Reverse tracing method and device of proxy host

Abstract

The invention relates to a reverse tracing method and device of a proxy host, belonging to the technical field of network security. The method comprises the steps of screening out at least one piece of HTTP request data with a proxy behavior from intercepted WEB attack warning logs; determining whether a request head of each piece of HTTP request data of the at least one HTTP request data comprises a real IP address of a real attacker; and if first HTTP request data comprising the real IP address of the real attacker exists in the at least one HTTP request data, searching a preset threat intelligence database for the real IP address and a proxy IP address of the first HTTP request data, so as to obtain a first query result. The method determines the IP address of the real attack source andcompletes tracing work rapidly and effectively, and helps network security protection equipment better identify proxy attack behaviors.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a reverse tracing method and device for a proxy host. Background technique [0002] In the process of daily analysis of network security device logs, it is found that the IP address of the attack source of most alarms is not the real IP address of the attacker. Network attackers not only have the ability to detect vulnerabilities, but also have higher security awareness than ordinary people, especially Black industry practitioners who make a living in the black industry chain have a certain degree of research and actual combat on network anonymous attack technology. However, these so-called "professional" hackers are often producing network attack warning data every day, which brings great challenges to network security. In the traditional traceability of hackers and even black industry network attacks, the clues are often broken on the proxy IP address, and...

AI Technical Summary

Problems solved by technology

However, these so-called "professional" hackers are often producing network attack warning data every day, which brings great challenges to network security

In the traditional traceability of hackers and even black industry network attacks, the clues are often broken on the proxy IP address, and the real IP address of the attacker cannot be traced, so measures cannot be taken to improve the intrusion identification of network security protection equipment ability

Images