for access is not a file included in the boot area, the device for safety search determines whether the file requested for access is a file included in the secure folder (step 216).

If it is determined in step 216 that the file is not included in the file security folder requested for access, the device driver for security search permits access to the file requested for access (224).

If it is determined in step 216 that the file is included in the file security folder requested for access, the device driver for safety search determines whether the process requesting access is a security explorer (step 218).

If it is determined in step 218 that the process requesting access is a security explorer, the device driver for security search requests a password to the user (220).

Then, the device driver for security search checks whether the received password is a predetermined valid password (222).

If it is determined in step 222 that the received password is a valid password, the device driver for security search permits access to the file requested to be accessed (224).

On the other hand, if it is determined in step 214 that the requested file is a file included in the boot area, or the process requesting access in step 218 is not a security explorer, or if the password received in step 222 is not a valid password, The device driver for security search does not allow access to the file requested to be accessed (226).

That is, in Fig. 2, the device driver for security search does not allow access to the file included in the security folder without accessing the security explorer and password, and also prevents access to the boot area.

FIG. 3 is a flowchart illustrating a procedure for preventing Ransomware using the security explorer and instant backup in the Ransomware protection apparatus according to an embodiment of the present invention.

Referring to FIG. 3, the anti-camping device includes a safety searcher and a device driver for searching for safety (310), which is a path through which all processes access the file system.

When receiving the access request for the file in the file system (312), the device driver for safety search confirms whether the access requested file is included in the secure folder (314).

If it is determined in step 314 that the file is not included in the requested file security folder, the device driver for security search permits access to the requested file (320).

If it is determined in step 314 that the file is included in the file security folder requested for access, the device driver for safety search determines whether the process requesting access is a security explorer (step 316).

If it is determined in step 316 that the process requesting access is a security explorer, the device driver for safety search instantly backs up the file requested to be accessed (318), and the device driver for security exploration permits access to the file requested for access (320) . In this case, the instant backup means that the requested file is backed up to a preset storage location for a predetermined time, or that the requested file is backed up to a predetermined storage location until it is accessed for a predetermined number of times.

In order to prevent the backup process from taking a long time when the file to be accessed is large, when the backup is made in step 318, the device driver for the secure search selects all the data constituting the file requested to be accessed As shown in FIG. That is, instead of transferring the entire file as a process, it can be transferred in units of blocks and backed up in blocks.

If it is determined in step 316 that the process requesting access is not a security explorer, the device driver for security search does not allow access to the file requested for access (322).

That is, the device driver for security search shown in FIG. 3 does not allow access to the files included in the security folder without going through the security explorer, and further allows instant recovery through the instant backup.

FIG. 4 is a flowchart illustrating a process for preventing Ransomware using a security explorer and a bait file in a Ransomware prevention apparatus according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIG. 4, the anti-virus protection device 410 includes a safety searcher and a device driver for searching for safety, which is a path for accessing the file system by all the processes.

When receiving the access request for the file in the file system (412), the device driver for safety search confirms whether the requested file is included in the secure folder (414).

If it is determined in step 422 that the file is not included in the requested file security folder, the device driver for security search permits access to the requested file (step 424).

If it is determined in step 422 that the file is included in the file security folder requested to be accessed, the device driver for safety search determines whether the process requesting access is a security explorer (step 426).

If it is determined in step 426 that the process requesting access is a security explorer, the device driver for safety search generates a bait file by copying the access requested file (step 428), provides the bait file to the process requesting access (step 430) It is confirmed whether the bait file has been updated (432).

If the bait file is not updated as a result of step 432, the algorithm is terminated.

If it is determined in step 432 that the bait file is updated, the device driver for safety search confirms whether the bait file is infected with the Ramsomware (434).

If it is determined in step 434 that the bait file has been infected with the Ransomware, the device driver for safety discovery informs the user that the infected bait file has been infected (for example, through a popup or the like) and deletes the infected bait file (436).

If it is determined in step 434 that the decoy file is not infected with the random software, the device driver for safety search may replace the requested file with the decoy file and store the file in step 440.

If it is determined in step 426 that the process requesting access is not a security explorer, the device driver for security search does not allow access to the file requested for access (438).

That is, the device driver for security search of FIG. 4 does not allow access to the files included in the security folder without going through the security explorer, and additionally allows the risk software to be avoided through the decoy file.

FIG. 5 is a flowchart illustrating a process for preventing the disabling of the device driver for safety search in the random access protection device according to the embodiment of the present invention.

Referring to FIG. 5, the anti-campus protection device 510 installs a safety searcher, a monitoring process, and a device driver for a safety search, which is a path through which all processes access the file system.

In step 520, monitoring is performed through the monitoring process to determine whether the device for safety search has been disabled (520). At this time, whether or not the safety search device driver is disabled can be confirmed by checking whether or not the safety search device driver is installed. That is, it can be determined that the device is not disabled if the device driver for safety search is installed and disabled if the device for safety search is not installed.

If it is determined in operation 520 that the device driver for safety search has been disabled (if the device driver for safety search is not installed), the monitoring process reinstalls the device driver for safety search 530.

If it is determined in step 520 that the device driver for safety search has not been disabled (if the device driver for safety search is installed), the device driver for safety search determines whether the monitoring process is disabled (step 540). At this time, whether or not the monitoring process is disabled is set so as to attempt to access the file stored in the file system at a predetermined time interval in the monitoring process in advance, and it is stored in the file system even after a predetermined time interval has elapsed in the device for safety search If access to the file does not occur, it is determined that the monitoring process has been stopped, thereby confirming whether or not the monitoring process has been disabled.

If it is determined in step 540 that the monitoring process has not been disabled, the anti-virus protection apparatus returns to step 520 and repeats a series of processes.

If the monitoring process is disabled as a result of step 540, access to the file system by the device driver for the security search is blocked, thereby preventing the access of the Raman software (550).

FIG. 6 is a flowchart illustrating a procedure for preventing Ransomware using instant backup in the Ransomware prevention apparatus according to another embodiment of the present invention.

Referring to FIG. 6, when the random access protection device receives a file access request for a file in the file system (610), it confirms whether the process requesting access to the file is a trusted process (612). At this time, if the number of times that the process accessed and the backed up file is not recovered and deleted is more than a preset number of times within a predetermined period, the process can be classified as a trusted process.

If it is determined in step 612 that the process requesting access is a trusted process, the anti-virus protection device provides the file requested for access (614).

If the process requesting access is not a trusted process in step 612, the anti-spyware device instantly backs up the requested file (318) and provides access to the requested file (618). In this case, the instant backup means that the requested file is backed up to a preset storage location for a predetermined time, or that the requested file is backed up to a predetermined storage location until it is accessed for a predetermined number of times. At this time, the preset storage location is a safe area that is managed for backup by making a part of the storage device into a database. The capacity of the safe area can be set by the user, and the storage period of the backup file stored in the safe area can be set in advance in order to prevent the occurrence of the failure due to the capacity exceeding the safety area, Can be managed to be deleted.

In order to prevent the backup process from taking a long time when the capacity of the file to be accessed is large, at the time of backing up in step 318, the anti-virus protection device deletes the entire data constituting the file requested to be accessed Can be backed up one by one. That is, instead of transferring the entire file as a process, it can be transferred in units of blocks and backed up in blocks.

Then, when the anti-virus protection device receives the recovery request of the backup file (620), the corresponding file is recovered using the backup file (622).

FIG. 7 is a flowchart illustrating a process for preventing Ransomware using a bait file in a Ransomware prevention apparatus according to another embodiment of the present invention.

Referring to FIG. 7, when the random access protection device receives a file access request for a file in the file system (710), it determines whether the process requesting access to the file is a trusted process (712). At this time, the anti-virus protection device can classify the process as a trusted process when a case where it is determined that the updated bait file is not infected with the RANCOMMWARE is accessed more than a preset number of times within a predetermined period. That is, in the case of a new process, it is set as an untrusted process. On the other hand, it is possible to set a trusted process in advance, and judge whether it is a trusted process whether it is already set or not.

If it is determined in step 712 that the process requesting the access is a trusted process, the anti-virus protection device provides the access requested file (714).

If it is determined in step 712 that the process requesting access is not a trusted process, the anti-spyware device copies the requested file to generate a decoy file (step 716), provides the decoy file to the process requesting access (step 718) , And checks whether the bait file has been updated (720).

If the bait file is not updated as a result of step 720, the algorithm is terminated.

When the bait file is updated as a result of checking in step 720, the anti-virus protection device checks whether the bait file is infected with the Ramsomware (722).

If it is determined in step 722 that the bait file has been infected with the Ransomware, the Ransomware prevention device informs the user that the infection is infected (for example, via a pop-up message) and deletes the infected bait file (724).

If it is determined in step 722 that the bait file has not been infected with the random software, the anti-virus protection device replaces the file requested to be accessed with the bait file (step 726).

The anti-virus protection apparatus to which the methods for preventing the RAN firmware can be applied using the above-described safety explorer will be described below with reference to FIG.

FIG. 9 is a diagram showing a schematic configuration of an anti-random software device according to an embodiment of the present invention.

9, the anti-virus protection device may include a file system 910, a device driver 920 for security search, an operating system 930 and an application 940, and the application 940 may include a security explorer 942 And a monitoring process 944.

The file system 910 indicates a system for managing a storage device and files stored therein, and means each file and structure stored in the storage device.

The device driver 920 for security search is a connection link between the operating system 930 and the file system 910 or a link between the application 940 and the file system 910. [ That is, in order to access the file system 910, the device driver 920 for security search must be used.

The device driver 920 for security search can perform the method of FIG. 5 through FIG. 5, further confirms that the personal information exists in the file to be stored in the file system 910, (E.g., using a pop-up, etc.) to inform the user that personal information is included in the file stored in the file 910. [ On the other hand, the device driver 920 for security search may be configured to separate the general folder and the partition of the storage device from the safety folder.

The security explorer 942 is a process for creating or setting a security folder, canceling a set security folder, and accessing a file contained in the security folder.

The monitoring process 944 monitors whether or not the safety search device driver 920 is in the installed state to prevent the safety search device driver 920 from being deleted and disabled, Attempts to access the file stored in the file system at a predetermined time interval so as to detect that the file 944 has not been disabled. At this time, the accessed file may be a predetermined file or an arbitrary file.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. The apparatus and components described in the embodiments may be implemented, for example, as a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) unit, a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments and equivalents to the claims are within the scope of the following claims.

910; File system
920; Device drivers for safety navigation
930; operating system
940; application
942; Safety Explorer
944; Monitoring process

Claims (19)

Installing a safety explorer and a device driver for searching for safety which is a path through which all processes access the file system;
Receiving an access request for a file of the file system;
Confirming that the file requested to be accessed is a file included in the secure folder;
Confirming whether the access requested file is a file included in the security folder and the process requesting access is the security explorer;
Allowing access to the access requested file if the process requesting the access is the security explorer;
Detecting whether the safety searching device driver is installed in the monitoring process, and reinstalling the safety searching device driver if the safety searching device driver is not installed;
Attempting access to a file stored in the file system at a predetermined time interval in the monitoring process; And
Determining that the monitoring process is stopped if access to the file stored in the file system does not occur even after the predetermined time interval elapses in the device driver for searching for safety and blocking access to the file system
The method comprising the steps of:
The method according to claim 1,
If the process requesting access is not a security explorer, not allowing access to the access requested file;
Further comprising the steps of:
The method according to claim 1,
Wherein the step of allowing access to the access requested file comprises:
Backing up the file requested to be accessed to a preset storage location for a predetermined time or backing up to the predetermined storage location until the access requested file is accessed for a preset number of times
The method comprising the steps of:
The method of claim 3,
The predetermined storage location may be a storage location,
A safe area managed for backup by making a part of the storage device into a database,
The safe area may include:
The capacity can be set by the user, the storage period of the backed up file is set in advance, and the backed up file exceeding the predetermined period is managed to be deleted
How to prevent Ransomware.
The method of claim 3,
Wherein the step of backing up comprises:
A step of backing up all the data constituting the access requested file by the amount of data to be transferred to the process requesting the access
The method comprising the steps of:
The method according to claim 1,
Wherein the step of allowing access to the access requested file comprises:
Generating a bait file by copying the access requested file;
Providing the bait file to a process requesting the access;
Confirming that the bait file is infected with the Ramsomeware when the bait file is updated; And
If it is determined that the bait file is infected with the Ransomware, the step of informing that the user is infected and deleting the infected bait file
The method comprising the steps of:
The method according to claim 6,
If it is determined that the bait file is not infected with the random software, the step of replacing the requested file with the bait file
Further comprising the steps of:
delete delete delete The method according to claim 1,
If the access requested file is a file included in a boot area of the operating system, blocking the access request
Further comprising the steps of:
The method according to claim 1,
Wherein the step of allowing access to the access requested file comprises:
Requesting a preset password when installing the security explorer; And
If an unauthorized password is input, blocking access to the file requested to be accessed, and if a valid password is input, allowing access to the file requested for access
The method comprising the steps of:
delete delete delete delete delete delete A computer-readable recording medium storing a program for executing the method according to any one of claims 1 to 7 and 11 to 12.

Images