A method, device and storage medium for detecting illegal external connection of a terminal

Abstract

The present invention relates to the field of network security technology, specifically to a detection method, device and storage medium for illegal external connection of a terminal, which obtains all terminal devices connected to a local area network, distinguishes authorized terminal devices from unauthorized terminal devices through authorization detection, and performs risk classification on authorized terminal devices; generates an external connection behavior data set by combining client monitoring data, network layer monitoring data and intranet detection data, extracts key information such as external connection target, access time, protocol type and port number, and divides them into pure intranet connection devices, normal external connection devices and unknown external connection devices according to external connection permissions; inputs log data of unknown external connection devices into a log anomaly detection model based on the Transformer architecture, identifies abnormal events, and calculates log risk scores; if the log risk score exceeds a preset threshold, it is determined to be an illegal external connection device. This method realizes the accurate detection of illegal external connection behaviors and significantly improves the security performance of the monitoring system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a detection method, device and storage medium for illegal external connection of a terminal. Background Art

[0002] In many high-security fields, information interaction is strictly monitored and controlled. In order to prevent confidential information leakage, ensure information security, network stability and business continuity, terminal devices in these fields are usually only allowed to access the local area network and are not allowed to communicate with the outside world, or are only allowed to connect to the outside world within a strictly controllable range. Therefore, it is necessary to introduce an effective terminal illegal external connection detection method to ensure that illegal external connection behaviors can be discovered and effectively prevented in a timely manner, further improving the security and stability of the network.

[0003] Existing external connection monitoring methods mainly include three main modes: client monitoring mode, intranet packet detection mode and gateway monitoring mode. Specifically, the client monitoring mode relies on installing a monitoring client on the terminal device to monitor the user's network behavior. However, this mode is highly dependent on the client. Once the client is uninstalled, disabled or bypassed, the monitoring effect will be greatly reduced. Secondly, the intranet packet detection mode detects illegal external connections by detecting the communication behavior between the terminal and the external network. This method can make up for the shortcomings of client monitoring to a certain extent, but its dependence on detection packets makes it easy to be intercepted by firewall rules or other security policies, resulting in missed reports. At the same time, the detection capability is still limited for intermittent external connection behaviors or external connections using encrypted channels. Finally, the gateway monitoring mode mainly identifies external connection behaviors through traffic analysis and deep packet inspection technology. Although it can centrally monitor the overall traffic at the network exit, it is easily limited by performance bottlenecks in a high-concurrency traffic environment, which may lead to incomplete monitoring. In addition, the ability of this mode is also insufficient for deep analysis of complex protocols.

[0004] Existing methods usually use a certain mode alone, lack comprehensive data analysis and correlation capabilities, resulting in scattered alarm information and difficulty in quickly judging the legality and risk level of external connection behavior. Therefore, there is an urgent need for a monitoring method for illegal external connection behavior of terminals to achieve comprehensive coverage and accurate identification of external connection behavior of intranet terminals, thereby significantly improving the security performance of the monitoring system.

[0005] To this end, a method, device and storage medium for detecting illegal external connection of a terminal are proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a detection method, device and storage medium for illegal external connection of a terminal. First, all terminal devices connected to a specified local area network are obtained, and by clarifying all devices in the current intranet, a monitoring range and a baseline are established to provide necessary data support for subsequent authorization detection and external connection behavior analysis. By combining authorization detection, terminal risk classification and uninstall detection, tampering detection and operation detection of client monitoring programs, the trusted state of the controlled authorized terminal device is ensured, and at the same time, client monitoring data, network layer monitoring data and intranet detection data are obtained to form a multi-dimensional external connection behavior data set, thereby realizing a comprehensive portrait of the terminal external connection behavior. By extracting key information such as external connection targets, access time, protocol type and port number in log data, and comparing it with external connection permission rules, normal external connection devices and unknown external connection devices are quickly divided, which improves the efficiency and accuracy of preliminary judgment. Further, a log anomaly detection model based on the Transformer architecture is used to identify abnormal events in unknown external connection devices, accurately evaluate the risk level of terminal external connection behavior by calculating log risk scores, and promptly determine illegal external connection terminal devices. This method combines the dual advantages of rule filtering and model detection, which not only improves the accuracy and real-time performance of illegal external connection detection, but also significantly reduces the risks of false positives and negative positives. It can adapt to diverse external connection behaviors in complex network environments and provide comprehensive protection for intranet security.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] According to a first aspect of the present disclosure, a method for detecting illegal external connection of a terminal is provided, comprising:

[0009] Acquire all terminal devices connected to a designated local area network; perform authorization detection on the terminal devices to obtain authorized terminal devices and unauthorized terminal devices; classify the authorized terminal devices to obtain terminal risk levels;

[0010] Performing uninstall detection, tamper detection and operation detection on the client monitoring program deployed on the authorized terminal device; treating the authorized terminal device that passes the uninstall detection, tamper detection and operation detection as a controlled authorized terminal device;

[0011] Acquire the client monitoring data of the controlled authorized terminal device, combine the network layer monitoring data and the intranet detection data, and summarize them into an external connection behavior data set; extract key information from the log data of the external connection behavior data set, including the first external connection target, the first access time, the first protocol type, and the first port number; divide the controlled authorized terminal device into a pure intranet connection device, a normal external connection device, and an unknown external connection device according to the key information and the external connection permission;

[0012] The log data corresponding to the unknown external device is obtained from the external behavior data set to obtain the log data to be checked; the pre-processed log data to be checked is input into the log anomaly detection model to identify abnormal events, and a log risk score is calculated based on all the abnormal events; if the log risk score exceeds a preset threshold, the corresponding unknown external device is determined to be an illegal external terminal device; the log anomaly detection model is trained based on the annotated historical log data and is a multi-classification model constructed using the Transformer architecture.

[0013] Furthermore, when the unauthorized terminal device is detected, the method further includes: directly isolating the unauthorized terminal device and sending an alarm to a security management center.

[0014] Furthermore, grading the authorized terminal devices includes: determining the terminal risk level according to the data confidentiality level, external connection requirements and historical security event data of the authorized terminal devices.

[0015] Furthermore, performing the uninstall detection, tamper detection and operation detection on the client monitoring program deployed on the authorized terminal device includes: the client monitoring program periodically sends a heartbeat signal to the security management center through a heartbeat packet mechanism and monitors the continuity of the heartbeat signal to obtain an uninstall detection result; calculating a hash value for a key file of the client monitoring program and comparing it with the original hash value stored in the security management center, and verifying the digital signature of the client monitoring program through pre-stored signature verification information to obtain a tamper detection result; and obtaining an operation detection result by monitoring the thread status, process calls and resource usage of the client monitoring program and comparing them with a normal behavior baseline.

[0016] Furthermore, when obtaining the client monitoring data, the network layer monitoring data and the intranet detection data of the controlled authorized terminal device, it also includes: performing data verification on the client monitoring data and the network layer monitoring data, specifically: inputting the client monitoring data and the network layer monitoring data into a trained joint anomaly detection model to obtain a joint anomaly detection result.

[0017] Furthermore, the joint anomaly detection model includes: an input layer, which is used to receive the client monitoring data and the network layer monitoring data, and to generate a multi-dimensional input vector by standardizing the client monitoring data and the network layer monitoring data, unifying the timestamp and data format, including a client standard input vector and a network layer standard input vector; a feature extraction layer, including a client feature extraction module and a network layer feature extraction module, which are used to extract client behavior features and network traffic features respectively; wherein the client feature extraction module is used to extract features from the client standard input vector, including system call logs, external target information and device status information; the time dependency and behavior pattern in the system call log are captured by the LSTM model, and the static attributes are processed in combination with the embedding layer to generate a client comprehensive feature vector; the network layer feature extraction module is used to extract spatial distribution features and dynamic connection patterns from the network layer standard input vector, including the target IP address , traffic characteristics, protocol types and connection frequencies; the spatial distribution characteristics of network protocols are captured by convolutional neural networks, and dynamic changes of traffic are analyzed in combination with multi-layer perceptrons to generate a comprehensive feature vector of the network layer; a feature fusion layer is used to fuse the client comprehensive feature vector with the network layer comprehensive feature vector, and the interaction between client behavior characteristics and network traffic characteristics is captured by a multi-head attention mechanism to generate a unified external behavior feature vector; an abnormal classification layer includes: a fully connected layer, which is used to map the external behavior feature vector to the external behavior category space and generate a classification score for each external behavior category; a Softmax activation function, which is used to convert the classification score into a probability distribution and calculate the classification confidence of each external behavior category; the external behavior category with the highest probability is selected from the classification confidence by a maximum probability value selection mechanism to determine a first external behavior category; an output layer, which is used to output the first external behavior category and the corresponding classification confidence.

[0018] Furthermore, the data verification also includes: determining the consistency index of the client monitoring data and the network layer monitoring data, including the target IP consistency index, the protocol type matching index, the traffic feature matching index and the timestamp consistency index; calculating the comprehensive consistency score according to the target IP consistency index, the protocol type matching index, the traffic feature matching index and the timestamp consistency index, and the calculation formula is: in, For the comprehensive consistency score, is the target IP consistency indicator, is the protocol type matching indicator, is the traffic feature matching index, is the timestamp consistency indicator, is the weight of the target IP consistency indicator, is the weight of the protocol type matching indicator, is the weight of the traffic feature matching index, is the weight of the timestamp consistency indicator;

[0019] The data verification score is calculated based on the joint anomaly detection result and the comprehensive consistency score, and the calculation formula is: in, scoring the data verification; The basic risk value is determined according to the first outreach behavior category; is the classification confidence corresponding to the joint anomaly detection result; is a terminal risk level weighting factor, which is determined according to the terminal risk level.

[0020] Furthermore, dividing the controlled authorized terminal device into the normal external connection device and the unknown external connection device according to the key information and the external connection permission includes: constructing a whitelist according to the external connection permission, the whitelist including the second external connection target, the second access time, the second protocol type and the second port number that are allowed to be externally connected; matching the key information with the whitelist, if the first external connection target, the first access time, the first protocol type and the first port number all meet the matching conditions defined in the whitelist, then identifying the controlled authorized terminal device as the normal external connection device; if any one of the first external connection target, the first access time, the first protocol type and the first port number does not meet the corresponding matching conditions, then identifying the corresponding controlled authorized terminal device as the unknown external connection device.

[0021] According to a second aspect of the present disclosure, a detection device for illegal external connection of a terminal is provided, comprising: a terminal acquisition module, for acquiring all terminal devices connected to a specified local area network; an authorization detection module, for performing authorization detection on the terminal devices, and obtaining authorized terminal devices and unauthorized terminal devices; a risk classification module, for classifying the authorized terminal devices, and obtaining terminal risk levels; a client monitoring module, for performing uninstall detection, tamper detection, and operation detection on the client monitoring program deployed on the authorized terminal device; the authorized terminal device that passes the uninstall detection, the tamper detection, and the operation detection at the same time is regarded as a controlled authorized terminal device; a data acquisition module, for acquiring the client monitoring data of the controlled authorized terminal device, and combining the network layer monitoring data and the intranet detection data to generate an external connection behavior data set; an external connection device classification module, for acquiring the client monitoring data of the controlled authorized terminal device, and combining the network layer monitoring data and the intranet detection data to generate an external connection behavior data set; Intranet detection data is aggregated to generate an external connection behavior data set; key information is extracted from the log data of the external connection behavior data set, including the first external connection target, the first access time, the first protocol type and the first port number; the controlled authorized terminal devices are divided into pure intranet connection devices, normal external connection devices and unknown external connection devices according to the key information and external connection permissions; a log anomaly detection module is used to obtain the log data corresponding to the unknown external connection device from the external connection behavior data set to obtain the log data to be checked; the pre-processed log data to be checked is input into the log anomaly detection model to identify abnormal events, and a log risk score is calculated based on all the abnormal events; an illegal external connection judgment module is used to judge the corresponding unknown external connection device as an illegal external connection terminal device when the log risk score exceeds a preset threshold; the log anomaly detection model is trained based on the annotated historical log data and is a multi-classification model constructed using the Transformer architecture.

[0022] The third aspect of the present disclosure provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the method provided in the first aspect of the present disclosure is implemented.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] The present invention comprehensively ensures the credibility and continuous operation status of the monitoring program by performing uninstall detection, tamper detection and operation detection on the client monitoring program, and provides a solid data foundation for the detection of illegal external connection behavior. Among them, the heartbeat packet mechanism can efficiently monitor whether the client monitoring program has been uninstalled to ensure its existence; the hash value check and digital signature verification detect whether the program has been tampered with from the perspective of static integrity to avoid security risks caused by malicious modification; the dynamic behavior monitoring of thread status, process call and resource occupancy can effectively identify false operation or abnormal stop, and ensure the normal operation of the monitoring program function. By combining static integrity detection with dynamic operation status monitoring, the method effectively prevents the risk of the monitoring program being uninstalled, tampered with or abnormally stopped, thereby ensuring the credibility of the data source, avoiding data distortion or loss, and improving the accuracy of the external connection behavior data set. The mechanism can eliminate terminal devices that have not installed or uninstalled the client monitoring program, focus the detection range on trusted devices, reduce invalid data interference, optimize the data collection process, improve system efficiency and resource utilization, and effectively prevent malicious attacks such as tampering and forged data, significantly enhancing the security and robustness of the system. By ensuring the integrity and reliability of data, the present invention significantly improves the accuracy and efficiency of illegal external connection detection and comprehensively improves the detection performance and security protection capabilities of the system.

[0025] 2. The present invention proposes a data verification mechanism when acquiring client monitoring data and network layer monitoring data, and uses a joint anomaly detection model for in-depth analysis, which significantly improves the accuracy and robustness of terminal outbound behavior detection. The joint anomaly detection model unifies the time and format of multi-source data through standardized processing, and combines the client feature extraction module and the network layer feature extraction module to capture the time dependency and behavior pattern of client behavior features, as well as the spatial distribution characteristics and dynamic connection patterns of network traffic respectively; through the multi-head attention mechanism, the deep interaction of the two types of features is realized in the feature fusion layer, and a unified outbound behavior feature vector is generated, thereby comprehensively characterizing the terminal outbound behavior. The anomaly classification layer uses a multi-classification model to output the first outbound behavior category and its classification confidence, which can accurately identify various outbound modes such as normal behavior, unauthorized outbound, hidden traffic and abnormal outbound. At the same time, the data verification mechanism effectively compensates for the possible defects of a single data source through cross-validation of client monitoring data and network layer monitoring data, and enhances the comprehensiveness and reliability of anomaly detection. This method significantly improves the accuracy of external connection behavior classification, reduces the risk of false alarms and missed alarms, and provides reliable technical support for the rapid determination and subsequent response of illegal external connection behaviors of terminals. It is suitable for multi-dimensional security monitoring scenarios in complex network environments.

[0026] 3. The present invention greatly improves the accuracy and robustness of terminal illegal external connection detection by introducing a data verification mechanism, combining consistency index calculation and comprehensive score evaluation. Through indicators such as target IP consistency, protocol type matching, traffic feature matching and timestamp consistency, the matching degree between client monitoring data and network layer monitoring data is comprehensively measured to avoid misjudgment or missed judgment caused by single-dimensional anomalies. The calculation of the comprehensive consistency score introduces a weight distribution mechanism, which can dynamically adjust the importance of each indicator according to actual needs, so as to adapt to different scenarios and security strategies. In addition, by combining the joint anomaly detection results with the comprehensive consistency score, the data verification score is calculated, and the basic risk value of the behavior category, the classification confidence and the terminal risk level are included in a unified framework, further enhancing the accuracy and interpretability of risk assessment. This mechanism realizes the organic combination of data layer cross-validation and behavior layer risk assessment, effectively reducing the false alarm rate and missed alarm rate while ensuring the accuracy of detection. This method realizes the automation of the entire process from consistency verification to risk assessment, which not only reduces manual intervention, but also significantly improves the system's detection capability for complex external connection behaviors and the response efficiency to potential threats, providing comprehensive and reliable technical support for security protection in a dynamic network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flow chart of a method for detecting illegal external connection of a terminal provided by an embodiment of the present invention;

[0028] Figure 2 A detailed flow chart of a method for detecting illegal external connections of a terminal provided by an embodiment of the present invention;

[0029] Figure 3 A flow chart of the application of terminal risk level and weighting factor provided in an embodiment of the present invention;

[0030] Figure 4 A flow chart of log risk score calculation provided by an embodiment of the present invention;

[0031] Figure 5 A schematic diagram of the structure of a terminal illegal external connection detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] See also Figures 1 to 5The present invention provides a method, device and storage medium for detecting illegal external connection of a terminal, and the technical solution is as follows:

[0034] Embodiment 1

[0035] In the intranet environment of Enterprise A, in order to ensure network security and prevent terminal devices from performing illegal external operations, strict management and hierarchical authority control are implemented for all terminal devices connected to the intranet. Differentiated external connection authority rules are formulated according to the business needs and security requirements of the terminal devices. For example, some terminals are pure intranet communication devices and are not allowed to perform any external operations; other terminals are allowed to connect only to designated external IP addresses within a specific time period and use designated protocol types and port numbers to complete business interactions. This refined authority allocation can effectively meet the needs of different business scenarios while reducing the security risks brought about by external connection behaviors.

[0036] To further strengthen the security management of the intranet, a client monitoring program is deployed on each authorized terminal device. Figure 1 A flow chart of a method for detecting illegal external connection of a terminal provided by an embodiment of the present invention, Figure 2 A detailed flow chart of a method for detecting illegal external connections of a terminal provided by an embodiment of the present invention, in addition to the main steps embodied in the text, Figure 2 It also includes other auxiliary processes not described in detail, such as a judgment process and an alarm process, etc., to fully demonstrate the working mechanism and specific implementation details of the present invention; the method includes the following steps:

[0037] See also Figure 1 S10 in which all terminal devices connected to the specified local area network within a specified time period are obtained;

[0038] In this embodiment, the specified time period is 8:00 to 18:00 during daily working hours, which is used to monitor the network behavior of devices during office hours to avoid unnecessary external connections after get off work, which may lead to potential security risks. The designated LAN is the internal office network of the enterprise (IP address range: 192.168.0.0 / 24), which includes office terminals, internal servers, and some IoT devices, and is used to provide intranet communication services and strictly control external connection permissions.

[0039] See also Figure 1 In S20, authorization detection is performed on the terminal device to obtain authorized terminal devices and unauthorized terminal devices; authorized terminal devices are terminal devices that are allowed to connect to the enterprise intranet, such as office computers; unauthorized terminal devices are terminal devices that do not have permission to connect to the intranet and are not allowed to connect to the enterprise intranet, such as laptops and mobile phones that employees access privately.

[0040] Furthermore, when the unauthorized terminal device is detected, it also includes: directly isolating the unauthorized terminal device and alerting the security management center. By performing authorization detection on the terminal device and identifying the unauthorized terminal device in real time, the method of the present invention can effectively prevent unauthorized devices from accessing the designated local area network, and avoid potential security threats caused by unauthorized terminals. When an unauthorized terminal device is detected, the system can quickly trigger the isolation mechanism to isolate it from the network, prevent it from communicating with other devices, and avoid data leakage or malicious attacks. At the same time, by alerting the security management center, an immediate response to abnormal behavior is achieved, which facilitates the administrator to intervene in time for further investigation and processing. This active isolation and alarm mechanism significantly improves the security and protection capabilities of the system, and ensures efficient management and compliance of the network environment.

[0041] See also Figure 1 S30 in which the authorized terminal device is graded to obtain a terminal risk level;

[0042] Furthermore, grading the authorized terminal devices includes: determining the terminal risk level according to the data confidentiality level, external connection requirements and historical security event data of the authorized terminal devices.

[0043] The terminal risk level is used as a weighting factor in the calculation of subsequent log risk scores, such as Figure 3 shown.

[0044] Table 1 Terminal risk level weighted mapping table

[0045] Terminal risk level describe Weighting Factor 1 Ordinary terminal devices (no sensitive data) 0.5 2 Low-risk terminal devices (small amounts of sensitive data) 0.7 3 Medium-risk terminal devices (important data storage) 0.85 4 High-risk terminal devices (confidential data or key terminals) 1.0 5 Extremely high-risk terminal equipment (core business equipment) 1.2

[0046] Table 1 gives an example of terminal risk levels and their corresponding weighting factors. This table can be expanded or adjusted according to actual application scenarios to more accurately reflect the importance and security requirements of different devices.

[0047] The method of the present invention realizes refined hierarchical management of terminal devices. This hierarchical management can dynamically reflect the security importance and potential threat level of different terminal devices, so that high-risk terminal devices can get more weight in the calculation of log risk scores. Introducing the terminal risk level as a weighting factor into the log risk score calculation can help improve the sensitivity of the detection model to high-risk terminals, optimize resource allocation, and reduce the possibility of false alarms and missed reports. In addition, by comprehensively considering the data confidentiality level, external connection requirements and historical security event data, it not only improves the perception ability of potential threats to the terminal, but also enhances the adaptability to complex scenarios, so that the system can achieve more accurate and efficient detection of illegal external connection behaviors in a dynamic environment, and further ensure the overall security and stability of the network.

[0048] See also Figure 1In S40, the client monitoring program deployed on the authorized terminal device is subjected to uninstall detection, tamper detection and operation detection; the authorized terminal device that passes the uninstall detection, the tamper detection and the operation detection at the same time is used as a controlled authorized terminal device;

[0049] Furthermore, performing the uninstall detection, tamper detection and operation detection on the client monitoring program deployed on the authorized terminal device includes: the client monitoring program periodically sends a heartbeat signal to the security management center through a heartbeat packet mechanism and monitors the continuity of the heartbeat signal to obtain an uninstall detection result; calculating a hash value for a key file of the client monitoring program and comparing it with the original hash value stored in the security management center, and verifying the digital signature of the client monitoring program through pre-stored signature verification information to obtain a tamper detection result; and obtaining an operation detection result by monitoring the thread status, process calls and resource usage of the client monitoring program and comparing them with a normal behavior baseline.

[0050] The present invention comprehensively ensures the integrity and reliability of the monitoring program by performing uninstall detection, tamper detection and operation detection on the client monitoring program, and effectively improves the security and stability of the system. Uninstall detection monitors the continuity of the client monitoring program through the heartbeat packet mechanism, and can promptly discover the situation where the program is maliciously uninstalled, ensuring that the monitoring program is always in a valid state; tamper detection verifies whether the key files have been modified from the perspective of static integrity through hash value comparison and digital signature verification, effectively preventing data distortion or security vulnerabilities caused by program tampering; operation detection monitors thread status, process calls and resource occupancy, and compares them with normal behavior baselines, and detects false operation or abnormal stop of the monitoring program in real time to ensure that its functions are normal. The introduction of this multi-level detection mechanism can ensure the credibility of the monitoring data source from multiple dimensions, provide high-quality data support for subsequent illegal external connection detection, significantly reduce the false alarm and missed alarm rates in the detection process, and at the same time enhance the system's ability to prevent malicious attacks, providing a solid technical guarantee for the security of the network environment.

[0051] See also Figure 1 S50 in which the client monitoring data of the controlled authorized terminal device is obtained, and the network layer monitoring data and the intranet detection data are combined to form an external connection behavior data set;

[0052] Furthermore, when obtaining the client monitoring data, the network layer monitoring data and the intranet detection data of the controlled authorized terminal device, it also includes: performing data verification on the client monitoring data and the network layer monitoring data, specifically: inputting the client monitoring data and the network layer monitoring data into a trained joint anomaly detection model to obtain a joint anomaly detection result (including the first external connection behavior category and the corresponding classification confidence). By introducing a data verification mechanism, the present invention realizes cross-validation of client monitoring data and network layer monitoring data, effectively making up for the limitations of a single data source. Client monitoring data can record behavioral characteristics such as external connection targets and protocol types of terminal devices, while network layer monitoring data provides real network characteristics and dynamic changes of external connection traffic. By inputting these two types of data into a trained joint anomaly detection model, the data verification mechanism can comprehensively analyze the correlation between terminal behavior and network traffic, and accurately discover hidden external connection behaviors and abnormal patterns that are difficult to identify with a single data source, such as disguised traffic, protocol abuse and other complex threats.

[0053] Furthermore, the joint anomaly detection model includes:

[0054] An input layer, used for receiving the client monitoring data and the network layer monitoring data, and generating a multi-dimensional input vector by standardizing the client monitoring data and the network layer monitoring data, unifying timestamps and data formats, including a client standard input vector and a network layer standard input vector;

[0055] The feature extraction layer includes a client feature extraction module and a network layer feature extraction module, which are used to extract client behavior features and network traffic features respectively; wherein the client feature extraction module is used to extract features from the client standard input vector, including system call logs, external target information and device status information; the time dependency and behavior pattern in the system call log are captured by the LSTM model, and the static attributes are processed in combination with the embedding layer to generate a client comprehensive feature vector; the network layer feature extraction module is used to extract spatial distribution features and dynamic connection patterns from the network layer standard input vector, including target IP addresses, traffic features, protocol types and connection frequencies; the spatial distribution features of network protocols are captured by a convolutional neural network, and dynamic changes in traffic are analyzed in combination with a multi-layer perceptron to generate a network layer comprehensive feature vector;

[0056] A feature fusion layer is used to fuse the client comprehensive feature vector with the network layer comprehensive feature vector, capture the interactive relationship between client behavior features and network traffic features through a multi-head attention mechanism, and generate a unified external connection behavior feature vector;

[0057] The abnormal classification layer includes: a fully connected layer, which is used to map the external connection behavior feature vector to the external connection behavior category space to generate a classification score for each external connection behavior category; a Softmax activation function, which is used to convert the classification score into a probability distribution and calculate the classification confidence of each external connection behavior category; and a maximum probability value selection mechanism is used to select the external connection behavior category with the highest probability from the classification confidence to determine the first external connection behavior category;

[0058] The output layer is used to output the first external contact behavior category and the corresponding classification confidence.

[0059] In this embodiment, the categories of external connection behaviors include normal behavior, unauthorized external connection, hidden traffic, and abnormal external connection.

[0060] By adopting a joint anomaly detection model including an input layer, a feature extraction layer, a feature fusion layer, anomaly classification layer and an output layer, the present invention realizes deep feature extraction and accurate classification of outbound behavior, greatly improving the accuracy and comprehensiveness of illegal outbound behavior detection. The input layer ensures the consistency of the time dimension and format of the two types of data by standardizing the client monitoring data and the network layer monitoring data, and provides high-quality input for subsequent feature extraction. The feature extraction layer extracts client behavior features and network traffic features through the client feature extraction module and the network layer feature extraction module respectively, and uses deep learning technologies such as LSTM model and convolutional neural network to fully explore the potential features of the data from the perspective of time series and spatial distribution. The feature fusion layer captures the complex interactive relationship between client behavior features and network traffic features through a multi-head attention mechanism, effectively solves the problem of insufficient information that may be caused by a single feature dimension, and generates a unified outbound behavior feature vector. The anomaly classification layer uses a multi-classification model to classify outbound behaviors according to a unified feature representation, which can accurately distinguish multiple behavior categories such as normal behavior, unauthorized outbound, hidden traffic and abnormal outbound, and generates classification confidence for further analysis. The introduction of this architecture significantly improves the detection accuracy of external connection behaviors, can accurately identify complex hidden threats (such as hidden traffic and disguised external connections), and effectively reduce false positives and false negatives. In addition, by integrating the multi-dimensional features of the client and network layers, the model's adaptability to advanced threats is significantly enhanced, making it suitable for diverse and complex network environment scenarios.

[0061] Further, after obtaining the first external connection behavior category and the corresponding classification confidence, the data verification also includes: determining the consistency index of the client monitoring data and the network layer monitoring data, including the target IP consistency index, the protocol type matching index, the traffic feature matching index and the timestamp consistency index;

[0062] Specifically, the target IP set is extracted from the client monitoring data and the network layer monitoring data, and is recorded as and Calculate the target IP consistency index : in, It is the number of intersections between the target IP in the client health data and the network layer monitoring data. is the union number of target IPs in the client and network layer data, Represents the size of the collection, that is, the number of elements contained in the collection.

[0063] The protocol type sets are extracted from the client monitoring data and the network layer monitoring data, respectively. and ;

[0064] Calculate protocol type matching index : in, is the number of intersections of protocol types in client health data and network layer monitoring data, It is the intersection and union of the number of protocol types in the client health data and the network layer monitoring data.

[0065] Extract the traffic size (in bytes) of the corresponding target IP from the client monitoring data and the network layer monitoring data, and record them as and For Targets , calculate the flow difference ratio:

[0066] in, For the Targets The flow difference ratio.

[0067] The target IP whose difference ratio is less than a preset threshold (5% in this embodiment) is recorded as matching traffic.

[0068] Calculate traffic feature matching index in, To match the target IP number of the traffic, The total number of target IP addresses.

[0069] The timestamp sets of outbound behaviors are extracted from the client monitoring data and the network layer monitoring data, respectively recorded as and For Targets , calculate the time difference: If the time difference is less than a preset threshold (such as 1 second), it is recorded as consistent.

[0070] Calculating Timestamp Consistency Indicator in, The number of target IP addresses that are consistent over time.

[0071] The comprehensive consistency score is calculated based on the target IP consistency index, the protocol type matching index, the traffic feature matching index and the timestamp consistency index. The calculation formula is: in, For the comprehensive consistency score, is the target IP consistency indicator, is the protocol type matching indicator, is the traffic feature matching index, is the timestamp consistency indicator, is the weight of the target IP consistency indicator, is the weight of the protocol type matching indicator, is the weight of the traffic feature matching index, is the weight of the timestamp consistency indicator;

[0072] The data verification score is calculated based on the joint anomaly detection result and the comprehensive consistency score, and the calculation formula is: in, scoring the data verification; The basic risk value is determined according to the first outreach behavior category; is the classification confidence corresponding to the joint anomaly detection result; is a terminal risk level weighting factor, which is determined according to the terminal risk level.

[0073] If the data verification score exceeds the preset risk threshold, it is determined that the data verification has not been passed, and an alarm message is generated in real time and sent to the security management center. See Table 2 for examples of alarm content.

[0074] Table 2 Alarm content example data table

[0075] Field Name content Equipment No. Device001 IP address 192.168.1.100 Overall consistency score 0.85 Data verification score 120 reason The overall consistency score is below the threshold time 2024-08-27 14:30:00

[0076] The present invention uses a data verification mechanism to comprehensively consider the consistency indicators of client monitoring data and network layer monitoring data as well as the anomaly detection results, thereby significantly improving the accuracy and reliability of anomaly detection of external connection behavior. The target IP consistency, protocol type matching, traffic feature matching and timestamp consistency indicators are weighted to generate a comprehensive consistency score, which can comprehensively evaluate the matching degree of the two types of monitoring data, thereby reducing the risk of false alarms and omissions that may be caused by a single data source. On the basis of the comprehensive consistency score, the data verification score is calculated in combination with the basic risk value corresponding to the first external connection behavior category, the classification confidence and the terminal risk level weighting factor, thereby realizing a refined evaluation of abnormal external connection behavior.

[0077] See also Figure 1 In S60, extracting key information from the log data of the external connection behavior data set, including a first external connection target, a first access time, a first protocol type, and a first port number; and dividing the controlled authorized terminal device into a pure intranet connection device, a normal external connection device, and an unknown external connection device according to the key information and the external connection permission;

[0078] In the terminal illegal external connection detection method of the present invention, firstly, by analyzing the log data in the external connection behavior data set, it is prioritized to determine whether the terminal device only performs intranet communication without external connection behavior. Specifically, the external connection targets of each controlled authorized terminal device are screened. If all external connection targets are within the enterprise intranet range (for example, the IP address falls within the intranet address segment 192.168.0.0 / 24) and do not involve external network communication, the device is directly classified as a pure intranet connection device. For devices with external network connection behavior, they are further distinguished based on the key information and external connection permissions.

[0079] Further, dividing the controlled authorized terminal device into the normal external connection device and the unknown external connection device according to the key information and the external connection permission includes:

[0080] A whitelist is constructed according to the external connection permission, wherein the whitelist includes a second external connection target, a second access time, a second protocol type, and a second port number that are allowed to be externally connected; the key information is matched with the whitelist, and if the first external connection target, the first access time, the first protocol type, and the first port number all meet the matching conditions defined in the whitelist, the controlled authorized terminal device is identified as the normal external connection device; if any one of the first external connection target, the first access time, the first protocol type, and the first port number does not meet the corresponding matching conditions, the corresponding controlled authorized terminal device is identified as the unknown external connection device.

[0081] Specifically, the matching condition is to check the four key parameters of the terminal device's outbound behavior to determine whether it meets the predefined whitelist rules. First, the terminal's outbound target (i.e., the connected IP address or domain name) must be consistent with the target allowed in the whitelist. Second, the time when the outbound occurs must be within the time range specified in the whitelist to ensure that the outbound is only performed during the legal time period. In addition, the protocol type used during the outbound (such as HTTP, HTTPS, etc.) also needs to comply with the provisions in the whitelist. Finally, the target port number must be a port allowed by the whitelist. If any of the four conditions does not meet the whitelist requirements, the outbound behavior will be considered abnormal and the device will be identified as an unknown outbound device. On the contrary, if all conditions meet the whitelist requirements, the terminal device's outbound behavior is considered normal and the device will be identified as a normal outbound device. In this way, the outbound behavior of the terminal device can be effectively controlled and detected to ensure network security.

[0082] The whitelist and subsequent log anomaly identification are complementary and can jointly improve the accuracy of detection and the security of the system. The whitelist quickly screens out normal external devices by clarifying the scope of allowed external connection behaviors (such as target address, access time, protocol type and port number), reducing unnecessary analysis and calculation burdens. Its strong deterministic characteristics effectively prevent unauthorized external connection behaviors. Even if there are some omissions, they are easily detected in subsequent log anomaly identification. However, the whitelist alone cannot cover unknown threats, such as hidden attack traffic or zero-day attacks. Therefore, it is necessary to further combine anomaly detection technology to accurately analyze unknown external devices after matching the whitelist, and identify illegal behaviors such as hidden traffic and frequency anomalies through the log anomaly detection model, so as to dynamically adapt to complex and changeable network environments. The present invention not only improves detection efficiency and reduces system resource consumption through the method of "whitelist priority and anomaly detection supplement", but also significantly enhances the defense capability against unknown threats and ensures the security and robustness of the system.

[0083] See also Figure 1 In S70, log data corresponding to the unknown external device is obtained from the external connection behavior data set to obtain log data to be checked; the pre-processed log data to be checked is input into a log anomaly detection model to identify abnormal events, and a log risk score is calculated based on all the abnormal events and an event score mapping table;

[0084] In the preprocessing of the log data to be checked, in order to ensure the independence of each external connection behavior, all the log data to be checked need to be split into single log records. That is, the multiple external connection records in the original log file are split one by one, and each log record corresponds to an external connection behavior (including external connection target, access time, protocol type, port number, etc.). This splitting method can ensure that each log record is used as a separate input and can generate a unique classification result when entering the log anomaly detection model, instead of causing the model to only output one result due to multiple external connection records being piled up in the same file.

[0085] In the preprocessing process of the log data to be checked, in addition to splitting the log records one by one, it is also necessary to count the abnormal event information of each terminal device. Specifically, the device identifier (such as the terminal device ID or MAC address) of each log record is associated to ensure that each external connection behavior can be attributed to a specific terminal device. After completing the preprocessing, all abnormal event categories and corresponding occurrence times are summarized for each terminal device to facilitate the subsequent calculation of the device-level log risk score.

[0086] The format of the split log data is shown in Table 3:

[0087] Table 3 Example of log data to be inspected after preprocessing

[0088] Device ID Log ID Outreach Goals Access time Protocol Type Port Number ... A001 1 192.168.1.10 08 / 27 / 2024 10:23 TCP 443 ... A001 2 192.168.1.20 08 / 27 / 2024 10:45 UDP 53 ... A001 3 baidu.com 08 / 27 / 2024 11:00 HTTP 80 ... A001 4 malicious-site.com 08 / 27 / 2024 12:15 HTTPS 443 ... A001 5 10.0.0.2 08 / 27 / 2024 13:00 TCP 22 ... ... ... ... ... ... ... ...

[0089] Specifically, Figure 4 As shown in FIG, the preprocessed log data to be checked is input into the log anomaly detection model, and the abnormal event category is output. The abnormal event category is divided into n categories. According to the integration of all the output results, the abnormal event category of each device is counted to generate a device-level abnormal event summary table. Some examples of the summary table are shown in Table 4, and the number of occurrences of each type of abnormal event is obtained.

[0090] The event score mapping table is shown in Table 5. The calculation formula for the total score (cumulative risk score) after aggregation is: in, is the total score after aggregation (cumulative risk score), For the The event scores of the abnormal event types (obtained from the event score mapping table, as shown in Table 5), The first The number of occurrences of the abnormal event type, The total number of abnormal event types detected in the log data to be checked.

[0091] Table 4 Statistics of abnormal events at device level

[0092] Device ID Abnormal event category Occurrence Event Rating A001 Hiding traffic 1 90 A001 Port scanning behavior 1 85 A001 Protocol exception 5 80 ... ... ... ...

[0093] Table 5 Event score mapping table

[0094] Abnormal event type Event Scoring Hiding traffic 90 Port scanning behavior 85 Protocol exception 80 Frequency Abnormality 70 Malware activity 60 Data transfer exceeded 50 ... ...

[0095] The log risk score is calculated based on the total score and the terminal risk level weighting factor. The calculation formula is: in, Provide log risk scores for the log data to be inspected. A weighting factor for the terminal risk level of the device;

[0096] See also Figure 1 In S80, if the log risk score exceeds a preset threshold, the corresponding unknown external device is determined to be an illegal external terminal device; the log anomaly detection model is trained based on the annotated historical log data and is a multi-classification model constructed using the Transformer architecture.

[0097] Specifically, the log anomaly detection model is built using the Transformer architecture, which is a deep learning multi-classification model based on natural language processing (NLP). The training process is as follows: First, collect and organize the annotated historical log data, which contains a variety of known abnormal event types (such as hidden traffic, port scanning behavior, protocol anomalies, frequency anomalies, malware activities, and excessive data transmission) as well as normal behavior. Then, the annotated log data is standardized and preprocessed, including converting the original log records into a model-readable input format. In the preprocessed log data, each record is mapped to an independent text sequence for training the model.

[0098] In the data partitioning stage, the dataset is divided into training set, validation set and test set in a ratio of 8:1:1. The model input layer embeds the token sequence of the log record into a high-dimensional vector, represents the semantic information through the embedding layer, and the position encoding layer adds the sequential characteristics of the time series. The multi-layer Transformer encoder captures the deep correlation features between log fields through the multi-head attention mechanism. The classification layer outputs the category probability distribution of each log record through the fully connected layer and the Softmax activation function. During the training process, the cross entropy loss function is used as the optimization target, combined with the Adam optimization algorithm and the batch training strategy (32 log records per batch), and the model parameters are adjusted in real time. After each training cycle, the validation set is used to evaluate the accuracy, recall rate and F1 score of the model, and the hyperparameters are optimized to improve the model performance. Finally, the best model parameters are saved for practical application. The trained log anomaly detection model can accurately classify the input single log record, identify its abnormal event type or normal state, and provide important support for the detection and risk assessment of illegal external connections of terminals.

[0099] In this embodiment, a set of comparative experiments was conducted. The experimental group adopted a terminal illegal external connection detection method proposed by the present invention, and the control group 1 adopted Figure 1 The process in the previous step was implemented, but step S40 was skipped (uninstallation detection, tampering detection, and operation detection were not performed on the client monitoring program), and the remaining steps remained unchanged; control group 2 followed the Figure 1 , but the external connection permission in S60 is a blacklist, then the controlled authorized terminal devices are divided into pure intranet connection devices, abnormal external connection devices and unknown external connection devices according to the key information and external connection permission (blacklist), and then the unknown external connection devices are further analyzed and executed. Figure 1 S70 and S80 in the method identify illegal external terminal devices among unknown external devices.

[0100] Table 6 Comparative experimental results data table

[0101] Experimental group / control group Detection Methods Detection accuracy False Positive Rate False negative rate Experimental Group The terminal illegal external connection detection method proposed by the present invention includes a complete process ( Figure 1 S10 to S80) 98.50% 1.20% 0.30% Control group 1 according to Figure 1 The process is implemented, but step S40 is skipped (uninstallation detection, tampering detection, and operation detection of the client monitoring program are not performed), and the remaining steps remain unchanged 85.30% 10.50% 4.20% Control group 2 according to Figure 1 The process is implemented, but the external connection permissions in S60 adopt blacklist rules, and the devices connected to the internal network, abnormal external connection devices and unknown external connection devices are divided into the following steps. 89.70% 8.20% 2.10%

[0102] Referring to Table 6, it can be seen from the comparative experiments that after applying the client monitoring program detection (S40) and the external connection permission based on the whitelist rule (S60), the experimental group significantly improved the detection accuracy and reduced the false positive and false negative rates.

[0103] The terminal illegal external connection detection method proposed in the present invention, by combining client monitoring data, network layer monitoring data and intranet detection data, comprehensively constructs an external connection behavior data set, and realizes accurate analysis and classification of terminal external connection behavior. By introducing terminal risk levels, the permissions of different authorized terminal devices are hierarchically managed, which effectively improves the monitoring accuracy of high-risk devices and reduces the false alarm and missed alarm probability of the overall system. Through uninstall detection, tampering detection and operation detection, the integrity and reliable operation of the client monitoring program are ensured, the credibility of the data source is guaranteed, and the detection failure caused by the tampering or uninstallation of the monitoring program is prevented from the source. The external connection permission division strategy based on the whitelist can quickly screen out normal external connection devices and unknown external connection devices, reduce unnecessary computing overhead, and optimize detection efficiency. At the same time, the log data of unknown external connection devices is deeply analyzed through the log anomaly detection model, and the log risk score is calculated by combining the abnormal event score and the terminal risk level weighting factor, which can accurately identify illegal external connection terminal devices and realize effective perception and judgment of unknown threats. In a complex network environment, this method can not only quickly adapt to a variety of external connection scenarios, but also effectively respond to unknown threats, providing a comprehensive and intelligent solution for terminal security monitoring, which helps to comprehensively reduce the potential security risks brought about by illegal external connection behaviors.

[0104] Embodiment 2

[0105] Company B is a large enterprise whose business involves the management of sensitive internal data and key resources. The internal network carries a large amount of core data communication and storage. In order to ensure the security of the intranet and the compliance of network behavior, Company B has implemented strict management measures on terminal devices connected to the intranet. Among them, the management of external connection behavior of terminal devices is a key protection target, because illegal external connection behavior may lead to data leakage, network attacks or failure of the internal network protection system. To this end, Company B has deployed a client monitoring program on each terminal device to monitor the external connection behavior and system status of the terminal device in real time. The program can collect information such as the terminal's external connection target, protocol type, access time, etc., and conduct real-time analysis in combination with the external connection permission rules formulated by the enterprise. Once abnormal behavior is detected, the client monitoring program will immediately report the relevant information to the security management center, so as to facilitate timely blocking of threats and source tracing analysis.

[0106] However, during actual operation, Company B discovered that client monitoring programs often become targets of attackers. The monitoring programs on some terminal devices were maliciously uninstalled, tampered with, or stopped running, resulting in the failure of the external behavior detection function. In this case, attackers can bypass the external detection mechanism and use the terminal device to conduct unauthorized communications with external targets, or even use the terminal device as a springboard to carry out further attacks on other devices or servers in the intranet, such as stealing sensitive data, spreading malware, or launching denial of service attacks. These problems make the reliability and stability of the monitoring program a weak link in Company B's network security system, and also pose a serious threat to the overall protection effect of the intranet.

[0107] To solve this problem, Company B provides a terminal illegal external connection detection device, such as Figure 5 As shown, including:

[0108] The terminal acquisition module is used to acquire all terminal devices connected to the specified local area network;

[0109] An authorization detection module is used to perform authorization detection on the terminal device to obtain authorized terminal devices and unauthorized terminal devices;

[0110] A risk grading module is used to grade the authorized terminal device to obtain a terminal risk level; a client monitoring module is used to perform uninstall detection, tamper detection and operation detection on the client monitoring program deployed on the authorized terminal device; the authorized terminal device that passes the uninstall detection, tamper detection and operation detection at the same time is regarded as a controlled authorized terminal device;

[0111] A data acquisition module is used to obtain the client monitoring data of the controlled authorized terminal device, and to generate an external connection behavior data set by combining the network layer monitoring data and the intranet detection data; an external connection device classification module is used to obtain the client monitoring data of the controlled authorized terminal device, and to generate an external connection behavior data set by combining the network layer monitoring data and the intranet detection data; extract key information from the log data of the external connection behavior data set, including the first external connection target, the first access time, the first protocol type and the first port number; and classify the controlled authorized terminal device into a pure intranet connection device, a normal external connection device and an unknown external connection device according to the key information and the external connection permission;

[0112] The log anomaly detection module is used to obtain the log data corresponding to the unknown external device from the external connection behavior data set to obtain the log data to be checked; input the pre-processed log data to be checked into the log anomaly detection model to identify abnormal events, and calculate the log risk score according to the event score mapping table;

[0113] The illegal external connection determination module is used to determine that the corresponding unknown external connection device is an illegal external connection terminal device when the log risk score exceeds a preset threshold; the log anomaly detection model is trained based on the annotated historical log data and is a multi-classification model constructed using the Transformer architecture.

[0114] Each functional module of the terminal illegal external connection detection device corresponds to the steps of the method in the first embodiment to ensure the integrity and feasibility of the technical implementation. The device covers all the contents involved in the first embodiment.

[0115] Embodiment 3

[0116] Corresponding to the above method embodiment, an embodiment of the present invention further provides a readable storage medium. The readable storage medium described below and the method for detecting illegal external connection of a terminal described above can refer to each other.

[0117] A storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for detecting illegal external connection of a terminal in the above method embodiment.

[0118] The storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0119] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting illegal external connection of a terminal, characterized in that: include: Get all terminal devices connected to the specified LAN; Performing authorization detection on the terminal device to obtain authorized terminal devices and unauthorized terminal devices; Classifying the authorized terminal devices to obtain terminal risk levels; The terminal risk level is used as a weighting factor in the calculation of subsequent log risk scores; Performing uninstall detection, tamper detection and operation detection on the client monitoring program deployed on the authorized terminal device; treating the authorized terminal device that passes the uninstall detection, tamper detection and operation detection as a controlled authorized terminal device; Obtaining the client monitoring data of the controlled authorized terminal device, combining the network layer monitoring data and the intranet detection data, and summarizing them into an external connection behavior data set; Extract key information from the log data of the external connection behavior data set, including a first external connection target, a first access time, a first protocol type, and a first port number; divide the controlled authorized terminal device into a pure intranet connection device, a normal external connection device, and an unknown external connection device according to the key information and the external connection permission; Acquire log data corresponding to the unknown external connection device from the external connection behavior data set to obtain log data to be checked; Input the preprocessed log data to be checked into the log anomaly detection model to identify abnormal events, and calculate the log risk score based on all the abnormal events; If the log risk score exceeds a preset threshold, the corresponding unknown external device is determined to be an illegal external terminal device; the log anomaly detection model is trained based on the annotated historical log data and is a multi-classification model constructed using the Transformer architecture.

2. A method for detecting illegal external connection of a terminal according to claim 1, characterized in that: When the unauthorized terminal device is detected, the process further includes: directly isolating the unauthorized terminal device and sending an alarm to a security management center.

3. A method for detecting illegal external connection of a terminal according to claim 1, characterized in that: Grading the authorized terminal devices includes: determining the terminal risk level according to the data confidentiality level, external connection requirements and historical security event data of the authorized terminal devices.

4. A method for detecting illegal external connection of a terminal according to claim 1, characterized in that: The uninstall detection, tamper detection and operation detection are performed on the client monitoring program deployed on the authorized terminal device, including: the client monitoring program periodically sends a heartbeat signal to the security management center through a heartbeat packet mechanism and monitors the continuity of the heartbeat signal to obtain an uninstall detection result; the tamper detection result is obtained by calculating the hash value of the key file of the client monitoring program and comparing it with the original hash value stored in the security management center, and verifying the digital signature of the client monitoring program through pre-stored signature verification information; the operation detection result is obtained by monitoring the thread status, process call and resource usage of the client monitoring program and comparing them with the normal behavior baseline.

5. A method for detecting illegal external connection of a terminal according to claim 1, characterized in that: When obtaining the client monitoring data, the network layer monitoring data and the intranet detection data of the controlled authorized terminal device, it also includes: performing data verification on the client monitoring data and the network layer monitoring data, specifically: inputting the client monitoring data and the network layer monitoring data into a trained joint anomaly detection model to obtain a joint anomaly detection result.

6. A method for detecting illegal external connection of a terminal according to claim 5, characterized in that: The joint anomaly detection model includes: an input layer, which is used to receive the client monitoring data and the network layer monitoring data, and to generate a multi-dimensional input vector by standardizing the client monitoring data and the network layer monitoring data, unifying the timestamp and data format, including the client standard input vector and the network layer standard input vector; a feature extraction layer, which includes a client feature extraction module and a network layer feature extraction module, which are used to extract client behavior features and network traffic features respectively; wherein the client feature extraction module is used to extract features from the client standard input vector, including system call logs, external target information and device status information; the time dependency and behavior pattern in the system call log are captured by the LSTM model, and the static attributes are processed in combination with the embedding layer to generate a client comprehensive feature vector; the network layer feature extraction module is used to extract spatial distribution features and dynamic connection patterns from the network layer standard input vector, including target IP addresses, flow The invention relates to a method for detecting the external connection behavior of a client and a network layer. The method comprises the following steps: first, capturing the spatial distribution characteristics of the network protocol through a convolutional neural network, and combining a multi-layer perceptron to analyze the dynamic changes of the traffic, and generating a comprehensive feature vector of the network layer; second, a feature fusion layer for fusing the comprehensive feature vector of the client with the comprehensive feature vector of the network layer, and capturing the interactive relationship between the client behavior characteristics and the network traffic characteristics through a multi-head attention mechanism, and generating a unified external connection behavior feature vector; third, an abnormal classification layer, comprising: a fully connected layer for mapping the external connection behavior feature vector to the external connection behavior category space, and generating a classification score for each external connection behavior category; fourth, a Softmax activation function for converting the classification score into a probability distribution, and calculating the classification confidence of each external connection behavior category; fifth, selecting the external connection behavior category with the highest probability from the classification confidence through a maximum probability value selection mechanism, and determining a first external connection behavior category; and fifth, an output layer for outputting the first external connection behavior category and the corresponding classification confidence.

7. A method for detecting illegal external connection of a terminal according to claim 5, characterized in that: The data verification further includes: determining the consistency index of the client monitoring data and the network layer monitoring data, including a target IP consistency index, a protocol type matching index, a traffic feature matching index, and a timestamp consistency index; and calculating a comprehensive consistency score according to the target IP consistency index, the protocol type matching index, the traffic feature matching index, and the timestamp consistency index, and the calculation formula is: S total =ω IP ·S IP +oh P ·S P +oh F ·S F +oh T ·S T ; oh IP +oh P +oh F +oh T =1; Among them, S total is the comprehensive consistency score, S IP is the target IP consistency indicator, S P is the protocol type matching index, S F is the traffic feature matching index, S T is the timestamp consistency indicator, ω IP is the weight of the target IP consistency index, ω P is the weight of the protocol type matching index, ω F is the weight of the traffic feature matching index, ω T is the weight of the timestamp consistency indicator; The data verification score is calculated based on the joint anomaly detection result and the comprehensive consistency score, and the calculation formula is: VS=BRV·CC·TRL·(1-S total ); Among them, VS is the data verification score; BRV is the basic risk value, which is determined according to the first external behavior category; CC is the classification confidence corresponding to the joint anomaly detection result; TRL is the terminal risk level weighting factor, which is determined according to the terminal risk level.

8. A method for detecting illegal external connection of a terminal according to claim 1, characterized in that: Classifying the controlled authorized terminal device into the normal external connection device and the unknown external connection device according to the key information and the external connection permission includes: A whitelist is constructed according to the external connection permission, wherein the whitelist includes a second external connection target, a second access time, a second protocol type, and a second port number that are allowed to be externally connected; the key information is matched with the whitelist, and if the first external connection target, the first access time, the first protocol type, and the first port number all meet the matching conditions defined in the whitelist, the controlled authorized terminal device is identified as the normal external connection device; if any one of the first external connection target, the first access time, the first protocol type, and the first port number does not meet the corresponding matching conditions, the corresponding controlled authorized terminal device is identified as the unknown external connection device.

9. A terminal illegal external connection detection device, characterized in that: include: The terminal acquisition module is used to acquire all terminal devices connected to the specified local area network; An authorization detection module is used to perform authorization detection on the terminal device to obtain authorized terminal devices and unauthorized terminal devices; A risk classification module, used to classify the authorized terminal devices to obtain terminal risk levels; The terminal risk level is used as a weighting factor in the calculation of subsequent log risk scores; The client monitoring module is used to perform uninstall detection, tamper detection and operation detection on the client monitoring program deployed on the authorized terminal device; the authorized terminal device that passes the uninstall detection, tamper detection and operation detection at the same time is regarded as a controlled authorized terminal device; A data collection module is used to obtain the client monitoring data of the controlled authorized terminal device, combine the network layer monitoring data and the intranet detection data, and summarize them into an external connection behavior data set; The external device classification module is used to obtain the client monitoring data of the controlled authorized terminal device, combine the network layer monitoring data and the intranet detection data, and summarize them into an external behavior data set; extract key information from the log data of the external behavior data set, including the first external target, the first access time, the first protocol type and the first port number; and classify the controlled authorized terminal device into a pure intranet connection device, a normal external device and an unknown external device according to the key information and the external permission; A log anomaly detection module, used to obtain log data corresponding to the unknown external connection device from the external connection behavior data set to obtain log data to be checked; Input the preprocessed log data to be checked into the log anomaly detection model to identify abnormal events, and calculate the log risk score based on all the abnormal events; The illegal external connection determination module is used to determine that the corresponding unknown external connection device is an illegal external connection terminal device when the log risk score exceeds a preset threshold; the log anomaly detection model is trained based on the annotated historical log data and is a multi-classification model constructed using the Transformer architecture.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for detecting illegal external connection of a terminal as claimed in any one of claims 1 to 8 are implemented.

Images