Compromised Host Traceability Across NAT Using Probe Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network environments with NAT devices, security devices struggle to accurately identify compromised hosts due to address translation, making it difficult to trace and eliminate security threats effectively.
Innovation Solution
A method and apparatus that intercepts sample files, determines them as malicious, and sends traceability probe files to compromised hosts to collect and report host information, enabling accurate identification without relying on pre-configured NAT mapping relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NAT address translation is used to enable intranet hosts to communicate with external networks, then network connectivity is improved, but the ability to trace and identify compromised hosts deteriorates
Solution Approach 1:
The patent introduces a traceability probe file as an intermediary carrier that bridges the gap between NAT translation and host identification. The probe file contains encoded trace information that acts as a mediator to link external network observations with internal host identities, overcoming the information loss caused by NAT address translation.
Solution Approach 2:
The patent creates a copy of trace information embedded within the probe file that mirrors the relationship between external IP addresses and internal hosts. This copied trace data allows the security device to reconstruct host identification information that would otherwise be lost due to NAT translation.
2Reliability
If security devices intercept and analyze network traffic to identify malicious files, then threat detection capability is improved, but the ability to locate the specific compromised host deteriorates due to NAT translation
Solution Approach 1:
The patent performs preliminary action by embedding traceability information into the probe file before it reaches the compromised host. This advance preparation ensures that when the host executes the probe file, the trace information is already in place to enable immediate host identification without requiring complex real-time analysis of NAT translation states.
Solution Approach 2:
The patent establishes a feedback mechanism where the compromised host, after executing the probe file, reports back its identity information to the security device. This feedback loop closes the information gap created by NAT translation, allowing the security device to reliably identify the compromised host based on the reported information.
3Object-affected harmful factors
If conventional security mechanisms block malicious file downloads, then prevention of malware execution is improved, but the ability to respond rapidly to compromised hosts deteriorates due to inability to trace hosts through NAT devices
Solution Approach 1:
The traceability probe file serves as an intermediary that enables rapid response by bridging the gap between malware blocking and host identification. Once a malicious file is blocked, the probe file allows the security device to quickly identify and locate the compromised host through the encoded trace information, eliminating the time loss associated with traditional tracing methods.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This application discloses a method and an apparatus for determining a compromised host, and relates to the field of computer technologies. According to the method, a compromised host in a private network (or an intranet) can be accurately determined in a scenario in which the host in the private network (or the intranet) sends a packet via a NAT device. The method is applied to a security device deployed at a border between an external network and an internal network. The method includes: intercepting a file sent by the external network to the internal network, where the file is provided by a server of the external network based on a request of a target host of the internal network; determining a traceability probe file in response to the intercepted file being a malicious file; and sending the traceability probe file to the target host. The traceability probe file is for controlling the host running the traceability probe file to collect host information of the host and report the host information.