A method and device for locating hosts infected by malicious codes

Abstract

The embodiment of the invention discloses a positioning method of a host machine infected by malicious code and a device, and relates to the technical field of network; the positioning method and thedevice are used for solving the problem that the infected user host machine cannot be positioned in a network allocated with a DNS agent server in the prior art. The method includes steps of extracting a target domain name required to inquiry from the DNS request data when a network safety device acquires the DNS request data; if the target domain name is a malicious domain name, sending the target DNS reply data corresponding to the DNS request data to the DNS agent data, and recording a target internet protocol IP address in a reply part of the target DNS reply data; when the network data isacquired, judging if the target IP address extracted from the network data is the target IP address; if it is, positioning the host machine infected by the malicious code according to the source IP address of the network data.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a method and equipment for locating hosts infected by malicious codes. Background technique [0002] Malicious websites have always been one of the main ways for Trojan horses and viruses to spread. Malicious websites use operating system or software security holes to embed malicious codes in web pages, such as malicious viruses, worms, and Trojan horses. When users visit these web pages, The embedded malicious code will forcibly modify the configuration information of the user's operating system or application software without the user's knowledge, causing the user's host to be infected with malicious code. [0003] In order to improve the credibility of the Internet, it is necessary to locate hosts infected by malicious code and perform security measures such as vulnerability repair and malicious code deletion. The existing method for locating hosts infected by malicious code...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a method and equipment for locating hosts infected by malicious codes, which are used to solve the problem that the prior art cannot locate infected user hosts in a network deployed with a DNS proxy server

Images