Intranet environment infected botnet machine troubleshooting processing method, device, equipment and medium

Abstract

The invention provides a troubleshooting processing method, device, equipment and medium for a botnet infected machine in an intranet environment, and the method comprises the steps: carrying out the abnormality analysis of network flow and network behaviors corresponding to an intranet, so as to determine target equipment infected by a botnet from a plurality of pieces of communication equipment in communication connection with the intranet; isolating the target equipment from the intranet; the propagation module is used for carrying out malicious software analysis on the target equipment so as to extract the botnet from the target equipment; embedding an executable code corresponding to the propagation module into a preset special killing tool to obtain a disposal tool; the method comprises the following steps: comprehensively scanning an intranet environment through a disposal tool to determine transmission equipment with botnet infection; botnet clearing and reinforcement protection are performed on the target device and the propagation device, so that the protection capability of the infected machine in the intranet is further enhanced, and it is ensured that the infected machine does not become an attack target of the Botnet any more.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method, apparatus, equipment, and medium for investigating and dealing with infected botnet machines in an intranet environment. Background Technology

[0002] With the development of information technology, the number and complexity of devices in intranet environments are constantly increasing, making the threat of botnets increasingly serious. A botnet is a network of a large number of computers controlled by malware. Attackers can remotely command these infected computers to perform malicious operations, such as DDoS attacks (Distributed Denial of Service) and data theft. This not only threatens enterprise network security but may also lead to serious consequences such as information leakage and business interruption.

[0003] Botnets typically infect multiple devices within an internal network, forming a vast control network to conduct distributed attacks, steal sensitive information, or engage in other malicious activities. Communication between infected devices often employs encryption or obfuscation techniques, making it difficult for traditional traffic analysis and signature detection methods to accurately identify these communication behaviors. This results in difficulties in timely detection and prevention of botnet spread in its early stages. Furthermore, once a machine within the internal network is infected by a botnet, traditional detection tools struggle to pinpoint the source of infection and the propagation path, making the cleanup process extremely difficult and prone to overlooking potentially infected devices. Traditional botnet protection methods typically rely on predefined rules and static signatures to detect and block botnet propagation. However, as botnet technology continues to evolve, its propagation methods and infection techniques have become increasingly complex and covert, rendering traditional protection methods inadequate in dealing with new botnet threats. Moreover, traditional network security protection methods often struggle to detect and address all infected machines in a timely manner in large-scale internal network environments, especially given the complex and diverse propagation mechanisms of botnets. Relying solely on traditional malware detection methods is insufficient to comprehensively eliminate potential threats.

[0004] Therefore, the existing botnet protection mechanisms in intranet environments have the following key problems: untimely response to botnet propagation paths, inaccurate detection of infected machines, and insufficient flexibility in removal and defense measures. Therefore, there is an urgent need for a method that can quickly locate, remove, and harden infected machines to ensure the security of the intranet environment. Summary of the Invention

[0005] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows: According to one aspect of this application, a method for investigating and handling machines infected with botnets within an intranet environment is provided, comprising: Isolate the target devices infected by the botnet from the internal network; Perform malware analysis on the target device to extract the botnet's propagation module from the target device; The executable code corresponding to the propagation module is embedded into a pre-defined removal tool to obtain a disposal tool; the removal tool is a network security tool developed based on botnet behavior; the removal tool is used to simulate the propagation behavior of botnets; A comprehensive scan of the intranet environment was conducted using the disposal tools to identify the propagation devices that were infected by the botnet from among several communication devices connected to the intranet; the propagation devices were the communication devices that had been infected by the botnet through the target devices. Use disposal tools to eliminate botnets from target devices and propagation devices; Vulnerability analysis is performed on the propagation module to strengthen the protection of both the target device and the propagation device.

[0006] In one exemplary embodiment of this application, the target device is determined according to the following steps: By using pre-set network traffic monitoring tools, the network traffic of the intranet is analyzed to identify communication devices that match the characteristics of botnet activities as target devices. Among the characteristics of botnet activity are communication traffic exceeding a preset traffic threshold, the number of Domain Name System (DNS) queries exceeding a preset number, and abnormal outbound connection behavior.

[0007] In one exemplary embodiment of this application, isolating the target device from the intranet includes: Disable the target device's network interface; Block all connections between the target device's IP address and the external network; Suspend the target device's access to the network.

[0008] In one exemplary embodiment of this application, malware analysis is performed on a target device to extract the propagation module of a botnet from the target device, including: Using a pre-set static analysis tool, suspicious files stored on the target device's hard drive are decompiled and reverse engineered to identify executable code containing botnet propagation logic within the suspicious files; the suspicious files are those that meet the pre-set botnet propagation conditions. By using a sandbox environment to dynamically monitor the behavior of suspicious files, the communication activities between the target device and the external network can be obtained. Based on the executable code containing botnet propagation logic in the suspicious files and the communication activities between the target device and the external network, the botnet propagation module is extracted from the target device.

[0009] In one exemplary embodiment of this application, the removal of a botnet from a target device and a propagation device using a disposal tool includes: Shut down malicious processes related to botnets on the target device and the distribution device; Remove the botnet propagation module and related files from the target device and the propagation device. The critical system configurations of the target equipment and propagation equipment were repaired using the appropriate tools. A comprehensive security scan of the target equipment and transmission equipment system was conducted.

[0010] In one exemplary embodiment of this application, after the step of clearing the botnet from the target device and the propagation device using a disposal tool, the method further includes: The executable code of the propagation module is analyzed using a pre-set static analysis tool to identify system vulnerabilities or configuration errors exploited by the propagation module. By using a pre-set dynamic debugging tool, the behavior of the propagation module during runtime is tracked to obtain the propagation path of the propagation module infecting botnets by exploiting system vulnerabilities or configuration errors.

[0011] In one exemplary embodiment of this application, vulnerability analysis is performed on the propagation module to strengthen the protection of the target device and the propagation device, including: Fix system vulnerabilities or configuration errors exploited by the propagation module.

[0012] According to another aspect of this application, a device for detecting and handling infected botnet machines in an intranet environment is provided, comprising: The target device isolation module is used to isolate target devices infected with botnets from the internal network; The propagation module extraction module is used to perform malware analysis on the target device in order to extract the propagation module of the botnet from the target device; The disposal tool determination module is used to embed the executable code corresponding to the propagation module into a preset removal tool to obtain the disposal tool; the removal tool is a network security tool developed based on botnet behavior; the removal tool is used to simulate the propagation behavior of botnets. The propagation device identification module is used to perform a comprehensive scan of the intranet environment using disposal tools to identify propagation devices infected by botnets from among several communication devices connected to the intranet; propagation devices are communication devices that have been infected by botnets through target devices; The botnet removal module is used to remove botnets from target devices and propagation devices using disposal tools. The device hardening and protection module is used to perform vulnerability analysis on the propagation module in order to harden and protect the target device and the propagation device.

[0013] According to another aspect of this application, a non-transitory computer-readable storage medium is provided, wherein the storage medium stores at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the aforementioned method for investigating and handling infected botnet machines in an intranet environment.

[0014] According to another aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0015] The present invention has at least the following beneficial effects: This invention provides a method for investigating and handling botnet-infected machines within an intranet environment. First, it performs anomaly analysis on the intranet's network traffic and behavior to identify infected target devices from among several communication devices connected to the intranet. Then, it isolates the target devices from the intranet and performs malware analysis to extract the botnet's propagation module. The executable code corresponding to the propagation module is embedded into a pre-defined removal tool to obtain a handling tool. This handling tool then performs a comprehensive scan of the intranet environment to identify botnet-infected propagation devices from among the communication devices connected to the intranet. Finally, the handling tool removes the botnet from both the target devices and the propagation devices, and performs vulnerability analysis on the propagation module to strengthen the protection of both. Through in-depth analysis of the botnet's propagation module, the protection capabilities of infected machines within the intranet are further enhanced, ensuring they no longer become targets of botnet attacks. This effectively solves the problems of rapid location, removal, and security hardening of botnet-infected machines within an intranet environment. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating a method for investigating and handling infected botnet machines within an intranet environment, as provided in an embodiment of the present invention. Figure 2 This is a block diagram of a device for investigating and dealing with infected botnet machines in an intranet environment, provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] This application proposes a method for investigating and handling machines infected with botnets within an intranet environment, such as... Figure 1 As shown, it includes: Step S100: When a target device infected with a botnet is detected, the target device is isolated from the internal network; The target device is a communication device infected by a botnet among several communication devices connected to the intranet. The target device is determined by performing anomaly analysis on the corresponding network traffic and network behavior within the intranet; specifically, the target device is determined according to step S101: Step S101: Analyze the network traffic of the intranet using a preset network traffic monitoring tool to identify communication devices that match the characteristics of botnet activities as target devices. Among the characteristics of botnet activity are communication traffic exceeding a preset traffic threshold, the number of Domain Name System (DNS) queries exceeding a preset number, and abnormal outbound connection behavior.

[0020] Identifying infected devices within an intranet environment is the first step in botnet protection. This process typically involves a combination of techniques. First, network traffic monitoring tools (such as NetFlow and sFlow) are used to comprehensively analyze intranet traffic, paying particular attention to abnormally high traffic, frequent DNS queries, and unusual outbound connections, as these are typical characteristics of botnet activity. Second, intrusion detection systems (IDS) and intrusion prevention systems (IPS) are used to identify suspicious network behaviors, such as abnormal port scans and unauthorized remote connection attempts. System log analysis tools (such as Splunk and ELK Stack) are used to uncover abnormal patterns in internal system logs, such as repeated privilege escalation attempts and recurring abnormal system calls. These could be the result of commands sent by the botnet's control end. Communication devices exhibiting these botnet activity characteristics are identified as potential botnet targets.

[0021] Furthermore, in step S100, the method for isolating the target device from the intranet includes steps S110-S130: Step S110: Disable the network interface of the target device; Step S120: Block all connections between the target device's IP address and the external network; Step S130: Suspend the target device's activity permissions in the network.

[0022] When a target device is suspected of being infected, it should be immediately isolated from the internal network. Specific measures include disabling its network interface, blocking all connections between its IP address and the external network, and suspending its activity permissions on the network.

[0023] Once isolated, the target device needs to be continuously monitored for all its activities, including file access, process creation, registry modifications, etc., in order to collect comprehensive evidence of infection and provide basic data for subsequent analysis and processing.

[0024] Step S200: Perform malware analysis on the target device to extract the botnet propagation module from the target device; Furthermore, in step S200, the method of performing malware analysis on the target device to extract the botnet propagation module from the target device includes steps S210-S230: Step S210: Using a preset static analysis tool, decompile and reverse engineer suspicious files stored on the hard drive of the target device to identify executable code containing botnet propagation logic in the suspicious files; Suspicious files are those that meet the preset conditions for botnet propagation; Step S220: Dynamically monitor the behavior of suspicious files in a sandbox environment to obtain the communication activities between the target device and the external network; Step S230: Extract the botnet propagation module from the target device based on the executable code containing botnet propagation logic in the suspicious file and the communication activities between the target device and the external network.

[0025] After the target device is isolated, the next step is to perform in-depth malware analysis to extract the botnet's propagation module. For file system analysis, static analysis tools (such as IDA Pro and Ghidra) are used to decompile and reverse engineer suspicious files stored on the hard drive to identify code segments containing propagation logic. This is combined with dynamic analysis techniques, using a sandbox environment (such as Cuckoo Sandbox) to monitor the dynamic behavior of suspicious files, recording their communication attempts with external networks, file creation, system calls, and other activities to further confirm the existence of the propagation module.

[0026] Furthermore, if a botnet employs a non-local attack method, such as injecting its code into other normally running processes using process injection techniques, then memory forensics tools (such as Volatility and Rekall) can be used to perform a comprehensive dump and analysis of the memory of the infected machine (i.e., the target device) to extract the loaded malicious code segments and runtime data. Then, static and dynamic analysis can be performed on them. By analyzing the extracted propagation modules, the system vulnerabilities it exploits and the propagation path can be discovered. This information is crucial for subsequent vulnerability patching and system hardening.

[0027] Step S300: Embed the executable code corresponding to the propagation module into a preset removal tool to obtain a processing tool; A dedicated removal tool is a cybersecurity tool developed based on botnet behavior. It is used to simulate the propagation behavior of botnets.

[0028] After successfully extracting the propagation module, the next step is to integrate it with a dedicated removal tool to generate a customized disposal tool. This step requires a deep understanding of the propagation module's working mechanism to ensure that the disposal tool can accurately identify and handle the infection source. In integrating the propagation module with the removal tool, the tool is first developed based on botnet behavior. Its functions include, but are not limited to: scanning all devices within the intranet environment, identifying infected machines using the same propagation module, terminating botnet processes, deleting botnet startup items, and deleting files stored locally by the botnet. Then, the propagation module's code is embedded into the removal tool, enabling it to simulate botnet propagation behavior and automatically detect other infected machines in the network. During development, it is crucial to ensure the disposal tool's code execution efficiency and resource consumption are minimized to avoid impacting the normal operation of other network services due to excessive resource consumption in a large-scale intranet environment. Simultaneously, rigorous compatibility testing is required to ensure the disposal tool functions correctly in different operating systems and network environments, preventing disposal task failures due to environmental differences.

[0029] By extracting and analyzing the propagation modules of machines infected with botnets, and combining this with specialized removal tools, infected botnet nodes can be quickly located and eliminated in large-scale intranet environments, thereby achieving comprehensive protection of the intranet environment and significantly improving security protection efficiency.

[0030] Step S400: Perform a comprehensive scan of the intranet environment using the disposal tool to identify the propagation devices that are infected by the botnet from among several communication devices connected to the intranet. The propagation device is a communication device that has infected the botnet through the target device, that is, a communication device that uses the same propagation module as the target device.

[0031] A comprehensive scan of the internal network environment and batch location of infected machines are performed using a disposal tool that incorporates a propagation module. During this process, the disposal tool actively utilizes the propagation module's functionality to simulate the propagation path of a botnet, attempting to infect other potentially infected machines. In this way, the disposal tool can quickly locate all infected nodes within the internal network. This process typically requires the cooperation of the network administrator to adjust the scanning tool's propagation strategy and scan scope to ensure coverage of the entire internal network in the shortest possible time. The disposal tool's location function should not only accurately identify infected machines but also record detailed information for each infected machine, including IP address, hostname, operating system version, open ports, and infection time. This data is crucial for subsequent cleanup and hardening measures. During the scanning process, interference with normal business operations should be minimized. If necessary, scanning priorities can be set, such as processing critical business nodes first and then general nodes.

[0032] When applied in a large-scale intranet environment, this invention avoids performance bottlenecks that may result from a full network scan by accurately locating the source of infection, while also preventing excessive network traffic consumption, thus ensuring the stability and efficiency of the system.

[0033] Step S500: Use disposal tools to remove the botnet from the target device and the propagation device; Furthermore, in step S500, the method for eliminating the botnet by using a disposal tool includes steps S510-S540: Step S510: Shut down malicious processes related to the botnet on the target device and the propagation device; Step S520: Delete the botnet propagation module and the related files corresponding to the propagation module from the target device and the propagation device; Step S530: Repair the critical system configurations of the target device and the propagation device using the disposal tool; Step S540: Perform a comprehensive security scan of the target device and the transmission device system.

[0034] Once the infected machine (i.e., the propagation device) is located, the disposal tool will automatically initiate a cleanup process. The cleanup process first shuts down all malicious processes related to the botnet and deletes the propagation module and its related files. Afterward, the tool repairs critical system configurations, including resetting tampered registry entries, deleting maliciously added startup items, and restoring modified system files. Following the cleanup, a comprehensive security scan is performed, including checks on the integrity of all files and detection of botnet remnants, to ensure no residual threats remain on the system.

[0035] By automatically extracting botnet propagation modules and combining them with specialized removal tools for targeted elimination, the workload of security administrators can be effectively reduced and the overall level of automation in protection can be improved without affecting normal system operation.

[0036] Step S550: Analyze the executable code of the propagation module using a preset static analysis tool to identify system vulnerabilities or configuration errors exploited by the propagation module. Step S560: Using a preset dynamic debugging tool, track the behavior of the propagation module during runtime to obtain the propagation path of the propagation module using system vulnerabilities or configuration errors to infect botnets.

[0037] After successfully eliminating the botnet, a detailed vulnerability analysis is performed on the extracted propagation module (steps S550-S560). This process first uses static analysis techniques to conduct an in-depth study of the propagation module's code, identifying the system vulnerabilities or configuration errors it exploits. Then, dynamic debugging tools are used to trace the propagation module's behavior during runtime, analyzing how it exploits system vulnerabilities to propagate. For example, debugging tools can be used to trace the execution path of malicious code step by step, observing how it uses specific system call or function vulnerabilities to achieve privilege escalation or remote code execution.

[0038] Furthermore, during vulnerability analysis, the specific attack methods and exploitation conditions of the propagation module should be recorded, such as whether administrator privileges are required or whether specific system configurations are dependent. This information is crucial for developing remediation plans and defense strategies. Ultimately, the vulnerability analysis results will generate a detailed report, providing remediation recommendations or patch solutions for system administrators to use in subsequent work.

[0039] Step S600: Perform vulnerability analysis on the propagation module to strengthen the protection of the target device and the propagation device.

[0040] Furthermore, in step S600, a method for performing vulnerability analysis on the propagation module to strengthen the protection of the target device and the propagation device includes step S610: Step S610: Fix the system vulnerabilities or configuration errors exploited by the propagation module.

[0041] Based on the vulnerability analysis results, system hardening and protection are implemented for infected machines. Hardening measures first include patching system vulnerabilities exploited by botnets, applying patches or configuration fixes provided in the analysis report, and conducting a detailed effectiveness evaluation after completing the internal network cleanup and protection upgrades to confirm the effectiveness of the cleanup tool and the utilization of the propagation module. This step requires a comprehensive analysis of logs and monitoring data during the cleanup process to evaluate the tool's performance in locating and removing infected machines and identify potential defects or deficiencies. If the tool is found to perform poorly in certain scenarios or has compatibility issues, the tool's code and cleanup strategy should be further optimized based on the evaluation results. For example, the propagation module simulation and cleanup mechanism of the tool can be optimized for different types of botnet infections to make it more flexible and efficient in future applications. The optimized tool should also undergo rigorous testing to ensure stable operation in network environments of different sizes and to have good scalability and adaptability.

[0042] By hardening infected machines, security vulnerabilities can be further patched after botnet removal, enhancing system defense capabilities and effectively reducing the risk of botnet reinfection, preventing similar attacks from recurring, and thus significantly improving the long-term security of the network and the overall security of the intranet environment.

[0043] Finally, the entire process was documented in detail, including the identification of the infection source, the extraction and analysis of the propagation modules, the cleanup process, and the effectiveness evaluation. Complete documentation helps to summarize lessons learned and provides a reference for future security incident responses.

[0044] This invention relates to botnet detection and disposal technology in intranet environments, aiming to solve the problem of quickly locating and removing machines infected with botnets in large-scale intranet environments. Traditional malware detection methods are often unable to effectively identify and respond to botnet propagation mechanisms, resulting in the inability to promptly deal with infected machines within the intranet environment, thereby increasing the risk of attacks. Based on in-depth analysis and research of the above problems, this invention aims to quickly locate and remove infected machines in the intranet by extracting and analyzing the propagation modules of botnets and combining them with customized removal tools. Simultaneously, through in-depth analysis of the propagation modules, it further strengthens the protection capabilities of infected machines, ensuring they no longer become targets of botnet attacks. This invention effectively solves the problem of quickly locating, removing, and hardening the security of machines infected with botnets (such as the Mirai botnet, a type of malware specifically targeting Internet of Things (IoT) devices, which uses default usernames and passwords to brute-force attacks, infecting devices and incorporating them into the botnet to launch large-scale distributed denial-of-service attacks) within the intranet environment. It not only targets currently known botnet threats but also possesses a certain degree of scalability and flexibility, adapting to future changes and developments in new botnets, thus safeguarding the security of enterprise intranets.

[0045] This invention employs a targeted approach, extracting the propagation module and combining it with specialized removal tools for location and elimination. This eliminates the need for a comprehensive network scan, significantly reducing network bandwidth and computing resource consumption. This not only improves network performance but also avoids interference with normal business operations, lowering resource utilization. Furthermore, it offers high flexibility and adaptability, automatically adjusting and optimizing protection strategies based on different network environments and threat characteristics. Because the extraction and analysis of the propagation module can be automated, and its integration with specialized removal tools is flexible, this invention can be widely applied in intranet environments of various sizes.

[0046] Furthermore, the present invention is simple to implement, easy to deploy and expand, can be quickly integrated into existing network security protection systems, and can be customized and optimized according to actual needs, adapting to intranet environments of various sizes, thus improving the practicality and scalability of the solution.

[0047] Furthermore, this application also proposes a device 100 for detecting and handling infected botnet machines within an intranet environment, such as... Figure 2 As shown, it includes: The target device isolation module 110 is used to isolate target devices infected with botnets from the internal network; The method for determining the target device includes: analyzing the network traffic of the intranet using a preset network traffic monitoring tool to identify communication devices that meet the characteristics of botnet activity as target devices; the characteristics of botnet activity include communication traffic exceeding a preset traffic threshold, the number of domain name system queries exceeding a preset number, and abnormal outbound connection behavior.

[0048] The method by which the target device isolation module 110 isolates the target device from the intranet includes: disabling the network interface of the target device; blocking all connections between the IP address of the target device and the external network; and suspending the target device's activity permissions in the network.

[0049] The propagation module extraction module 120 is used to perform malware analysis on the target device in order to extract the propagation module of the botnet from the target device. The propagation module extraction module 120 performs malware analysis on the target device to extract the botnet propagation module from the target device. This method includes: using a preset static analysis tool to decompile and reverse engineer suspicious files stored on the target device's hard drive to identify executable code containing botnet propagation logic within the suspicious files; ensuring the suspicious files meet preset botnet propagation conditions; monitoring the suspicious files' dynamic behavior in a sandbox environment to obtain communication activities between the target device and external networks; and extracting the botnet propagation module from the target device based on the executable code containing botnet propagation logic in the suspicious files and the communication activities between the target device and external networks.

[0050] The disposal tool determination module 130 is used to embed the executable code corresponding to the propagation module into a preset removal tool to obtain the disposal tool; A dedicated removal tool is a network security tool developed based on botnet behavior; it is used to simulate the propagation behavior of botnets.

[0051] The propagation device identification module 140 is used to perform a comprehensive scan of the intranet environment using disposal tools to identify propagation devices that are infected by botnets from among several communication devices connected to the intranet. The transmission device is a communication device that has infected the botnet through the target device; The botnet removal module 150 is used to remove botnets from target devices and propagation devices using disposal tools. The botnet removal module 150 uses a disposal tool to remove botnets from target devices and propagation devices, including: shutting down malicious processes related to botnets on target devices and propagation devices; deleting the botnet propagation module and related files on target devices and propagation devices; repairing critical system configurations on target devices and propagation devices using the disposal tool; and performing a comprehensive security scan on the systems of target devices and propagation devices.

[0052] The device hardening and protection module 160 is used to perform vulnerability analysis on the propagation module in order to harden and protect the target device and the propagation device.

[0053] Among them, the device hardening and protection module 160 performs vulnerability analysis on the propagation module to harden and protect the target device and the propagation device, including: repairing system vulnerabilities or configuration errors exploited by the propagation module.

[0054] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0055] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0056] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0057] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0058] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0059] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0060] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0061] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0062] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0063] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0064] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0065] Electronic devices can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable users to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed through input / output (I / O) interfaces. Furthermore, electronic devices can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapters.

[0066] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0067] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0068] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0069] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0070] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0071] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0072] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0073] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for investigating and handling machines infected with botnets within an intranet environment, characterized in that, When a target device infected with a botnet is detected, then: Isolate the target device from the intranet; Malware analysis is performed on the target device to extract the botnet propagation module from the target device; The executable code corresponding to the propagation module is embedded into a preset removal tool to obtain a removal tool; the removal tool is a network security tool developed based on botnet behavior; the removal tool is used to simulate the propagation behavior of botnets. The aforementioned processing tool performs a comprehensive scan of the intranet environment to identify, from among several communication devices connected to the intranet, the propagation devices that have been infected by the botnet; the propagation devices are communication devices that have been infected by the botnet through the target device. The aforementioned disposal tool is used to eliminate the botnet from the target device and the propagation device. Vulnerability analysis is performed on the propagation module to strengthen the protection of the target device and the propagation device.

2. The method according to claim 1, characterized in that, The target device is determined according to the following steps: By using pre-set network traffic monitoring tools, the network traffic of the intranet is analyzed to identify communication devices that match the characteristics of botnet activities as target devices. Among the characteristics of botnet activity are communication traffic exceeding a preset traffic threshold, the number of Domain Name System (DNS) queries exceeding a preset number, and abnormal outbound connection behavior.

3. The method according to claim 1, characterized in that, The step of isolating the target device from the intranet includes: Disable the network interface of the target device; Block all connections between the target device's IP address and the external network; Suspend the target device's activity permissions in the network.

4. The method according to claim 1, characterized in that, The step of performing malware analysis on the target device to extract the botnet propagation module from the target device includes: Using a pre-set static analysis tool, suspicious files stored on the hard drive of the target device are decompiled and reverse engineered to identify executable code containing botnet propagation logic within the suspicious files; the suspicious files are those that meet the pre-set botnet propagation conditions. The suspicious files are dynamically monitored in a sandbox environment to obtain information about the communication activities between the target device and the external network. Based on the executable code containing botnet propagation logic in the suspicious file and the communication activities between the target device and the external network, the botnet propagation module is extracted from the target device.

5. The method according to claim 1, characterized in that, The step of using the disposal tool to remove the botnet from the target device and the propagation device includes: Shut down malicious processes related to the botnet in the target device and the propagation device; Delete the botnet propagation module and the related files corresponding to the propagation module from the target device and the propagation device; The critical system configurations of the target device and the propagation device are repaired using the aforementioned treatment tool; A comprehensive security scan is performed on the target device and the propagation device system.

6. The method according to claim 1, characterized in that, After the botnet is cleared from the target device and the propagation device using the disposal tool, the method further includes: The executable code of the propagation module is analyzed using a pre-set static analysis tool to identify system vulnerabilities or configuration errors exploited by the propagation module. By using a pre-set dynamic debugging tool, the behavior of the propagation module during runtime is tracked to obtain the propagation path of the propagation module infecting botnets by exploiting system vulnerabilities or configuration errors.

7. The method according to claim 6, characterized in that, The step of performing vulnerability analysis on the propagation module to strengthen the protection of the target device and the propagation device includes: The system vulnerabilities or configuration errors exploited by the propagation module are fixed.

8. A device for detecting and handling infected botnet machines within an intranet environment, characterized in that, include: The target device isolation module is used to isolate target devices infected with botnets from the internal network; The propagation module extraction module is used to perform malware analysis on the target device in order to extract the propagation module of the botnet from the target device; The disposal tool determination module is used to embed the executable code corresponding to the propagation module into a preset removal tool to obtain the disposal tool; the removal tool is a network security tool developed based on botnet behavior; the removal tool is used to simulate the propagation behavior of botnets. The propagation device identification module is used to perform a comprehensive scan of the intranet environment using the processing tool to identify propagation devices infected by the botnet from a number of communication devices connected to the intranet; the propagation device is a communication device that has been infected by the botnet through the target device. The botnet removal module is used to remove the botnet from the target device and the propagation device using the disposal tool. The device hardening and protection module is used to perform vulnerability analysis on the propagation module in order to harden and protect the target device and the propagation device.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method as described in any one of claims 1-7.

10. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 9.

Images