Method and apparatus for determining compromised host

An apparatus, comprising:

• a non-transitory memory storage comprising instructions;
• and
• one or more processors in communication with the memory storage, wherein the one or more processors execute the instructions to:
• intercept a first packet sent by an external network to an internal network, wherein the first packet comprises a sample file, wherein the apparatus is disposed in a security device deployed at a border between the external network and the internal network, wherein the sample file is provided by a server of the external network based on a request of a target host of the internal network;
• determine a traceability probe file in response to the sample file being a malicious file, wherein the traceability probe file controls a host running the traceability probe file to collect host information of the host and report the host information;
• and
• send the traceability probe file to the target host, wherein sending the traceability probe file to the target host comprises sending, to the target host, a second packet obtained by replacing the sample file transmitted in the first packet with the traceability probe file corresponding to the sample file.

A system, comprising:

• a security device deployed at a border between an external network and an internal network, the security device comprising:
• a non-transitory first memory storage comprising first instructions;
• and
• one or more first processors in communication with the first memory storage, wherein the one or more first processors execute the first instructions to:
• intercept a first packet sent by the external network to the internal network, wherein the first packet comprises a sample file, wherein the sample file is provided by a server of the external network based on a request of a target host of the internal network;
• and
• send a traceability probe file obtaining request to a cloud device in response to the sample file being a malicious file, wherein the traceability probe file obtaining request comprises file information of the sample file, and the file information comprises a file name or a file type of the sample file;
• and
• the cloud device, wherein the cloud device comprises:
• a non-transitory second memory storage comprising second instructions;
• and
• one or more second processors in communication with the second memory storage, wherein the one or more second processors execute the second instructions to:
• receive the traceability probe file obtaining request;
• determine a traceability probe file based on the file information carried in the traceability probe file obtaining request and a traceability probe file library;
• and
• return the traceability probe file to the security device, wherein the traceability probe file controls a host running the traceability probe file to collect host information of the host and report the host information, and the traceability probe file library comprises a plurality of traceability probe template files of different types, wherein the first instructions comprise further instructions to receive the traceability probe file returned by the cloud device, and send the traceability probe file to the target host, and wherein sending the traceability probe file to the target host comprises sending, to the target host, a second packet obtained by replacing the sample file transmitted in the first packet with the traceability probe file corresponding to the sample file.