1. A method for detecting a zombie host by an operator network located externally to a user side network, comprising: obtaining a network address translation (NAT) table; detecting, by a detection apparatus on the operator network, a behavior plane and a communication plane of a host on a user-side network according to the NAT table; and analyzing a result of detecting the behavior plane and the communication plane of the host according to the NAT table to judge whether the host is the zombie host, wherein the analyzing the result further comprises: comparing features of zombie IP streams detected on the behavior plane with features of IP streams detected on the communication plane, and determining that the zombie IP streams exist on the communication plane when the compared features of the zombie IP streams and the compared features of the IP streams are the same.