Method for detecting ransomware-encrypted file, storage medium and electronic device

Abstract

A method for detecting a ransomware-encrypted file includes: acquiring a designated file; extracting bytes from a file header, a file middle portion and a file trailer of the designated file respectively; extracting features from the extracted bytes, where the extracted features include at least a variance of a distribution of a first preset type of characters; inputting the extracted features into more than one first machine learning model to obtain a probability distribution, outputted by each of the more than one first machine learning model, indicating a likelihood that the designated file is ransomware-encrypted; and determining, based on the probability distribution, whether the designated file is ransomware-encrypted. The present disclosure improves efficiency and accuracy of ransomware detection by extracting bytes and features from different portions of the designated file and utilizing a plurality of machine learning models for ransomware detection.