KR102149711B1 - An apparatus for detecting and preventing ransom-ware behavior using camouflage process, a method thereof and computer recordable medium storing program to perform the method - Google Patents

Abstract

The present invention relates to an apparatus for detecting and preventing ransomware behavior using a camouflage process, a method therefor, and a computer-readable recording medium in which a program for performing the method is recorded. The present invention is a camouflage program generation module that generates and executes a camouflage program, and when a program that attempts to terminate the camouflage program by monitoring the camouflage program is detected, the detected program is determined as ransomware, and the detection A ransomware behavior detection and prevention device including a camouflage program monitoring module for terminating and quarantining a program, a method for the same, and a computer-readable recording medium in which a program performing the method is recorded.

Description

An apparatus for detecting and preventing ransomware behavior using a camouflage process, a method for the same, and a computer-readable recording medium in which a program performing the method is recorded. recordable medium storing program to perform the method}

The present invention relates to a ransomware behavior detection and prevention technology, and more particularly, a ransomware behavior detection and prevention device using a camouflage process, a method therefor, and a computer-readable recording medium in which a program performing the method is recorded. About.

In the case of recently distributed ransomware, various programs are terminated before encryption in order to effectively encrypt user data. In other words, the recent ransomware finds and terminates programs that execute the files before encrypting user document files or data as targets. For example, in the case of the recently popular "Gandcrab" ransomware, Office, SQL related names in the list of all processes running before the ransom act, that is, encrypting data, is performed (actual search process names: oracle.exe, sqlservr.exe) , mysqld.exe onenote.exe, outllok.exe, powerpnt.exe, excel.exe, etc.) and exit. It can be inferred that the judgment of attackers that an open file could be a more important and valuable document was taken into account.

Since the prior art detects an action at a time when the encryption logic operates, some files may be encrypted even when the action is detected. For example, the defense logic that monitors dummy files not only requires dummy files to be installed everywhere, but also there is a possibility that ransom behavior cannot be prevented if the malicious code in which the order of encryption is specified is specified.

[Prior technical literature]

[Patent Literature] Registered Korean Patent Publication No. 1850650 on April 13, 2018 (Name: Mobile storage device that detects ransomware and method therefor)

An object of the present invention is to provide a device capable of preventing ransom behavior by detecting ransomware before starting a ransom behavior, a method therefor, and a computer-readable recording medium in which a program performing the method is recorded.

A ransomware behavior detection and prevention apparatus according to a preferred embodiment of the present invention for achieving the above object includes a camouflage program generation module that generates and executes a camouflage program, and monitors the camouflage program to When a program attempting to terminate is detected, the detected program is determined as ransomware, and a camouflage program monitoring module terminates and isolates the detected program.

The camouflage program monitoring module is characterized by detecting a program that attempts to terminate the camouflage program by hooking a process termination function of the camouflage program.

The ransomware behavior detection and prevention apparatus further includes a white program DB generation module for selecting a white program and configuring a white program database including identification information for the selected white program. At this time, the camouflage program monitoring module determines the detected program as a normal program and stops the quarantine process for the detected program if a program attempting to terminate the camouflage program is included in the white program database. It features.

The white program DB generation module is characterized in that the search for a window system file and an anti-virus program is included in the white program database.

The white program DB generation module is characterized in that the program selected by the user is included in the white program database.

The camouflage program generation module is characterized in that after generating the camouflage program, the information including the entire path of the camouflage program is encrypted and stored.

The camouflage program generation module is characterized in that after automatically generating a folder with a random name, the camouflage program is generated in the created folder.

The camouflage program generation module is characterized in that it creates a camouflage program file in a folder designated by the user according to the user's setting.

The camouflage program monitoring module is characterized by generating a history log file for a program determined as ransomware.

Ransomware behavior detection and prevention method according to a preferred embodiment of the present invention for achieving the above object includes the steps of a camouflage program generation module executing a camouflage program, and the camouflage program monitoring module monitors the camouflage program. The step of determining whether a program attempting to terminate the camouflage program is detected, and when a program attempting to terminate the camouflage program is detected as a result of the determination, the camouflage program monitoring module displays the detected program being white. Determining whether the program is included in the program database; and if the detected program is not a program included in the white program database as a result of the determination, the camouflage program monitoring module determines the detected program as ransomware, And isolating after terminating the detected program.

The step of determining whether a program that attempts to terminate the spoofing program is detected, when the spoofing program monitoring module calls the process termination function of the spoofing program, through a hooking code inserted into the process termination function of the spoofing program. And detecting a program that attempts to terminate the camouflage program.

After the step of determining whether the program is included in the white program database, as a result of the determination, if the detected program is a program included in the white program database, the detected program is determined as a normal program, and the detected program And stopping the containment process for the.

Executing the camouflage program includes the steps of the camouflage program generation module generating the camouflage program, the white program DB generation module constructing the white program database, and the camouflage program generation module generating the camouflage program. And executing the program.

In the step of generating the camouflage program, the camouflage program generation module creates a camouflage program file in a folder designated by the user according to the user's settings, or automatically creates a folder with a random name, and then creates a camouflage program in the created folder. It includes the step of.

The generating of the camouflage program includes the step of encrypting and storing information including the entire path of the camouflage program after the camouflage program generation module generates the camouflage program.

The step of constructing the white program database includes, by the white program DB generation module, searching for a window system file and a vaccine program and including it in the white program database.

The step of configuring the white program database includes the step of including, by the white program DB generation module, a program selected by the user into the white program database.

After the isolating step, the camouflage program monitoring module further comprises generating a history log file for the isolated program.

In addition, a computer-readable recording medium in which a program for performing the method for detecting and preventing ransomware behavior according to the above-described embodiment of the present invention is recorded is provided.

The present invention focuses on the fact that the ransomware terminates the application programs that manage data at once before performing the encryption act, that is, the ransom act, and executes a program disguised as an application program, that is, after executing the disguised program. By detecting a program that attempts to terminate the program, blocking the program, and terminating the program, it is possible to prevent ransom actions performed later.

Moreover, in the present invention, since the detected program may be a normal program such as a system module, a vaccine, etc., such false detection is prevented through a white program database. Accordingly, user documents and data can be protected from ransomware without being confused with normal programs.

1 is a diagram illustrating a computing device according to an embodiment of the present invention.
2 is a block diagram illustrating an apparatus for detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention.
3 is a flowchart illustrating a method of executing a camouflage process according to an embodiment of the present invention.
4 is a flowchart illustrating a method of detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention.

Prior to the detailed description of the present invention, terms or words used in the present specification and claims described below should not be construed as being limited to their usual or dictionary meanings, and the inventors shall use their own invention in the best way. For explanation, based on the principle that it can be appropriately defined as a concept of terms, it should be interpreted as a meaning and concept consistent with the technical idea of the present invention. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention, and do not represent all the technical spirit of the present invention, and various equivalents that can replace them at the time of application It should be understood that there may be water and variations.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this case, it should be noted that the same components in the accompanying drawings are indicated by the same reference numerals as possible. In addition, detailed descriptions of known functions and configurations that may obscure the subject matter of the present invention will be omitted. For the same reason, some components in the accompanying drawings are exaggerated, omitted, or schematically illustrated, and the size of each component does not entirely reflect the actual size.

Embodiments of the present invention may be executed on a computing device that performs computing operations, and may be described in connection with computer executable instructions such as program modules being executed by such a computer system. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of program code means for executing the acts of the invention disclosed herein. Accordingly, it is intended to provide a description of a computing device in which the present invention may be implemented. 1 is a diagram illustrating a computing device according to an embodiment of the present invention.

1, a computing device according to an embodiment of the present invention is a system for connecting various system components including a processing unit 11, a system memory 12, and a system memory 12 to the processing unit 11 It includes a bus 10.

The processing unit 11 is capable of executing computer-executable instructions designed to implement features of the present invention. The processing unit 11 may be a central processing unit (CPU), an application processor, a digital signal processor (DSP), or the like.

The system bus 10 may be any of several types of bus structures including a local bus, a peripheral bus, and a memory bus or memory controller using any of a variety of bus architectures. The system memory 12 includes a ROM (Read Only Memory) 12a and a RAM (Random Access Memory) 12b. A basic input/output system (BIOS) 13a containing basic routines to help transfer information between components in the computing device during startup may generally be stored in ROM 12a.

The computing device may include storage means, for example, a hard disk drive 15 that reads information from or writes information to the hard disk, and reads information from or writes information to the magnetic disk. A magnetic disk drive 16 for recording, and an optical disk drive 17 for reading information from an optical disk such as a CD-ROM or other optical medium or recording information on the optical disk, for example. The hard disk drive 15, the magnetic disk drive 16, and the optical disk drive 17 are each connected to a system bus by a hard disk drive interface 18, a magnetic disk drive interface 19, and an optical drive interface 20, respectively. 10).

In addition, the computing device may further include an external memory 21 as a storage means. The external memory 21 may be connected to the system bus 10 through an input/output interface 24.

The above-described drives and associated computer-readable media read and written by the drives provide nonvolatile storage of computer executable instructions, data structures, program modules, and other data. Exemplary environments described herein illustrate the hard disk 15, the magnetic disk 16, and the optical disk 17, but in addition to magnetic cassette, flash memory card, DVD, Bernoulli cartridge, RAM, ROM Other types of computer-readable media for storing data may be used, including, SSD, and the like.

A program including an operating system 13b, one or more application programs 13c, other program modules 13d, and one or more program modules including program data 13c, loaded and executed by the processing unit 11 The code means may be stored in the hard disk 15, the magnetic disk 16, the optical disk 17, the ROM 12a or the RAM 12b.

In addition, the computing system may receive commands and information from a user through other input devices 22 such as a keyboard, a pointing device, a microphone, a joy stick, a game pad, a scanner, and the like. Also, an image being photographed may be input through an image input sensor such as a camera module. These input devices 22 may be connected to the processing unit 11 through an input/output interface 24 connected to the system bus 10. The input/output interface 24 is, for example, a serial port interface, a PS/2 interface, a parallel port interface, a USB interface, an Institute of Electrical and Electronics Engineers (IEEE) 1394 interface (i.e., a FireWire interface). Any of a variety of different interfaces may be logically represented, or even a combination of different interfaces may be represented logically.

In addition, the computing device according to an embodiment of the present invention may further include a display device 26 such as a monitor or LCD, or an audio device 27 such as a speaker or a microphone. These 26 and 27 are connected to the system bus 10 via a video/audio interface 25. Other peripheral output devices not shown, such as speakers and printers, for example, may also be connected to the computing device. The video/audio interface unit 25 may include a High Definition Multimedia Interface (HDMI), Graphics Device Interface (GDI), or the like.

In addition, the computing device implementing the present invention is capable of accessing a network such as, for example, an office-wide area or enterprise-wide area computer network, a home network, an intranet, and/or the Internet. The computing device can exchange data with external sources such as, for example, a remote computer system, a remote application, and/or a remote database, via such a network. To this end, the computing device to which the present invention is applied includes a network interface 27 for receiving data from an external source and/or transmitting data to an external source.

The computing device according to the embodiment of the present invention may transmit and receive information to and from a device located at a remote location through the network interface 28.

The network interface 28 may be represented as a logical combination of one or more software and/or hardware modules, such as, for example, a network interface card and a corresponding Network Driver Interface Specification ("NDIS") stack.

Similarly, the computing device receives data from an external source or transmits data to an external source through the input/output interface 24. The input/output interface 24 may be connected to a modem 23 (eg, a standard modem, a cable modem, or a digital subscriber line (“DSL”) modem), through which an external source It may receive data from and/or transmit data to an external source.

Although Fig. 1 shows an operating environment suitable for the present invention, the principles of the present invention may be employed in any system capable of implementing the principles of the present invention, with suitable modifications, if necessary. The environment shown in FIG. 1 is exemplary only and does not represent a small portion of the very diverse environments in which the principles of the present invention may be implemented.

In addition, various information generated according to embodiments of the present invention may be stored and accessed on any computer-readable medium related to the computing device. For example, some of these program modules and some of the associated program data, in order to store in the system memory 12, the operating system 13b, the application program 13c, the program module 13d, and/or program data. It may be included in (13e).

Further, when a mass storage device such as a hard disk is connected to the computing system, such program modules and related program data may be stored in the mass storage device. In a network environment, the program module related to the present invention or a part thereof is a remote computer system connected through the modem 23 of the input/output interface 24 or the network interface 28, for example, a computing system of a cloud server or a distributed server. It may be stored in a remote memory storage device such as a system memory and/or mass storage device associated with it. Execution of these modules may be performed in a distributed environment as described above.

Next, in more detail, an apparatus for detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention will be described. 2 is a block diagram illustrating an apparatus for detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention.

2, the processing unit 11 includes a camouflage program generation module 100, a white program DB generation module 200, and a camouflage program monitoring module 300. In the embodiment of the present invention, the camouflage program generation module 100, the white program DB generation module 200, and the camouflage program monitoring module 300 will be described as hardware such as individual architectures operating on a processor, but the present invention is limited thereto. Is not. That is, according to another aspect of the present invention, the camouflage program generation module 100, the white program DB generation module 200, and the camouflage program monitoring module 300 may be software loaded and executed in the processing unit 11. Alternatively, the camouflage program generation module 100, the white program DB generation module 200, and the camouflage program monitoring module 300 may be implemented as a combination of hardware and software.

The camouflage program generation module 100 generates a camouflage program and executes it. According to an embodiment, the camouflage program generation module 100 may generate and execute a camouflage program file in a folder designated by the user according to the user's setting. According to another embodiment, the camouflage program generation module 100 may automatically generate a folder with a random name, then generate a camouflage program in the created folder, and execute it. In addition, the camouflage program generation module 100 encrypts and stores the camouflage program address information including the full path of the executed camouflage program as a file (DB). Preferably, the camouflage program generation module 100 encrypts and stores the camouflage program address information including the full path of the camouflage program in a folder in which the camouflage program monitoring module 300 operates. Here, the encryption of the spoofing program address information is to prevent unnecessary exposure of information on monitoring settings. The camouflage program generation module 100 may execute the camouflage program and then execute the camouflage program monitoring module 300 separately from the camouflage program.

The white program DB generation module 200 is for setting a white program. That is, the white program DB generation module 200 selects a white program and configures a white program database including identification information for the selected white program. The white program DB generation module 200 may search for a window system file and a vaccine program and include it in the white program database. In addition, the white program DB generation module 200 may include a program selected by a user in the white program database. The white program DB generation module 200 encrypts and stores the white program database in a folder in which the program monitoring module 300 operates.

The camouflage program monitoring module 300 is for monitoring all programs to be executed including the camouflage program. The camouflage program monitoring module 300 is executed by the camouflage program generation module 100 separately from the camouflage program. The executed camouflage program monitoring module 300 monitors all programs to be executed including the camouflage program. According to the monitoring, the camouflage program monitoring module 300 hooks the process termination function and monitors termination events for all programs occurring in the OS. In particular, the camouflage program monitoring module 300 is for monitoring a camouflage program to detect a program that attempts to terminate the camouflage program. To this end, the camouflage program monitoring module 300 may detect a program that attempts to terminate the camouflage program by hooking a process termination function of the camouflage program. The camouflage program monitoring module 300 hooks the process termination function of the camouflage program, and when an end event of the camouflage program occurs, the hooked code operates to detect a program that attempts to terminate the camouflage program. For example, the hooking code inserted into the process termination function of the disguised program, that is, the hooked code may detect a program that calls the process termination function. Therefore, when an event to terminate the disguise program occurs, the process termination function of the disguise program is called, and the hooking code inserted into the process termination function of the disguise program can detect a program that calls the process termination function of the disguise program.

When a program attempting to terminate the camouflage program is detected, the camouflage program monitoring module 300 may determine the detected program as ransomware. However, if the detected program is a program included in the white program database, the detected program is determined as a normal program, not ransomware, and the quarantine process for the detected program is stopped. If the camouflage program monitoring module 300 attempts to terminate the camouflage program, and it is not a program included in the white program database, it determines the detected program as ransomware. Subsequently, the camouflage program monitoring module 300 terminates and isolates the program determined to be ransomware. In addition, the camouflage program monitoring module 300 creates and stores a history log file for the isolated program.

Next, a method of detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention will be described. Ransomware behavior detection and prevention methods consist of executing a camouflage process, detecting ransomware behavior through the camouflage process, and preventing ransomware behavior.

First, a method of executing a camouflage process according to an embodiment of the present invention will be described. 3 is a flowchart illustrating a method of executing a camouflage process according to an embodiment of the present invention.

Referring to Figure 3, the camouflage program generation module 100 generates a camouflage program in step S110. According to an embodiment, the camouflage program generation module 100 may generate a camouflage program in a folder designated by the user according to the user's setting. According to another embodiment, the camouflage program generation module 100 may automatically generate a folder with a random name and then generate a camouflage program in the created folder. Here, after the camouflage program generation module 100 generates the camouflage program, the camouflage program address information including the full path of the camouflage program is encrypted and stored in a folder of the camouflage program monitoring module 300.

After the camouflage program is generated, the white program DB generation module 200 selects a white program in step S120 and constructs a white program database including identification information for the selected white program. According to an embodiment, the white program DB generation module 200 may search for a window system file and a vaccine program and include it in the white program database. Also, according to another embodiment, the white program DB generation module 200 may include a program selected by a user in the white program database. In this case, the white program DB generation module 200 may encrypt and store the white program database in a folder in which the program monitoring module 300 operates.

Next, the camouflage program generation module 100 executes the camouflage program created earlier (S110) in step S130.

Next, the camouflage program generation module 100 executes the camouflage program monitoring module 300 separately from the camouflage program previously executed in step S140. The executed camouflage program monitoring module 300 monitors all programs executed in the OS including the camouflage program.

Next, a method of detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention will be described. 4 is a flowchart illustrating a method of detecting and preventing ransomware behavior using a camouflage process according to an embodiment of the present invention.

4, after the camouflage program is executed, the camouflage program monitoring module 300 is loaded and executed by the camouflage program generation module 100 in the processing unit 11 (S140), and the camouflage program monitoring module 300 ) Starts monitoring all programs that are executed including the camouflage program in step S210. According to the monitoring, the camouflage program monitoring module 300 hooks the process termination function and monitors termination events for all programs occurring in the OS.

The camouflage program monitoring module 300 determines whether a program attempting to end the camouflage program is detected in step S220. The camouflage program monitoring module 300 hooks the process termination function of the camouflage program, and when the process termination function of the camouflage program is called when the end event of the camouflage program occurs, the hooking code inserted into the process termination function of the camouflage program operates. It is possible to detect a program that attempts to terminate the disguised program, that is, a program that called the process termination function of the disguised program.

Therefore, when a program attempting to end the camouflage program is detected in step S220, the camouflage program monitoring module 300 proceeds to step S230 to determine whether the detected program is a program included in the white program database.

As a result of the determination in step S230, if the detected program is a program included in the white program database, the camouflage program monitoring module 300 determines that the detected program is a normal program, that is, a white program, not ransomware, and proceeds to step S260. Go ahead and stop the process, that is, the quarantine process for the detected program.

On the other hand, as a result of the determination in step S230, if the detected program is not a program included in the white program database, the camouflage program monitoring module 300 determines that the detected program is ransomware, and proceeds to step S240.

The camouflage program monitoring module 300 terminates and isolates the program detected in step S240, that is, ransomware. Then, the camouflage program monitoring module 300 generates a history log file for a program isolated in step S250, that is, a program determined as ransomware, and stores the corresponding history log file.

As described above, the present invention focuses on the fact that the ransomware terminates the application programs that manage data at once before performing encryption, and executes a program disguised as an application program, that is, the disguised program, and then terminates the disguised program. By detecting a program that attempts to do so, blocking the program, and terminating the program, it is possible to prevent the ramsum behavior performed later. Moreover, in the present invention, since the detected program may be a normal program such as a system module, a vaccine, etc., such false detection is prevented through a white program database.

Meanwhile, the ransomware behavior detection and prevention method using the camouflage process according to the embodiment of the present invention described above may be implemented in the form of a program that can be read through various computer means and recorded in a computer-readable recording medium. Here, the recording medium may include a program command, a data file, a data structure, or the like alone or in combination. The program instructions recorded on the recording medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software. For example, the recording medium includes magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic-optical media such as floptical disks ( magneto-optical media), and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions may include not only machine language wires such as those made by a compiler, but also high-level language wires that can be executed by a computer using an interpreter or the like. These hardware devices may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

The present invention has been described above using several preferred embodiments, but these embodiments are illustrative and not limiting. As such, those of ordinary skill in the art to which the present invention pertains will understand that various changes and modifications can be made according to the equivalence theory without departing from the spirit of the present invention and the scope of the rights presented in the appended claims.

100: camouflage program generation module
200: White program DB generation module
300: camouflage program monitoring module

Claims (19)

In the ransomware behavior detection and prevention device,
A camouflage program generation module for generating and executing a camouflage program;
A white program DB generation module for selecting a white program and configuring a white program database including identification information for the selected white program; And
When the process termination function of the camouflage program is called, a program that attempts to terminate the camouflage program is detected through a hooking code inserted into the process termination function of the camouflage program, and the detected program is included in the white program database. A camouflage program monitoring module configured to determine whether the program is a program, and if the detected program is not a program included in the white program database, determine the detected program as ransomware, and terminate and isolate the detected program; Characterized in that it comprises,
Ransomware behavior detection and prevention device.
delete delete The method of claim 1,
The white program DB generation module
Searching for a window system file and an antivirus program and including it in the white program database
Ransomware behavior detection and prevention device.
The method of claim 1,
The white program DB generation module
Including the program selected by the user in the white program database
Ransomware behavior detection and prevention device.
The method of claim 1,
The camouflage program generation module
After generating the camouflage program, the information including the entire path of the camouflage program is encrypted and stored.
Ransomware behavior detection and prevention device.
The method of claim 6,
The camouflage program generation module
After automatically creating a folder with a random name, a camouflage program is created in the created folder.
Ransomware behavior detection and prevention device.
The method of claim 6,
The camouflage program generation module
Characterized in that the camouflage program file is created in a folder designated by the user according to the user's settings.
Ransomware behavior detection and prevention device.
The method of claim 1,
The camouflage program monitoring module
Characterized in that it creates a history log file for a program determined as ransomware
Ransomware behavior detection and prevention device.
In the ransomware behavior detection and prevention method,
Creating and executing the camouflage program by the camouflage program generation module;
Configuring, by the white program DB generation module, a white program database including identification information on the white program;
Detecting, by the spoofing program monitoring module, a program that attempts to terminate the spoofing program through a hooking code inserted in the process termination function of the spoofing program when the process termination function of the spoofing program is called;
Determining, by the camouflage program monitoring module, whether the detected program is a program included in the white program database when a program that calls an end function for the camouflage program is detected; And
As a result of the determination, if the detected program is not a program included in the white program database, the camouflage program monitoring module determines the detected program as ransomware, terminates the detected program, and isolates the detected program. Characterized in that it comprises
Ransomware behavior detection and prevention methods.
delete The method of claim 10,
After the step of determining whether the program is included in the white program database,
As a result of the determination, if the detected program is a program included in the white program database, determining the detected program as a normal program, and stopping the isolation process for the detected program; and further comprising doing
Ransomware behavior detection and prevention methods.
delete The method of claim 10,
The step of creating and executing the camouflage program
And generating, by the camouflage program generation module, a camouflage program file in a folder designated by the user according to a user's setting or automatically generating a folder with a random name and then generating a camouflage program in the created folder; doing
Ransomware behavior detection and prevention methods.
The method of claim 10,
The step of creating and executing the camouflage program
And after the camouflage program generation module generates the camouflage program, encrypting and storing information including the entire path of the camouflage program.
Ransomware behavior detection and prevention methods.
The method of claim 10,
The step of configuring the white program database
And including, by the white program DB generation module, searching for a window system file and an anti-virus program and including it in the white program database.
Ransomware behavior detection and prevention methods.
The method of claim 10,
The step of configuring the white program database
And including, by the white program DB generation module, a program selected by a user in the white program database.
Ransomware behavior detection and prevention methods.
The method of claim 10,
After the isolating step,
The camouflage program monitoring module generating a history log file for the isolated program; characterized in that it further comprises
Ransomware behavior detection and prevention methods.
A computer-readable recording medium on which a program for executing the method for detecting and preventing ransomware behavior according to any one of claims 10, 12, 14 to 18 by a computer is recorded.

Images