关键词: 勒索软件, 混合加密, 诱饵文件, 文件操作监控, 密文还原

Abstract: In this paper, ransomware using hybrid pattern cryptographic system is taken as the research object. By combining decoy files and file operation monitoring, encryption key, encryption algorithm, the first few bytes of cipher text, the size of cipher text and other details while ransomware encrypting files can be obtained, and this paper proposes a new  file recovery approach. This paper evaluates the file recovery approach against 8 active ransomware families, and the results show that the file recovery approach proposed in this paper is effective. The file recovery approach is suitable for file recovery, which is an effective complement to fill the gap in current strategy of ransomware defense.

Key words: ransomware, hybrid pattern cryptographic system, decoy files, file operation monitoring, cipher text recovery