WO2023024125A1

WO2023024125A1 - Ransomware defense method and system based on trusted computing, and related device

Info

Publication number: WO2023024125A1
Application number: PCT/CN2021/115509
Authority: WO
Inventors: 陶源; 胡巍; 李末岩; 李明; 张宇翔
Original assignee: 公安部第三研究所
Priority date: 2021-08-23
Filing date: 2021-08-31
Publication date: 2023-03-02
Also published as: CN113660282A

Abstract

Disclosed in the present invention are a ransomware defense method and system based on trusted computing, and a related device. The method of the present solution comprises: automatically acquiring traffic information in a network, and determining a service data traffic relationship between various network assets; establishing an access control policy according to a trusted access list, isolating a logical network in the network, re-dividing a network region, and forming a micro-isolation region inside the network; virtualizing a corresponding virtual IP and port, forming a corresponding honeypot group, and mixing the honeypot group with an actual host in the network; and when the number of times that a honeypot is accessed exceeds a set number of times, regarding the IP as an untrusted object for interception. By means of the ransomware defense solution based on trusted computing provided in the present invention, behaviors of malicious programs such as ransomware can be rapidly detected and effectively restrained in a timely manner, or the risk of the malicious programs such as ransomware is controlled to be in a micro-isolation region, thereby greatly improving the security of "east-west" traffic (an inner boundary) of the network.

Description

A method, system and related equipment for ransomware defense based on trusted computing

technical field

The invention relates to network security technology, in particular to intranet security technology.

Background technique

Despite the development of technology, with the substantial improvement of computing power and storage capacity, and the network "north-south" traffic passing through the border security protection has been greatly protected, the security of "east-west" traffic (internal border) is always safe. Where the defense is weakest. Insider attacks have become the biggest risk to internal security. The ransomware virus even opened the gap in the "east-west" flow protection, and arbitrary attacks and damages brought great risks to the security of the intranet.

Relying only on traditional passive defense methods such as firewalls, gateways, IPS, IDS, WAF, and APT has been difficult to deal with current network man-made attacks, and is easily exploited by attackers and ransomware. The traditional thinking of scanning for vulnerabilities and patching is no longer conducive to overall security .

It can be seen that how to improve intranet security in a proactive manner is an urgent problem in this field.

Contents of the invention

Aiming at the problems existing in the existing network security technology that basically adopts passive defense means, the purpose of the present invention is to provide a blackmail virus defense method based on trusted computing, which can be oriented to specific application scenarios and security requirements, and protect important network assets. Refactoring to form a customized new trusted architecture, which can quickly discover the behavior of malicious programs such as ransomware viruses, and effectively and timely contain them, or control the risk of malicious programs such as ransomware viruses within a small range. This effectively improves network security.

On this basis, the present invention further provides a ransomware defense system capable of implementing the ransomware defense method, and related equipment.

In order to achieve the above purpose, the trusted computing-based ransomware defense method provided by the present invention includes:

Automatically obtain traffic information in the network, and judge the business data traffic relationship between various network assets;

According to the trusted access list, establish an access control strategy, isolate the logical network in the network, re-divide the network area, and form a microscopic isolation area inside the network;

Virtualize the corresponding virtual IP and port to form a corresponding honeypot group and mix it with the actual host in the network; when the number of honeypot visits exceeds the set number of times, the IP is regarded as an untrustworthy object and intercepted.

Further, the ransomware defense method draws a complete business flow model diagram through policy calculation after self-learning the east-west traffic of the network.

Further, the ransomware defense method also lists the corresponding access source and target IPs, port numbers and data flows according to the identification strategy through self-learning of east-west traffic on the network.

In order to achieve the above purpose, the trusted computing-based ransomware defense system provided by the present invention includes: a data pool, a security visualization and policy interaction unit, a presentation layer and an operation layer group;

The data pool imports automatically obtained traffic data information in the network;

The security visualization and policy interaction unit automatically monitors the traffic in the network, judges the business data flow relationship between various network assets through independent learning, and establishes a corresponding trusted access control strategy according to the trusted access list; Perform logical network isolation to form a corresponding micro-isolation zone; the security visualization and policy interaction unit also virtualizes the corresponding virtual IP and port, forming a large number of honeypots, and mixing them with actual hosts in the network;

The display layer is used to display vulnerabilities, malware, business relationships and ransomware;

The operation layer is used to control the micro-isolation, honeypot and disposal module, and through the micro-isolation and honeypot to control business trusted access control and adjust the trusted access relationship, and block the discovered ransomware through the processing module.

Further, the security visualization and policy interaction unit can create trusted access templates in the entire network, adjust trusted access control policies based on the trusted access templates, and divide micro-isolated areas as required.

Further, the security visualization and policy interaction unit also summarizes the information through self-learning of east-west traffic on the network, and then draws a complete business flow model diagram through policy calculation.

In order to achieve the above object, the present invention provides a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the steps of the above ransomware defense method are implemented.

In order to achieve the above object, the present invention provides a processor, the processor is used to run a program, and when the program runs, the steps of the above blackmail virus defense method are executed.

In order to achieve the above object, the present invention provides a terminal device, which includes a processor, a memory, and a program stored on the memory and operable on the processor, the program code is loaded and executed by the processor to achieve the above Steps of ransomware defense method.

In order to achieve the above object, the present invention provides a computer program product, which is suitable for executing the steps of the above blackmail virus defense method when executed on a data processing device.

The blackmail virus defense scheme based on trusted computing provided by the present invention is oriented to specific application scenarios and security requirements, and forms a customized trusted system structure for important network assets. This scheme can quickly detect the behavior of malicious programs such as blackmail virus, and effectively Contain in time, or control the risk of malicious programs such as ransomware in a micro-isolated area, thereby greatly improving the security of network "east-west" traffic (internal border).

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Fig. 1 is the architectural example diagram of the ransomware virus defense system in the example of the present invention;

Fig. 2 is an example diagram of the interception of the ransomware defense system in the example of the present invention.

Detailed ways

In order to make the technical means, creative features, goals and effects achieved by the present invention easy to understand, the present invention will be further described below in conjunction with specific illustrations.

For relying on traditional defense methods, information systems are vulnerable to ransomware attacks. This patent provides a ransomware defense scheme based on trusted computing, which is oriented to specific application scenarios and security requirements, and reconstructs important network assets to form a customized trusted architecture for important network assets.

Accordingly, this ransomware virus defense scheme can identify and determine trusted subjects and objects, control and formulate access rules between trusted subjects and objects, audit the access behavior of subjects and objects, monitor the running status of subjects and objects, and alarm dangerous behaviors, which can quickly detect The behavior of malicious programs such as ransomware, and effectively and timely contain them, or control the risk of malicious programs such as ransomware within a smaller range, such as a micro-isolated area.

Specifically, this ransomware defense scheme builds a whitelist based on the trusted access list and establishes an access control strategy; at the same time, it isolates logical networks such as public areas and key areas of the information network to avoid the spread of unsafe factors. , the security policy can be implemented more effectively. On this basis, this ransomware defense scheme forms a large number of honeypots to intercept captured untrustworthy IPs and prevent them from accessing real hosts. Access to the honeypot. This ransomware defense solution can quickly detect the behavior of malicious programs such as ransomware, and contain them effectively and in a timely manner, or control the risk of malicious programs such as ransomware in a micro-isolated area.

This ransomware defense scheme mainly implements two aspects of trusted access control and untrusted object interception to improve the security of the information network system during operation.

(1) Trusted access control

This ransomware defense scheme can realize trusted access control. This scheme judges the business data flow relationship between various network assets by automatically obtaining the flow information in the information network system.

The method for judging the business data flow relationship between network assets in this solution is not limited here, and may be determined according to actual needs.

Based on the obtained traffic information, this ransomware defense solution establishes an independent traffic analysis model, summarizes the traffic information through a stage of self-learning of network east-west traffic, and then draws a complete business flow model diagram through policy calculation to assist The administrator manages the entire enterprise intranet.

The policy calculation and drawing means for forming the business flow model diagram in this solution are not limited here, and can be determined according to actual needs.

Furthermore, during the self-learning process of this solution, the autonomous traffic analysis model lists the corresponding access source and destination IPs, port numbers and data flows in the information network system through corresponding identification strategies. Through this model, the logical application diagram of the entire information asset in the information network system can be grasped quickly, and all subjects and objects of trusted access can be displayed in the network based on this.

In this solution, after learning and analyzing the obtained traffic information by the autonomous traffic analysis model, the corresponding white list is constructed according to the trusted access list, and the access control strategy is further established accordingly.

At the same time, in order to avoid the spread of unsafe factors, this scheme isolates the logical networks such as public areas and key areas of the information network system, thereby realizing a reasonable division of network areas and forming corresponding micro-isolation areas. Corresponding access control policies are implemented in the isolation respectively.

As an optimal solution, the access control strategy in this solution is based on the whitelist mode of quintuple, which only allows IP to access IP ports, and does not allow other ports.

At the same time, this ransomware defense solution can customize and adjust strategies: add, open, close, adjust and reconstruct five-tuples.

(2) Untrusted object interception

In the structural design of high-level information systems, the goal of information system defense is to eliminate the mutual interference between system components, establish a strict interaction structure, and prevent security functions from being bypassed and tampered with.

Accordingly, this ransomware defense scheme verifies the credibility of components in the information system by intercepting untrustworthy objects, ensures a strict interaction structure, and prevents security functions from being bypassed and tampered with.

This scheme virtualizes a large number of virtual IPs and ports to form a large number of honeypots. When the number of honeypot visits exceeds the set number of times, this scheme regards the IP as an untrustworthy object.

The virtual IPs in this ransomware defense solution will be automatically generated in batches, and public ports (such as 138, 139, 445, etc.) on the IP will be opened. The generated IP ranges and addresses can be customized as needed. It is possible to access automatically generated IP and port numbers, form honeypot groups, and mix with real hosts. When the access of the honeypot group exceeds a certain threshold, it is decided to change the source IP to an untrusted IP.

This solution will immediately intercept the untrusted IP after the untrusted object interception technology captures the untrusted IP, so as to realize the immediate interception of the untrusted IP captured by the hologram and prevent it from accessing the real host, but it will not intercept the untrusted IP to continue to access the honeycomb jar, and continue to allow untrusted IPs to enter the honeypot.

In order to further generate this ransomware defense scheme, the following uses corresponding examples to further illustrate this ransomware defense scheme.

Based on the ransomware defense scheme, this example presents a ransomware defense system that can realize the ransomware defense scheme.

Referring to Fig. 1, the ransomware defense system 100 (or trusted protection system) in this example is mainly composed of a data pool 110, a security visualization and policy interaction unit 120, a display layer group 130 and an operation layer group 140.

The data pool 110 in this system imports the traffic data information in the network that is automatically obtained;

The security visualization and policy interaction unit 120 in this system automatically monitors the traffic in the network by constructing a corresponding independent traffic analysis model, and then judges the business data flow relationship between various network assets through independent learning, and according to the trusted access list , to establish a corresponding trusted access control strategy; at the same time, logical network isolation is carried out for network assets to form a corresponding micro-isolation zone. The security visualization and policy interaction unit 120 also virtualizes corresponding virtual IPs and ports to form a large number of honeypots, which are mixed with actual hosts in the network.

The display layer group 130 in this system performs data interaction with the security visualization and policy interaction unit 120 to display vulnerabilities, malicious software, business relationships and ransomware.

The operation layer group 140 in this system is used to control the micro-isolation area, honeypot and disposal module, and control the business trusted access control and adjust the trusted access relationship through the micro-isolation area and honeypot, and block the discovered blackmail through the processing module Virus.

In this system, micro-isolation is used to realize effective security control of the east-west direction of the network. To this end, the security visualization and policy interaction unit 120 in this system sorts out the assets of the information network system, isolates them according to the logical relationship of the business, the data flow direction between the business, and the agreement, and builds a complete and accurate credible Access architecture, which enables accurate micro-segregation.

As a preferred solution, the security visualization and policy interaction unit 120 in this system automatically monitors the traffic in the network based on the established autonomous traffic analysis model, summarizes the information, and sorts out the assets in the intranet and the logical application relationship of various assets , forming a corresponding business flow model diagram and an asset logic application diagram, which can be displayed through the corresponding display layer group 130, so that the business flow can be visualized. And based on this, quickly and proactively create trusted access templates in the entire network. Therefore, in this system, the operation layer group 140 adjusts the trusted access policy according to the requirement based on the trusted access template, and divides the micro-isolation area.

In this system, when dividing and constructing the micro isolation area, the information network system assets are divided into subjects and objects according to the different properties of entities. Among them, the information subject is the user or process that makes information flow in the system or changes the state of the system. Objects can be passive entities, such as files or blocks of memory, that can contain or receive information. Based on this principle, the system divides and constructs corresponding micro-isolation areas.

In this system, corresponding trusted access control strategies are established for the divided and constructed micro-isolated areas, so that each micro-isolated area has its own independent trusted access control strategy, thereby further improving the security of the entire information network system.

Therefore, when the system is running, based on the micro-quarantine function, when the host in the micro-quarantine is attacked by malicious programs such as ransomware, the ransomware can only try to infect in the micro-quarantine. At the same time, because each micro-isolation area runs its own trusted access control strategy, based on the established trusted whitelist mechanism, and at the same time blocks the ports used by the ransomware, the ransomware will not cause greater impact. If the ports used are not blocked, ransomware can only infect other hosts in the micro-quarantine with ports open. This way, the ransomware's reach is minimized.

The following example illustrates the running process of the ransomware defense system 100 given in this example.

Referring to FIG. 1 , the ransomware defense system 100 is composed of a data pool, security visualization and policy interaction, a display layer and an operation layer, specifically as above. The whole system is arranged in the corresponding information network system.

Under such settings, the ransomware defense system 100 deployed in the information network system imports the traffic data information of the information network system, and analyzes from the aspects of filling fork, business flow, vulnerability scanning, and third-party data. The presentation layer is used to display vulnerabilities, malware, business relationships, and ransomware. The operational layer is used to control microsegmentation, honeypots, and management. Control business trusted access control and adjust trusted access relationship through micro-isolation and honeypot. The operation layer management is used to automatically block and manually block the discovered ransomware.

Referring to Figure 2, the ransomware defense system sorts out the assets of the information network system, and divides the information network system into five micro-isolation areas according to the logical relationship of the business, the data flow direction between the businesses, and the agreement: micro-isolation Region 1 - Microisolation Region 5. And establish corresponding trusted access control policies for each micro-isolated area, and run their respective trusted access control policies.

As an example, among the five micro-isolated areas formed in this example, the hosts in micro-isolated area 1 and micro-isolated area 5 can allow port 139 to be accessed.

When the ransomware defense system is running, it can realize trusted defense. If the host in the information network system is implanted with ransomware or other malicious programs, when the ransomware starts to infect, it will inevitably try to infect the captured host.

At this time, the security visualization and policy interaction unit in the ransomware defense system will detect the ransomware in time through the independent learning and analysis of network traffic, the established trusted access control strategy and the formed honeypot. Hosts with physical ports are immediately blocked and an alarm is raised in the system, which is displayed by the presentation layer.

At the same time, this ransomware defense system is based on the micro-isolation function. When a host in the micro-isolation area is implanted with malicious programs such as ransomware, the ransomware will only attempt to infect within the micro-isolation area; If the whitelist mechanism has been established, if the port used by the ransomware has been blocked for access, then the ransomware cannot cause greater impact; if the port used by the ransomware is not blocked for access, then the ransomware can only infect micro Other hosts that open this port in the isolation area, so as to minimize the impact of ransomware.

Continuing the above case (combined with Figure 2), the host in the isolated area 5 in the information network system is infected by the ransomware virus. The ransomware can only infect other hosts in this isolation area in isolation area 5, and is based on the trusted access control policy configured in this isolation area.

Since the ransomware mainly uses port 139 to infect corresponding hosts, in this case, the formed micro-isolation area 2, micro-isolation area 3, and micro-isolation area 4 block and deny access to port 139 based on their own trusted access control policies. , and then the ransomware uses port 139 to enter micro-isolation zone 2, micro-isolation zone 3, and micro-isolation zone 4; at the same time, since micro-isolation zone 1 allows access to port 139 based on its own trusted access control policy, then the The ransomware can use port 139 to enter the micro isolation area 1. In this way, it is possible to control the influence range of the ransomware within the scope of the micro-isolated area 5 and the micro-isolated area 1 .

In addition, in the above process, based on the untrusted object interception technology, when a host in the micro-isolation area is implanted with malicious programs such as ransomware, when the ransomware starts to infect, it will inevitably try to infect the honeypot. The trusted defense system will immediately block the host at the access physical port and give an alarm in the system.

It can be seen from the above example that when the ransomware defense system is implemented, its architecture can realize the analysis, monitoring and auditing of security events. The network security expert knowledge base of the corresponding credible defense system can be established by using methods such as rule model, correlation analysis and machine learning, so that the system can respond to various risks in a timely manner.

The ransomware defense system realizes the combination of access control and authorization through corresponding micro-isolation technology to prevent unauthorized access and resource abuse. Microscopic isolation is to classify the assets in the information network system and isolate them according to the logical relationship of the business. Trusted access architecture is built on the flow of data between services and protocols. The authorized subject configures the access control strategy according to the data classification and hierarchical structure, and the control granularity can reach the appropriate granularity of data organization.

This ransomware defense system can access the network in the role of an access layer switch, the switch port is connected to a real server or terminal, and the control node is sinked to the access port of each server to realize end-to-end micro-isolation function and holographic trapping Function, multiple ransomware defense systems can perform unified management and control and issue policies through clustering.

Specific application scenarios and security requirements can be realized through the access and deployment of the ransomware defense system. In order to avoid the spread of unsafe factors, logical networks such as public areas and key areas are isolated. Reasonable division of network areas can implement security policies more effectively. This ransomware defense system can immediately intercept captured untrustworthy IPs to prevent them from accessing real hosts. This system will not block untrusted IPs from continuing to access the honeypot, and will continue to allow untrusted IPs to enter the honeypot. It can quickly detect the behavior of malicious programs such as ransomware, and can effectively and timely contain or control the risk of malicious programs such as ransomware in a small range, such as a micro-quarantine.

In addition, on the basis of the foregoing solution, an embodiment of the present invention also provides a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the steps of the above ransomware defense method are implemented.

Further, the embodiment of the present invention also provides a processor, the processor is used to run a program, wherein, when the program is running, the steps of the implementation method of the above-mentioned ransomware defense are executed.

Further, an embodiment of the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and operable on the processor, and the program code is loaded and executed by the processor to implement The steps of the implementation method of the above ransomware defense.

Further, the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the method for implementing the above ransomware defense.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and module can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read only memory (ROM) or flash RAM. The memory is an example of a computer readable medium.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The basic principles, main features and advantages of the present invention have been shown and described above. Those skilled in the industry should understand that the present invention is not limited by the above-mentioned embodiments. What are described in the above-mentioned embodiments and the description only illustrate the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will also have Variations and improvements are possible, which fall within the scope of the claimed invention. The protection scope of the present invention is defined by the appended claims and their equivalents.

Claims

The ransomware defense method based on trusted computing is characterized in that it includes:

Automatically obtain traffic information in the network, and judge the business data traffic relationship between various network assets;

According to the trusted access list, establish an access control strategy, isolate the logical network in the network, re-divide the network area, and form a microscopic isolation area inside the network;

Virtualize the corresponding virtual IP and port to form a corresponding honeypot group and mix it with the actual host in the network; when the number of honeypot visits exceeds the set number of times, the IP is regarded as an untrustworthy object and intercepted.
The ransomware defense method according to claim 1, wherein the ransomware defense method draws a complete business flow model diagram through policy calculation after self-study of network east-west traffic.
The ransomware defense method according to claim 1, wherein the ransomware defense method also lists the corresponding access source and target IP, port number and data flow.
The ransomware defense system based on trusted computing is characterized in that it includes: a data pool, a security visualization and policy interaction unit, a display layer and an operation layer group;

The data pool imports automatically obtained traffic data information in the network;

The security visualization and policy interaction unit automatically monitors the traffic in the network, judges the business data flow relationship between various network assets through independent learning, and establishes a corresponding trusted access control strategy according to the trusted access list; Perform logical network isolation to form a corresponding micro-isolation zone; the security visualization and policy interaction unit also virtualizes the corresponding virtual IP and port, forming a large number of honeypots, and mixing them with actual hosts in the network;

The display layer is used to display vulnerabilities, malware, business relationships and ransomware;

The operation layer is used to control the micro-isolation, honeypot and disposal module, and through the micro-isolation and honeypot to control business trusted access control and adjust the trusted access relationship, and block the discovered ransomware through the processing module.
The ransomware defense system according to claim 4, wherein the security visualization and policy interaction unit can create trusted access templates in the entire network, and adjust trusted access control policies based on the trusted access templates, And divide the micro isolation area according to the need.
The ransomware defense system according to claim 4, wherein the security visualization and policy interaction unit also summarizes information through self-study of east-west traffic on the network, and then draws a complete business flow model through policy calculation picture.
A computer-readable storage medium, on which a program is stored, characterized in that, when the program is executed by a processor, the steps of the ransomware defense method described in any one of claims 1-3 are implemented.
A processor, the processor is used to run a program, wherein the program executes the steps of the ransomware defense method according to any one of claims 1-3 when the program is running.
A terminal device, which includes a processor, a memory, and a program stored on the memory and operable on the processor, wherein the program code is loaded and executed by the processor to implement claims 1-3 The steps of any one of the ransomware defense methods.
A computer program product, characterized in that, when executed on a data processing device, it is suitable for performing the steps of the ransomware defense method according to any one of claims 1-3.