A method, system and related device for determining a lost host

Abstract

This application discloses a method for determining a lost host, which can effectively prevent the firewall from judging the internal DNS server as a lost host again through the identification capability, and through the linkage mechanism, the firewall that detects a malicious domain name will notify the internal DNS server of this situation, so that the internal DNS According to the stored domain name resolution request, the server finds the host that initiates the domain name resolution request, thereby locating the real compromised host. Applying the scheme of this application, in the scenario of determining the compromised host, the firewall and the internal DNS server no longer act independently, but under the joint action of identification capability, linkage mechanism and storage capability, they can accurately locate the compromised host and avoid It eliminates the occurrence of misjudgment and a series of problems caused by misjudgment, and improves the security of the network. The present application also discloses a system for determining a lost host, a firewall device, an internal DNS server, and a computer-readable storage medium, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method, a system, a firewall, an internal DNS server and a computer-readable storage medium for determining a lost host. Background technique [0002] Hackers or malicious attackers often choose to control other people's computer equipment (host) to carry out malicious attacks, so as to avoid tracking and conceal themselves. Such hosts controlled to perform malicious attacks are usually called compromised hosts. [0003] Compared with individual computer equipment, once the internal host in the intranet environment becomes a compromised host, it will become a huge security risk that threatens the security of the entire intranet environment. Therefore, how to determine whether there is a compromised host in the intranet environment, and which one It is very important that the internal host is the compromised host. [0004] In the prior art, the compromised ho...

AI Technical Summary

Problems solved by technology

However, it is obviously impossible for the internal DNS server to be a compromised host. That is to say, under the existing compromised host determination mechanism, the internal DNS server is often mistakenly identified as a compromised host, so that the real compromised host can escape detection and pose a security risk. can't be resolved

Images