Patent ID: 11874925
Assignee: SECUVE CO., LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G  H

Claim 0:
1. A data processing method for coping with ransomware in a computer apparatus having a processor and a memory, comprising:
registering at least one characteristic value selected in consideration of a type of data;
when output subject data to be outputted from the processor to the memory is generated, dividing the output subject data into a plurality of segments each having a predetermined size, and extracting the at least one characteristic value for the output subject data by analyzing the plurality of segments;
analyzing a matching level of each of the at least one characteristic value by comparing the at least one characteristic value extracted from the output subject data with a corresponding registered characteristic value;
determining whether an ransomware attack occurred to the output subject data according to a matching level analysis result; and
executing an output operation for the output subject data according to a ransomware attack determination result,
wherein the at least one characteristic value comprises a bit position ratio characteristic value that represents a statistical value for a ratio at which a predetermined bit value appears at each bit position in the plurality of segments or a segment bit number ratio characteristic value that represents a statistical value for a number of bits having a particular bit value in the plurality of segments,
wherein the at least one characteristic value for the output subject data further comprises a segment pattern frequency characteristic value that represents a statistical value for each frequency of occurrences of different segment patterns appearing in the plurality of segments, and
wherein registering the at least one characteristic value comprises:
registering at least one of: a bit position ratio characteristic value for each type extracted from data categorized by data types and a maximum and minimum range thereof, a segment bit number ratio characteristic value for each type extracted from the data categorized by data types and a maximum and minimum range thereof, a segment pattern frequency characteristic value for each type extracted from the data categorized by data types and a maximum and minimum range thereof, a bit position ratio characteristic value for all types extracted from all types of data regardless of the data types and a maximum and minimum range thereof, a segment bit number ratio characteristic value for all types extracted from all the types of data regardless of the data types and a maximum and minimum range thereof, and a segment pattern frequency characteristic value for all types extracted from all the types of data regardless of the data types and a maximum and minimum range thereof.