Botnet host detection method, system and device and storage medium

Abstract

The invention discloses a zombie host detection method, system and device and a storage medium. According to the method, the linkage relationship between the firewall device and the user host is detected; after the firewall equipment detects that the user host has a zombie host behavior; furthermore, the information of the related programs causing the user host to have zombie host behaviors is obtained through the user host, so that the user can learn the abnormal programs causing the user host to have zombie host behaviors through the firewall, and the user is ensured to be capable of clearing the abnormal programs in the zombie host in a targeted manner. In addition, the invention further provides a zombie host detection system, zombie host detection equipment and a storage medium, whichhave the same beneficial effects.

Description

technical field [0001] The present application relates to the field of network security, in particular to a method, system, equipment and storage medium for detecting a zombie host. Background technique [0002] Botnet (Botnet) is a common threat in various networks. It sends malicious codes to user hosts through emails, web scripts, etc. A one-to-many controllable network is formed between attackers and zombie hosts. Attackers spread bots through various channels to infect a large number of hosts on the Internet, and zombie hosts receive instructions from attackers through a control channel. Including attacking external network services or stealing sensitive corporate information, once these attacks occur, they will consume a lot of network resources and may leak corporate secrets. [0003] At present, firewalls are often used to detect zombie hosts. However, currently through the firewall, it is only possible to know whether the user host has zombie host behavior, but can...

AI Technical Summary

Problems solved by technology

[0002] Botnet (Botnet) is a common threat in various networks. It sends malicious codes to user hosts through emails, web scripts, etc. A one-to-many controllable network is formed between attackers and zombie hosts. Attackers spread bots through various channels to infect a large number of hosts on the Internet, and zombie hosts receive instructions from attackers through a control channel. Including attacking external network services or stealing sensitive corporate information, etc. Once these attacks occur, they will consume a lot of network resources and may leak corporate secrets

[0003] At present, firewalls are often used to detect zombie hosts. However, currently through the firewall, it is only possible to know whether the user host has zombie host behavior, but cannot know the abnormal program that causes the user host to have zombie host behavior. virus program

Images