1.Assess risks and reduce network exposurechecks the security baseline of the host, evaluates whether the terminal has risks such as exploitable vulnerabilities, weak passwords, and open unsafe ports, discovers security risks in time before security incidents occur, evaluates regularly, and determines the security risk level of the host according to the evaluation results.
2.system reinforcement, blocking propagation entranceEffective protection for disk boot area, system registry, key configuration items, etc., prevents ransomware from using host system risks to penetrate and spread, and regularly reinforces the system according to the risk assessment results to continuously reduce system security risks.
3.Built-in antivirus engine, found known ransomwarevirus feature matching is one of the most common ransomware killing technology, through the sample feature matching, for known viruses, this method is the simplest and most direct method. The heuristic scanning technique is actually a dynamic height or decompiler implemented in a specific way to gradually understand and determine the real motivation of the relevant instruction sequence by decompilating it. For virus samples with shells, regular anti-virus methods cannot be effectively found and processed, and the problem of shells is usually handled by dynamic unshelling of virtual machines.
4.blackmail behavior detection, blocking unknown blackmail attacksransomware software has typical behaviors such as disk/file system traversal, ending process, clearing service, encrypting files, encrypting disks, volume shadow deletion, backup deletion, etc. By detecting typical behaviors of ransomware, ransomware intrusion and destruction can be effectively found, blackmail process can be blocked or terminated in time, and system security can be protected.
5.blackmail virus trapping, active lure ransomware appearedransomware typically traverses the disk, reading and writing files. Some files are randomly generated on the disk. These files have no meaning for normal applications and system processes and are generally not accessed. Monitoring the access of bait files, if there is a program to operate on these trap files, it is very likely to be a ransomware attack.
6.regular data backup to ensure uninterrupted business operationAnti-Ransomware supports local data backup and external professional backup recovery system, local data backup, protection of core data, data stored in the local designated disk, no additional cost.
