Multi-process clustering-based ransomware attack detection device and method, and recording medium for recording program for implementing method

Abstract

The present disclosure relates to a ransomware attack detection device and method, and a recording medium having a program recorded thereon, the program for implementing the method. More particularly, the present disclosure relates to a multiprocess clustering-based ransomware attack detection device and method, and a recording medium having a program recorded thereon, the program being configured to implement the method, wherein a cluster ID for a cluster assigned to processes created at a kernel level of an operating system (OS) is created, processes branched from one parent process information read and written by the processes are clustered for each cluster ID, and a ransomware attack is detected and blocked according to whether the clustered information is changed or damaged.