Method, equipment and system for positioning controlled host in internal network

Abstract

A method, equipment and a system for positioning a controlled host in an internal network are disclosed. The method comprises the following steps of the detection device of an external network obtainsa target domain name carried in a DNS request message sent by an internal network host to a DNS server in the external network and the identification replacement information of the internal network host; when detecting that the target domain name is a malicious domain name and the internal network host is the controlled internal network host, the detecting device sends a query request to a querydevice in the internal network, and the query request includes the target domain name and the identification replacement information of the controlled internal network host; and the query device inquires a mapping table and acquires the identification information of the controlled internal network host according to the target domain name and the identification replacement information of the controlled internal network host, and sends the identification information of the controlled internal network host to the detection device. In the invention, under the condition of ensuring the safety of the private data of the internal network, the identification information of the controlled internal network host is quickly positioned and obtained.

Description

technical field [0001] The embodiments of the present application relate to the technical field of network security, and in particular to a method, device and system for locating a controlled host in an intranet. Background technique [0002] Advanced Persistent Threat (APT) attack refers to an attack method in which some professional and organized hackers use advanced attack methods to carry out long-term persistent network attacks on specific targets. After the networks of some key institutions (such as governments, enterprises, agencies, etc.) are attacked by APT, the control hosts located on the external network can use command and control (Command and Control, C&C) instructions to the controlled hosts in the internal network (the following It is called "controlled intranet host") for control, such as controlling the controlled intranet host to update local files, detecting other hosts in the intranet, and so on. [0003] The C&C anomaly detection method based on domain...

AI Technical Summary

Problems solved by technology

[0009] The embodiment of the present application provides a method, device and system for locating a controlled host in an intranet, which are used to solve the problems of low efficiency, poor real-time performance and problems existing in the method for locating a controlled host in an intranet provided by the prior art. The problem of poor compatibility

Images