A network violation outreach detection method

Abstract

This invention relates to the field of network security and discloses a method for detecting unauthorized external connections. The method includes: acquiring and preprocessing real-time data traffic of a target monitored network via a bypass method; performing passive detection on the preprocessed traffic data based on feature matching to identify known unauthorized communication patterns; injecting probe packets carrying unique source identifiers into internal network hosts and actively probing based on the response capture results from the external network to discover unknown unauthorized external connection channels; correlating the output results of the active and passive detection processes to perform comprehensive analysis and risk assessment of the host's behavior; generating unauthorized external connection alarms based on the risk assessment results and securing relevant electronic evidence. By combining passive feature matching detection with an active probing mechanism, this method solves the problem that existing technologies relying solely on feature matching cannot discover unknown or hidden external connection channels, achieving a comprehensive detection effect for both known and unknown unauthorized external connection behaviors.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for detecting unauthorized external network connections. Background Technology

[0002] With the development of network information technology, the boundaries of network security are becoming increasingly blurred. Unauthorized data transmission from internal networks or covert communication between compromised hosts and external control servers has become one of the major threats to information security. To address this threat, continuous monitoring of communication between internal and external networks is necessary to promptly detect and block unauthorized external connections.

[0003] Currently, the main technical means of detecting such unauthorized external connections rely on passive analysis of network traffic. These methods involve deploying security devices such as Intrusion Detection Systems (IDS) and Next-Generation Firewalls (NGFWs) at critical network nodes, and using Deep Packet Inspection (DPI) technology to match real-time traffic characteristics with pre-set rule bases or threat intelligence databases.

[0004] However, this technical approach has inherent limitations. Its detection capabilities are highly dependent on the completeness and timeliness of rules and intelligence, often making it difficult to effectively identify unauthorized external communication channels established using unknown attack tools, zero-day vulnerabilities, or novel encryption protocols. Attackers can evade signature-based detection through various techniques such as protocol spoofing and traffic encryption, rendering traditional methods ineffective against advanced persistent threats (APTs). Furthermore, alerts generated by such detection systems are typically isolated incidents, lacking comprehensive analysis of the host's behavioral context, resulting in a large number of alerts and a high false positive rate, posing a significant challenge to security operations personnel in their analysis and response efforts. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for detecting unauthorized external connections to the network. This method solves the problems of existing methods relying on passive feature matching, which makes it difficult to discover unknown or hidden external connection channels, and the resulting isolated alarms and high false alarm rates, making accurate judgment difficult.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for detecting unauthorized external network connections, comprising the following steps:

[0007] S1. Obtain and preprocess the real-time data traffic of the target monitoring network through a bypass method;

[0008] S2. Passive detection is performed on the preprocessed traffic data based on feature matching to identify known illegal communication patterns;

[0009] S3. Inject probe packets carrying unique source identifiers into internal network hosts, and actively probe based on the response capture results of external networks to discover unknown unauthorized external connection channels.

[0010] S4. The output results of the associated active and passive detection processes are used to conduct a comprehensive analysis and risk assessment of the host's behavior.

[0011] S5. Generate violation alerts based on risk assessment results and solidify relevant electronic evidence.

[0012] Preferably, step S1 specifically includes the following steps:

[0013] Reassemble the data packets in the real-time data traffic into a network session;

[0014] The network session is parsed to extract the session 5-tuple information, application layer protocol type, and key features.

[0015] Preferably, step S3 specifically includes the following steps:

[0016] The communication behavior of the target monitoring network is self-learned to establish a baseline model of the internal network asset inventory and normal external communication.

[0017] The detection targets were determined based on the aforementioned internal network asset inventory and baseline model;

[0018] Generate a probe message containing a unique tracing identifier for the probe target;

[0019] The detection message is injected into the detection target;

[0020] By using a response capture mechanism deployed on an external network, the system monitors and verifies whether the probe message is received in order to confirm unauthorized external connection behavior.

[0021] Preferably, the generation of the probe message carrying a unique traceability identifier specifically includes the following steps:

[0022] The unique tracing identifier is generated through hash operation based on the IP address, MAC address, current timestamp, and random number of the target being detected.

[0023] The unique tracing identifier is encapsulated as a payload in a multi-protocol message, and the probe message is disguised using an application layer protocol.

[0024] Preferably, step S4 specifically includes the following steps:

[0025] Create and dynamically update behavioral profiles for hosts in the internal network, including static attributes, dynamic behavioral characteristics, and security event logs.

[0026] Based on preset time windows and logical rules, correlation analysis is performed on multi-source security events in the behavioral profile;

[0027] The host's overall risk score is calculated based on a risk quantification assessment model.

[0028] Preferably, the calculation of the host's comprehensive risk score based on a risk quantification assessment model is achieved in the following manner:

[0029] Assign basic risk weights to different types of security incidents;

[0030] The overall risk score is the sum of the risk values ​​of each independent security event related to the host, plus the sum of the additional risk reward values ​​generated by the associated event group;

[0031] The risk value of the independent security event is the result of its basic risk weight calculated using a time decay function.

[0032] Preferably, the logical rules include:

[0033] The system associates passively detected events that occur on the same host within a preset time window and involve communication with a known command and control server with unauthorized external connection events confirmed by active detection to generate a composite alarm.

[0034] Preferably, the passive detection based on feature matching specifically includes the following steps:

[0035] The communication features extracted from the traffic data are matched in real time with a preset knowledge base consisting of a violation rule base and a threat intelligence base.

[0036] A passive detection event is generated when the communication feature matches any item in the knowledge base.

[0037] Preferably, step S5 specifically includes the following steps:

[0038] An alarm is triggered when the overall risk score of the host exceeds a preset alarm threshold;

[0039] Aggregate all root cause event information related to the alarm to generate a structured alarm report;

[0040] The original network data packets directly related to the root cause event are automatically extracted and saved as electronic evidence.

[0041] Preferably, the injection of the detection message into the detection target is achieved in the following ways:

[0042] The probe message is constructed and sent using the network interface of the detection system in the form of a raw socket, wherein the destination IP address of the message is set to the IP address of the probe target.

[0043] This invention provides a method for detecting unauthorized external connections on a network. It has the following beneficial effects:

[0044] 1. This invention combines passive feature matching detection with an active detection mechanism. Active detection is achieved by injecting a message carrying a unique traceability identifier and capturing external responses. This solves the problem that existing technologies rely solely on feature matching and cannot discover unknown or hidden external connection channels. It achieves the effect of comprehensive detection of known and unknown illegal external connection behaviors.

[0045] 2. This invention solves the problems of isolated alarms, lack of context, and difficulty in distinguishing between real threats and false alarms caused by traditional detection methods by linking active and passive detection results, constructing host behavior profiles, and using a risk quantification assessment model for comprehensive analysis. This achieves the effects of improving alarm accuracy, reducing false alarm rate, and realizing accurate quantification of host risk.

[0046] 3. This invention solves the problems of difficulty in accurately tracing the source to a specific host and lack of reliable electronic evidence after discovering unauthorized external connections by embedding a unique source identifier in the active probe message and solidifying the relevant original network data packets when generating an alarm. This achieves the effect of accurately attributing the illegal behavior and solidifying the evidence. Attached Figure Description

[0047] Figure 1 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0048] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Please see the appendix Figure 1 This invention provides a method for detecting unauthorized external network connections, comprising the following steps:

[0050] S1. Obtain and preprocess the real-time data traffic of the target monitoring network through a bypass method;

[0051] S2. Passive detection is performed on the preprocessed traffic data based on feature matching to identify known illegal communication patterns;

[0052] S3. Inject probe packets carrying unique source identifiers into internal network hosts, and actively probe based on the response capture results of external networks to discover unknown unauthorized external connection channels.

[0053] S4. The output results of the associated active and passive detection processes are used to conduct a comprehensive analysis and risk assessment of the host's behavior.

[0054] S5. Generate violation alerts based on risk assessment results and solidify relevant electronic evidence.

[0055] The specific process of this method is explained in detail below.

[0056] First, real-time data traffic of the target monitored network is obtained through a bypass method. This step is specifically achieved by configuring the port mirroring function of the network switching device or deploying a network traffic splitter to non-intrusively copy a copy of the data traffic flowing through the core network link. This ensures that there is no impact on the continuity of existing network services.

[0057] After acquiring the raw data traffic, the traffic is preprocessed. The preprocessing operation includes reassembling discrete data packets into logical network sessions and performing protocol parsing on the session data to extract the field information necessary for subsequent detection, such as source / destination IP addresses, source / destination port numbers, protocol types, and key features in the application layer data payload.

[0058] After preprocessing, the passive detection and active detection processes are executed in parallel.

[0059] In the passive detection process, deep packet inspection technology is used to analyze preprocessed traffic data. Communication characteristics extracted from the traffic in real time are matched against a pre-defined violation rule base and a threat intelligence base. This matching process aims to discover violations with known characteristics, such as identifying traffic generated by specific remote control tools or proxy software, and communications with known malicious servers, thereby determining the controlled reverse connection behavior of compromised assets.

[0060] In the proactive probing process, the network environment's communication behavior is first self-learned to establish a baseline model of internal network assets and normal external communication. Then, for hosts identified as belonging to the internal network, a probe message containing a unique source identifier is constructed and injected. The destination address of this probe message is set to a response capture address deployed outside the target monitoring network (such as the public internet).

[0061] Next, a response capture mechanism deployed on the external network continuously monitors whether probe packets are forwarded to that address. If an internal host has an unauthorized external connection channel, it will forward the probe packet through that channel upon receiving it. Once the external response capture mechanism receives such a packet and successfully extracts the preset unique source identifier by decoding the packet payload, it can confirm that the source host corresponding to that identifier has engaged in unauthorized external connection behavior.

[0062] Subsequently, a correlation analysis is performed on the feature matching results discovered in the passive detection process and the illegal external connection events confirmed in the active detection process. This step integrates events from the two detection processes involving the same host to construct a dynamic behavioral profile of the host, and calculates the host's risk score based on a risk assessment model.

[0063] When the calculated host risk score reaches or exceeds a preset threshold, a violation alert is generated. This alert contains detailed tracing information such as the violating host's internal IP address, MAC address, time of violation, and destination IP address of the external connection. Simultaneously, original data packets and session logs directly related to the violation are archived, forming a complete chain of electronic evidence.

[0064] Finally, the generated alerts and solidified evidence are collected and presented in a unified manner to provide network security managers with a clear view of the events, supporting subsequent auditing, tracing, and emergency response.

[0065] The basis of this invention lies in the acquisition and parsing of network traffic. To achieve subsequent detection of unauthorized external connections, communication data within the target monitored network needs to be collected and structured.

[0066] The first step in this process is to acquire network traffic. This invention employs a bypass deployment method to capture a complete copy of network traffic without interrupting or altering the existing network structure and data flow paths. Specifically, one of the following two techniques can be used: First, utilizing the port mirroring function of a network switch, all communication data from one or more physical ports is copied to another designated monitoring port. The detection system connects to this monitoring port to receive the traffic copy. Second, a dedicated network splitter is deployed in critical network links. This hardware device can passively copy all data packets flowing through the link and send them to the detection system, providing high-fidelity traffic data. Both techniques achieve non-intrusive traffic acquisition, providing raw data input for subsequent analysis.

[0067] After obtaining the original data packets, the second step, session reassembly, is performed. Since data packets in network transmission are discrete, to understand the complete application layer interaction, data packets belonging to the same communication process must be reassembled into a network session. This reassembly process, based on the five-tuple in the network and transport layer header information of the data packets—namely, source IP address, destination IP address, source port number, destination port number, and transport layer protocol (such as TCP or UDP)—groups data packets with the same five-tuple into the same session log stream. For TCP protocol session reassembly, its implementation requires handling the TCP protocol's state machine, sequence number, acknowledgment number, and mechanisms such as out-of-order reordering and packet loss retransmission. Those skilled in the art can implement this using existing algorithm libraries; the specific implementation is well-known in the field and will not be elaborated upon here. Through session reassembly, the unordered data packet stream is transformed into an ordered application layer data stream with contextual logic.

[0068] After session reassembly is complete, the third step, protocol parsing and feature extraction, begins. This step performs deep packet inspection (DPI) on the reassembled session data stream to identify the application layer protocol it carries and extract key feature information. The protocol identification process uses methods such as signature matching or behavioral pattern analysis to determine which application protocol the session belongs to, such as Hypertext Transfer Protocol (HTTP), Domain Name System Protocol (DNS), Secure Sockets Layer / Transport Layer Security (SSL / TLS), etc.

[0069] After identifying the specific protocol, corresponding feature extraction is performed for different protocols. For example:

[0070] For an HTTP session, extract the access method (GET, POST, etc.), the Uniform Resource Locator (URL) of the request line, and the Host, User-Agent, and Referer fields in the request header.

[0071] For a DNS session, extract the queried domain name and query type from the query message, and the list of responding IP addresses from the response message.

[0072] For SSL / TLS encrypted sessions, although the application layer payload is encrypted, the Server Name Indicator (SNI) field can still be extracted from the client greeting message during the handshake phase. This SNI field exposes the target server domain name that the client intends to access in plaintext, and is a key feature for analyzing the destination of encrypted traffic.

[0073] Following the steps outlined above, the raw network traffic is transformed into a series of structured session logs. Each session log contains a five-tuple of information about the session, the identified application layer protocol type, and a set of key features extracted from the protocol interaction. This structured feature data will serve as input for subsequent passive detection and active probing modules, providing a data foundation for the accurate determination of unauthorized external connections.

[0074] After preprocessing the network traffic, the method of this invention proceeds to a passive detection step based on feature matching. This step aims to identify unauthorized external connection behaviors with known patterns and controlled anti-connection activities of compromised assets by comparing real-time network communication characteristics with a pre-set knowledge base.

[0075] The first phase of this process involves the construction and maintenance of a knowledge base. This knowledge base consists of two parts: a violation rule base and a threat intelligence base. The violation rule base defines the communication characteristics of various known violation tools or behaviors. Examples include network beacon traffic characteristics of specific remote control tools (such as IceScorpion and AntSword), VPN handshake patterns on uncommon ports, or protocol fingerprints of specific proxy software. These characteristics can manifest as specific byte sequences in application-layer payloads, unique request header combinations, or non-standard protocol interaction behaviors. The threat intelligence base compiles various security threat indicators, primarily including the IP addresses and domain names of known command and control servers, the URLs of known malware distribution sites, and network addresses associated with phishing and cryptocurrency mining activities. This knowledge base is continuously and dynamically updated through various channels, including subscribing to external commercial intelligence sources, open-source intelligence communities, and internal security research, to ensure the timeliness of its detection capabilities.

[0076] The second stage of this step is real-time matching and detection. The structured session features extracted in the previous steps are input into the matching engine and compared with the knowledge base in real time. For each network session, the matching and detection process can be determined by the following logic:

[0077] ;

[0078] In the formula, For network sessions The passive detection result is 1, which indicates that a match was detected, and 0, which indicates that no match was detected. For from the conversation The feature set extracted from the set, the elements of the set This refers to a single characteristic, such as the destination IP address, the requested domain name, or the SNI field; For violation rule database; This is a threat intelligence database. The meaning of this judgment is that as long as the session... any feature If the rule exists in the violation rule base or threat intelligence base, the session is determined to be a passive detection matching event.

[0079] To achieve efficient real-time matching, the matching engine employs corresponding optimization algorithms for different types of features. For example, for matching large-scale string sets such as domain names, URLs, and payload fingerprints, the Aho-Corasick automaton or its derivatives can be used. Such multi-pattern matching algorithms can complete the matching in linear time, and their specific implementation is well-known in the field and will not be elaborated here.

[0080] The third stage of this step is generating passive detection events. Once the above determination results are obtained... A value of 1 indicates that the system generates a passive detection event record. This record is a structured data volume containing the event's timestamp, the session 5-tuple information that triggered the match, the specific match item (i.e., the matched rule or intelligence content), the preset risk level associated with that match item, and the original session log as context. These generated passive detection events will serve as one of the inputs for subsequent event association and risk assessment steps.

[0081] To detect unknown or covert unauthorized external connections that are difficult to detect using passive methods, the method of this invention employs an active detection mechanism. The execution of this mechanism begins with the automated learning of the current network environment and the establishment of a baseline of normal communication behavior.

[0082] The first step in this process is the automatic identification of internal network assets. By analyzing the collected network traffic, hosts whose source or destination IP addresses belong to private address ranges (e.g., addresses within the ranges of 10.0.0.0 / 8, 172.16.0.0 / 12, and 192.168.0.0 / 16 as defined in RFC1918) are identified and preliminarily categorized as internal assets. Simultaneously, by continuously monitoring Address Resolution Protocol (ARP) request and response packets in the Layer 2 network, a mapping table of internal IP addresses to MAC addresses is established and dynamically maintained. Through these methods, a list of internal network assets is created.

[0083] The second step in this process is to establish a baseline model for normal business communication. Within a pre-defined learning period, statistical analysis is performed on all traffic originating from internal assets and destined for external public IP addresses. This analysis gathers all external destination IP addresses, domain names queried via the Domain Name System (DNS) protocol, and Server Name Indication (SNI) fields appearing during the Transport Layer Security (TLS) handshake phase. Based on this data, a set of external targets considered for normal business access is constructed—the whitelist baseline. This baseline model provides a basis for distinguishing between normal business communication and potentially abnormal outbound behavior.

[0084] The third step in this process is to identify the targets for proactive probing. Combining the identified internal asset inventory with the established normal communication baseline, hosts requiring proactive probing are selected. The selection strategy prioritizes terminal hosts that have almost no or no external communication activity during the learning cycle, as these hosts should theoretically not initiate external connections. For servers and other devices that have stable communication with legitimate external targets in the baseline model, their probing priority can be reduced or they can be excluded from the probing scope to avoid interfering with normal business operations.

[0085] After identifying the target, the method of this invention proceeds to the steps of constructing and embedding the probe message. The core of this step is to generate a special data packet that can be processed by the target host's network protocol stack and can be accurately traced after being forwarded to an external network.

[0086] This step begins by generating a unique source identifier for each probe mission. This identifier ensures that when an external response is captured, it can be accurately associated with a specific internal host and probe event. The generation process of this identifier can be represented by the following formula:

[0087] ;

[0088] In the formula, This is the final unique traceability identifier; For cryptographic hash functions, such as SHA-256; The IP address of the target host being probed; The MAC address of the target host being probed; The timestamp when the current exploration mission was initiated; Randomly generated The value is used to increase the randomness of the identifier; This is for string concatenation operations.

[0089] After generating a unique traceability identifier, the next step is to encapsulate it as a payload into the probe message. To improve the success rate of the probe and penetrate potential network access control policies, this method supports encapsulating the identifier into messages of various different protocols. For example, it can be placed directly in the data portion of a User Datagram Protocol (UDP) message, or in the payload of an Internet Control Message Protocol (ICMP) echo request message.

[0090] To further circumvent potential deep packet inspection devices within the internal network, this step also includes spoofing the probe packets using application-layer protocols. This involves constructing probe packets carrying a unique origin identifier into what appears to be a legitimate application-layer request. One specific implementation is to disguise it as a DNS query request, using encoded (e.g., Base64 encoded) data. As a subdomain part of the query domain. Another implementation is to disguise it as an HTTP-GET request, This can be used as a query parameter in the URL or as the value of a custom HTTP header field. Through this spoofing, the probe message appears as normal application traffic during network transmission, reducing the probability of being intercepted.

[0091] After constructing the probe message, the method of this invention proceeds to the scheduling and injection step of the probe task. This step aims to reliably deliver the probe message to the target host in a manner that is imperceptible to internal network users and security devices.

[0092] The first step is to schedule the probing tasks. To avoid attracting attention due to the regular network traffic introduced by the probing itself, the scheduling strategy employs low frequency and randomized time intervals. Specifically, a basic probing period is set, and a random time offset is superimposed on this period, making the time interval between two consecutive probing tasks variable. This effectively prevents the formation of detectable periodic communication patterns.

[0093] After the scheduled task is triggered, the next step, injecting probe packets, is executed. This step sends the constructed probe packets to the target monitoring network. Specifically, this is achieved by constructing and sending a complete network data packet using raw sockets through the network interface of the detection system. When constructing the data packet, the destination IP address in the network layer header is set to the IP address of the probed host, and the destination port in the transport layer header is set according to the masquerading application protocol. The source IP address of the data packet is set to the IP address of the detection system itself. In this way, the probe packets are injected into the network link, exchanged by the network device to the target host, and received and processed by the target host's network protocol stack.

[0094] After the probe packets are injected into the internal network, the method of this invention enters the step of capturing and tracing the external response. This step is the closed loop of the active probe mechanism, used to confirm whether there is an unauthorized channel forwarding internal probe packets to the outside.

[0095] This step begins by deploying and running a response capture service on an external network (such as a cloud server on the public internet). This service continuously listens for incoming network traffic on one or more pre-specified ports. These listening ports correspond to the destination ports used when constructing the probe packets.

[0096] If an internal host has an unauthorized external connection channel, upon receiving a probe packet, its operating system or application software will forward the packet to the external network through this channel, ultimately reaching the public IP address where the response capture service resides. At this point, the process proceeds to the next step: decoding and verifying the captured packet. Upon receiving the data packet, the response capture service extracts data from its payload. If the data conforms to a preset encoding format (such as Base64), it is decoded to recover the unique source identifier embedded within. .

[0097] The final step is to perform source tracing verification and return the results. The response capture service will decode the... This is synchronized in advance with the internal detection system and contains all issued detection tasks and their corresponding data. The received list is compared. If it exists in the list, the verification is successful, which directly proves that it is related to the [list of names / items]. The associated internal host has an unauthorized external connection path that leads to an external response capture service. Upon successful verification, the response capture service will send the data containing the unauthorized connection through a secure, encrypted channel (e.g., an HTTPS-based API interface). The system also sends a confirmation message with the captured timestamp back to the internal detection system. This confirmation message constitutes an active detection event and will be used for subsequent risk assessment.

[0098] To achieve accurate assessment of host risks, the method of this invention does not perform isolated judgments after receiving events from passive detection and active probing, but instead performs correlation analysis of events and constructs a behavioral profile of the host.

[0099] The first step in this process is to create and maintain a dynamic behavioral profile for each host in the internal network. This behavioral profile is a structured dataset used to comprehensively record all information related to the host. Its data structure specifically includes three dimensions: first, static attributes, which record the host's inherent identification information, such as its IP address, MAC address, and operating system type obtained through passive fingerprinting technology; second, dynamic behavioral characteristics, which record the host's network communication patterns over a period of time, such as the set of external domain names accessed most frequently by the host, the distribution of the most frequently used application layer protocols, and statistical data such as daily average uplink and downlink traffic; and third, a security event log, which records all security events related to the host in chronological order, including passive detection events and active probe events generated in the preceding steps.

[0100] The construction and updating of this behavioral profile is an ongoing process. When an internal IP address first appears on the network, the system initializes its behavioral profile. Subsequently, by continuously analyzing the network traffic of that host, its behavioral characteristic data is dynamically updated. When any detection process (passive or active) generates an event related to that host, the event is appended to the security event log of its profile, thereby aggregating scattered alarm information into a unified view centered on the host.

[0101] Building upon the host behavior profile, the process moves to the next step: performing correlation analysis of multi-source events. This step aims to uncover potential threats that a single event cannot reveal by analyzing the inherent relationships between multiple events recorded in the host profile. A basic correlation method is time-window-based aggregation. The system sets a time window, such as 5 minutes, and groups all security events occurring on the same host within this time window as components of a composite security event.

[0102] More in-depth correlation analysis is based on pre-defined logical rules used to identify combinations of events with specific attack logic. For example, one correlation rule could be defined as follows: if, within a set time window, a passive detection event of communication with a known malware command and control (software) server is first recorded in the host's behavioral profile, followed by a successful unauthorized outbound connection event confirmed by an active detection mechanism, then these two events are strongly correlated. This correlation results in a higher-confidence, higher-risk composite alert because it indicates that the host not only engages in suspected malicious communication but also possesses an actual channel for data transmission; the combination of these two behaviors significantly strengthens the conclusion that the host has been fully controlled. Another rule could be to correlate events when a host triggers multiple different types of low-risk passive detection events within a short period, and its recent network behavior (such as DNS request volume) shows significant anomalies, to identify probing behavior in the early stages of an attack. Through such correlation analysis rules, this method connects isolated, low-confidence event points into a logically related chain of evidence, thereby improving detection accuracy.

[0103] After completing the correlation analysis of multi-source events, the method of this invention adopts a risk quantification assessment model to accurately calculate the current risk status of each host, thereby transforming the complex security situation into an intuitive numerical value.

[0104] The first step in this process is to assign a base risk weight to different types of security incidents. This weight is a preset value that reflects the severity of the incident itself. Specifically, successful unauthorized outbound connections confirmed by proactive detection mechanisms are given the highest weight, as they directly confirm the existence of a compromised channel. Secondly, passively detected incidents matching high-confidence threat intelligence (such as known software servers) are also given high weight. Incidents related to low-confidence intelligence or general violations (such as communicating using non-standard ports) are given relatively lower weight.

[0105] The second step in this process is to calculate the host's overall risk score. This score is not a simple summation of the basic weights of each event, but rather takes into account both the timeliness of the events and the correlation between them. A host's overall risk score can be calculated using the following formula:

[0106] ;

[0107] In the formula, The overall risk score for the host computer; The total number of unique security events related to the host within a preset time period; For the first The basic risk weight of each independent security incident; is the base of the natural logarithm; This is a preset time decay constant that controls the rate at which the risk of an event decays over time. The larger the value, the faster the risk decays. This is the timestamp for calculating the current risk score; For the first The timestamp of each independent security incident; This represents the total number of associated event groups identified through association analysis rules. For the first The additional risk reward value generated by a group of related events. The magnitude of the association is defined by the rule that triggers it. For example, when a software communication event is associated with a violation of external connection rules, the resulting reward value will be significantly higher than that of an association of multiple low-risk events.

[0108] The third step in this process is to map the host's risk status to a predefined risk level based on the calculated comprehensive risk score. This mapping is achieved through a set of thresholds. For example, a risk score of 0 to 40 can be set to correspond to a "low risk" level, 41 to 70 to a "medium risk" level, 71 to 90 to a "high risk" level, and 91 points and above to a "critical" level. In this way, the system transforms the quantified risk score into a risk level that is easy for managers to understand and handle, providing a direct basis for subsequent alarm and response decisions.

[0109] Once the host's overall risk score is calculated using the risk quantification assessment model, the method of this invention proceeds to the final alarm generation and evidence consolidation step. This step is the final output of the entire detection process, designed to provide managers with clear and actionable risk warnings and preserve irrefutable original evidence.

[0110] The first step in this process is alarm triggering. The system presets one or more alarm thresholds, which correspond to the aforementioned risk levels. When a host's overall risk score consistently exceeds a certain threshold for a preset duration, or when its instantaneous value exceeds a higher critical threshold, the alarm generation process is automatically triggered. This mechanism ensures the timeliness and accuracy of alarms, avoiding false alarms caused by momentary fluctuations.

[0111] Once an alert is triggered, the second step is executed: the aggregation and generation of alert information. The system generates not an isolated event point, but a detailed alert report. This report compiles complete contextual information about the violating host in a structured format, specifically including: the host's static identity (internal IP address, MAC address); the final quantified risk score and corresponding risk level; a detailed list of all root cause events that triggered the alert, clearly showing details of each passively detected event (such as hit threat intelligence) and actively detected and confirmed events (such as the time and source of response capture); and a brief description of the entire chain of related events. This ensures that security administrators can immediately grasp the full picture of the event upon receiving an alert, eliminating the need for tedious data correlation work.

[0112] The third step, solidifying the chain of evidence, is executed concurrently with alarm generation. To ensure the traceability and non-repudiation of the event, the system automatically locates and extracts the original network data packets directly related to all root events that triggered the alarm. These data packets are saved in the standard PCAP file format and stored in association with the corresponding alarm reports. Each PCAP file contains complete data from the network layer to the application layer, constituting the most original and direct electronic evidence. In this way, this method not only issues alarms but also provides a complete and robust chain of electronic evidence for subsequent in-depth forensic analysis, security audits, or possible legal proceedings.

Claims

1. A method for detecting unauthorized external network connections, characterized in that, Includes the following steps: S1. Obtain and preprocess the real-time data traffic of the target monitoring network through a bypass method; S2. Passive detection is performed on the preprocessed traffic data based on feature matching to identify known illegal communication patterns; S3. Inject probe packets carrying unique source identifiers into internal network hosts, and actively probe based on the response capture results of external networks to discover unknown unauthorized external connection channels. S4. The output results of the associated active and passive detection processes are used to conduct a comprehensive analysis and risk assessment of the host's behavior. S5. Generate violation alerts based on risk assessment results and solidify relevant electronic evidence.

2. The method for detecting unauthorized external network connections according to claim 1, characterized in that, Step S1 specifically includes the following steps: Reassemble the data packets in the real-time data traffic into a network session; The network session is parsed to extract the session 5-tuple information, application layer protocol type, and key features.

3. The method for detecting unauthorized external network connections according to claim 1, characterized in that, The S3 step specifically includes the following steps: The communication behavior of the target monitoring network is self-learned to establish a baseline model of the internal network asset inventory and normal external communication. The detection targets were determined based on the aforementioned internal network asset inventory and baseline model; Generate a probe message containing a unique tracing identifier for the probe target; The detection message is injected into the detection target; By using a response capture mechanism deployed on an external network, the system monitors and verifies whether the probe message is received in order to confirm unauthorized external connection behavior.

4. The method for detecting unauthorized external network connections according to claim 1, characterized in that, The generation of the probe message carrying a unique tracing identifier specifically includes the following steps: The unique tracing identifier is generated through hash operation based on the IP address, MAC address, current timestamp, and random number of the target being detected. The unique tracing identifier is encapsulated as a payload in a multi-protocol message, and the probe message is disguised using an application layer protocol.

5. The method for detecting unauthorized external network connections according to claim 1, characterized in that, The S4 step specifically includes the following steps: Create and dynamically update behavioral profiles for hosts in the internal network, including static attributes, dynamic behavioral characteristics, and security event logs. Based on preset time windows and logical rules, correlation analysis is performed on multi-source security events in the behavioral profile; The host's overall risk score is calculated based on a risk quantification assessment model.

6. The method for detecting unauthorized external network connections according to claim 5, characterized in that, The host's comprehensive risk score is calculated based on a risk quantification assessment model, specifically through the following methods: Assign basic risk weights to different types of security incidents; The overall risk score is the sum of the risk values ​​of each independent security event related to the host, plus the sum of the additional risk reward values ​​generated by the associated event group; The risk value of the independent security event is the result of its basic risk weight calculated using a time decay function.

7. The method for detecting unauthorized external network connections according to claim 5, characterized in that, The logical rules include: The system associates passively detected events that occur on the same host within a preset time window and involve communication with a known command and control server with unauthorized external connection events confirmed by active detection to generate a composite alarm.

8. The method for detecting unauthorized external network connections according to claim 7, characterized in that, The passive detection based on feature matching specifically includes the following steps: The communication features extracted from the traffic data are matched in real time with a preset knowledge base consisting of a violation rule base and a threat intelligence base. A passive detection event is generated when the communication feature matches any item in the knowledge base.

9. The method for detecting unauthorized external network connections according to claim 1, characterized in that, The S5 step specifically includes the following steps: An alarm is triggered when the overall risk score of the host exceeds a preset alarm threshold; Aggregate all root cause event information related to the alarm to generate a structured alarm report; The original network data packets directly related to the root cause event are automatically extracted and saved as electronic evidence.

10. The method for detecting unauthorized external network connections according to claim 3, characterized in that, The injection of the detection message into the detection target is specifically achieved in the following manner: The probe message is constructed and sent using the network interface of the detection system in the form of a raw socket, wherein the destination IP address of the message is set to the IP address of the probe target.

Images