A zombie host detection method, system, device and storage medium

Abstract

The present application discloses a method, system, device and storage medium for detecting a zombie host. The method uses the linkage relationship between a firewall device and a user host that detects it, and after the firewall device detects that the user host has zombie host behavior, further The user host obtains information about the relevant programs that cause it to behave as a zombie host, so the user can learn about the abnormal program that causes the user host to behave as a zombie host through the firewall, thereby ensuring that the user can remove the abnormal program in the zombie host in a targeted manner. In addition, the present application also provides a zombie host detection system, equipment and storage medium, the beneficial effects are the same as those described above.

Description

technical field [0001] The present application relates to the field of network security, and in particular, to a method, system, device and storage medium for detecting a zombie host. Background technique [0002] Botnet is a common threat in all kinds of networks. It sends malicious codes to user hosts and executes them in various forms such as emails and web scripts, so as to achieve the purpose of controlling user hosts to become zombie hosts. A one-to-many controllable network is formed between the attacker and the zombie host. The attacker spreads the bot program to infect a large number of hosts on the Internet through various channels, and the zombie host receives the attacker's instructions through a control channel. Including attacking external network services or stealing sensitive corporate information, etc. Once these attacks occur, network resources will be greatly consumed, and corporate secrets may also be leaked. [0003] At present, firewalls are often used...

AI Technical Summary

Problems solved by technology

[0002] Botnet (Botnet) is a common threat in various networks. It sends malicious codes to user hosts through emails, web scripts, etc. A one-to-many controllable network is formed between attackers and zombie hosts. Attackers spread bots through various channels to infect a large number of hosts on the Internet, and zombie hosts receive instructions from attackers through a control channel. Including attacking external network services or stealing sensitive corporate information, etc. Once these attacks occur, they will consume a lot of network resources and may leak corporate secrets

[0003] At present, firewalls are often used to detect zombie hosts. However, currently through the firewall, it is only possible to know whether the user host has zombie host behavior, but cannot know the abnormal program that causes the user host to have zombie host behavior. virus program

Images