Ransomware detection method and device

The embodiment of the invention provides a ransomware detection method. The ransomware detection method comprises the following steps: determining a sequence of traversing terminal files by historicalransomware; deploying a stain file on the terminal according to the determined sequence of traversing the terminal file by the historical ransomware so as to ensure that the stain file is traversed before any important file of the terminal is traversed by the ransomware; when it is monitored that the operation state of the stain file is abnormal, obtaining all processes of the terminal at present; and if a certain process meets any specific attribute of the ransomware library, determining a fact that the software corresponding to the process is ransomware. Compared with a method of deployinga stain file on a terminal device and monitoring the ransomware through the API interfaces and monitoring the API interfaces corresponding to the I/O operations, on one hand, when the operation stateof the stain file is monitored, the frequency of obtaining the operation state of the stain file is far lower than the frequency of the I/O operations, so that the monitoring cost is low, and the system operation loss is low; and on the other hand, the operation state monitoring and I/O operation of the taint file are mutually independent, the I/O operation speed is not influenced, and the methodhas relatively high feasibility and is suitable for popularization and application.