NAT Host Traceability Using Malicious File Probe Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network environments with NAT devices, security devices struggle to accurately identify and trace back to compromised hosts due to address translation, making it difficult to prevent malicious software downloads and eliminate security threats.
Innovation Solution
A method and apparatus that deploys a traceability probe file through a security device to compromised hosts via a NAT device, enabling them to collect and report host information without pre-configured NAT mapping relationships, using a traceability probe file library and cloud device assistance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If NAT address translation is used to protect private network hosts, then network security and privacy are improved, but the ability to trace and identify compromised hosts is worsened
Solution Approach 1:
The patent introduces a traceability probe file as an intermediary element that carries identification information through the NAT translation process. This probe file acts as a mediator between the security device needing to identify hosts and the NAT device obscuring host identities, allowing traceability information to be preserved despite address translation.
Solution Approach 2:
The patent creates a copy of the traceability probe file and embeds it within the data transmission process. This copied probe file travels alongside the normal data traffic through the NAT device, preserving the ability to trace the original host without interfering with the NAT protection function.
2Measurement precision
If security devices intercept and analyze network traffic to identify threats, then threat detection capability is improved, but network device complexity and processing overhead are worsened
Solution Approach 1:
The patent performs preliminary actions by embedding the traceability probe file into the data stream before it reaches the security device. This pre-prepared traceability information is already integrated into the traffic flow, so the security device can extract identification information without performing complex real-time analysis or interception of additional signaling channels.
3Loss of time
If real-time threat response is implemented to eliminate compromised hosts quickly, then security response time is improved, but the complexity of tracking through NAT is worsened
Solution Approach 1:
The patent implements a feedback mechanism where the traceability probe file returns identification information to the security device after traversing through the NAT-protected network. This feedback loop provides real-time host identification without requiring complex forward-looking prediction or pre-established translation tables, enabling quick threat response.
Data Source
AI summary
This application discloses a method and an apparatus for determining a compromised host, and relates to the field of computer technologies. According to the method, a compromised host in a private network (or an intranet) can be accurately determined in a scenario in which the host in the private network (or the intranet) sends a packet via a NAT device. The method is applied to a security device deployed at a border between an external network and an internal network. The method includes: intercepting a file sent by the external network to the internal network, where the file is provided by a server of the external network based on a request of a target host of the internal network; determining a traceability probe file in response to the intercepted file being a malicious file; and sending the traceability probe file to the target host.