1. A method for detecting a zombie host, comprising: obtaining a network address translation (NAT) table; detecting a behavior plane and a communication plane of a host according to the NAT table; and analyzing a result of detecting the behavior plane and the communication plane of the host according to the NAT table to judge whether the host is a zombie host.