Enterprise-level remote office method combined with intelligent security mechanism

Abstract

This invention discloses an enterprise-level remote office method incorporating intelligent security mechanisms, belonging to the field of network security. The method includes: after completing two-factor authentication via a web browser, the user initiates a connection to a remote computer assigned by the administrator. A WebRTC connection is established, and the screen data of the controlled terminal is encoded into a video stream, which is then transmitted to the control terminal via P2P direct connection or a TURN server. The control terminal records keyboard and mouse operation commands in real time and stores them in a Redis database. The stored commands are scanned using an autoencoder detection model to identify malicious scripts. The commands are encrypted using AES-256 and transmitted to the controlled terminal via an RTC Data Channel or a TURN server. After the controlled terminal decrypts the commands, the RobotGo module parses and executes the operation. This invention significantly improves the security, management efficiency, and ease of use of remote office work.

Description

Technical Field

[0001] This invention belongs to the field of network security, specifically relating to an enterprise-level remote office method that incorporates intelligent security mechanisms. Background Technology

[0002] With the rapid development of the internet, the demand for remote work is also increasing. More internet companies need to dynamically allocate computers for remote work to their employees to adapt to changes in their work schedules and ensure the security of internal information resources. In traditional remote work platforms, employees access remote work by entering their login account and password for the corresponding remote computer. This means that employees can still access remote computers even after changing positions or leaving the company, making it impossible to dynamically allocate computers for remote work and creating risks such as information leaks. To improve the convenience of managing and allocating remote computers, the remote work platform needs to add administrator functions for managing remote computers.

[0003] Existing remote work platforms generally rely on client software, which leads to platform limitations, difficulty in unified management of remote devices, and vulnerabilities such as Windows Remote Desktop, which are susceptible to weak password attacks, resulting in poor security and limited applicability. Most platforms still use account and password logins, which can easily lead to information leaks when employees leave or change positions. Password management is complex and cumbersome, impacting efficiency. Furthermore, the lack of security checks on keyboard input and file uploads makes remote computers vulnerable to malicious control, posing security risks and financial losses to enterprises. Summary of the Invention

[0004] To address the shortcomings of the existing technologies, the present invention aims to provide an enterprise-level remote office method that incorporates intelligent security mechanisms. This method supports access via a browser on local area networks and the internet, eliminating the need for client installation and overcoming platform limitations. Simultaneously, it introduces intelligent security mechanisms to detect keyboard input and file upload activities, preventing backdoor programs and Trojan injection, thus comprehensively enhancing the security of remote work.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] The present invention provides an enterprise-level remote office method incorporating an intelligent security mechanism, comprising the following steps:

[0007] Step S1: Access the remote office platform through a web browser, perform two-factor authentication using account password and mobile phone verification code. After successful authentication, the platform confirms the user's identity and assigns roles accordingly. The control end selects and confirms the remote office computer to be controlled; the controlled end also receives the connection request in the platform and prepares to respond.

[0008] Step S2: The control terminal selects the remote office computer assigned by the administrator to the platform account for remote work. During the connection process, the control terminal and the controlled terminal ensure security through an authentication mechanism.

[0009] Step S3: The control end establishes a WebRTC connection with the controlled end. The screen interface data of the controlled end is encoded and compressed into a video stream and sent to the control end through P2P direct connection or TURN server.

[0010] Step S4: The control terminal records the user's keyboard and mouse operations in real time and stores the commands in the Redis database. The command data is scanned by an autoencoder-based detection model to identify malicious scripts and provide data support for manual review. Reviewers can view historical commands through Redis but do not participate in script detection.

[0011] Step S5: The control terminal encrypts the command using the AES-256 algorithm and transmits it to the controlled terminal via the RTC Data Channel or TURN server;

[0012] Step S6: The control terminal decrypts the received encrypted commands using AES-256 and then sends them to RobotGo for parsing and simulation of keyboard and mouse operations to achieve remote control.

[0013] Furthermore, the remote office platform in step S1 includes: a front-end interface of the controlled end and a back-end.

[0014] Furthermore, the enterprise-level remote office method is characterized in that, in step S1, the front-end interface of the controlled terminal is built using Vue3 and ElementPlus; the back-end is developed using Go language, and the Electron framework is used to realize the integration and interaction between the front-end and the back-end.

[0015] Furthermore, the two-factor authentication in step S1 uses an account password and a mobile phone verification code for identity authentication.

[0016] Furthermore, the account password and mobile verification code are used for identity verification. The account password is stored in the database using MD5 encryption, and the user's mobile phone number is stored using AES-256 encryption. Before requesting the mobile verification code, verification via image verification code is required. The mobile verification code is generated using cryptographically secure random numbers and stored in a Redis database. Storing it in Redis facilitates malicious script detection and provides convenience for manual review. To achieve efficient verification and security control of the verification code, the platform sends the mobile verification code through Tencent Cloud or Alibaba Cloud. The verification code is temporarily stored in Redis and deleted immediately after successful verification to ensure single-use validity. If five consecutive incorrect entries are made, a 30-minute account cooldown will be triggered, during which the user can log in to the remote office platform only after both the account password and mobile verification code are correct.

[0017] Furthermore, the initialization process for the controlled terminal to prepare a response in step S1 includes:

[0018] When the remote computer runs the controlled application, the controlled computer collects hardware fingerprints to generate device IDs and connection codes.

[0019] Furthermore, the controlled device periodically sends status packets to the device ID registration server to update its network status information.

[0020] Further, step S2 includes:

[0021] Administrators assign remote office computer device IDs to user accounts through management accounts on the control panel, and users select the remote office computer assigned by the administrator on the control panel to work remotely.

[0022] Furthermore, the control terminal queries the registration server for the identity information of the remote office computer device ID, and initiates a connection to the controlled terminal based on the identity information.

[0023] Furthermore, the specific implementation process of step S3 is as follows:

[0024] Step 3-1: The control end creates a PeerConnection object and generates an Offer SDP after querying the network status information of the controlled end's device ID from the device ID registration server. Then, it sends the Offer SDP to the controlled end through the WebSocket signaling server. After receiving the Offer SDP, the controlled end creates a PeerConnection and generates an Answer SDP. The two parties exchange ICE Candidates through the WebSocket signaling server.

[0025] Step 3-2: After the control end and the controlled end obtain each other's network information, if they are on the same local area network, they communicate directly through a P2P connection; if they are on different local area networks or there is a firewall configuration, the platform first achieves intranet penetration through the STUN server; if STUN penetration fails, the platform automatically switches to the TURN server as a data relay station according to the network status information, and uses TLS-encrypted TCP streams for data transmission, thereby ensuring secure and reliable communication between the control end and the controlled end.

[0026] Step 3-3: Configure the STUN / TURN server on the WebSocket signaling server. The WebSocket signaling server uses the ICE protocol to automatically select the optimal connection path, giving priority to P2P direct connection. If the connection fails, it will be downgraded to TURN relay, thus enabling communication between the control end and the controlled end on the Internet.

[0027] Steps 3-4: After establishing real-time data communication between the control end and the controlled end, the controlled end obtains the screen interface data of the controlled device and stores the data in a buffer. The controlled end encodes and compresses the screen interface data in the buffer to obtain video stream data. When the control end and the controlled end are directly connected via UDP, the video stream will be transmitted in real-time via RTP and RTCP working together on UDP. When the control end and the controlled end communicate using a TURN relay server, TCP packets are used to transmit video stream data.

[0028] Steps 3-5: After receiving and parsing the video stream data, the control terminal displays the video stream on the remote control page of the controlled terminal. Users can remotely control the controlled terminal as needed through the interface, realizing interaction between the control terminal and the controlled terminal.

[0029] Furthermore, in step S4, the automatic encoder is used to perform anomaly detection on uploaded files and instructions entered within a specified period. The specific implementation process is as follows:

[0030] Step 4-1: First, collect and organize known backdoor and Trojan virus data, and process this data as a dataset. Then, preprocess the dataset, including data cleaning, data standardization, feature engineering, and data partitioning;

[0031] Step 4-2: Construct an autoencoder model that combines a gated recurrent unit and multi-head attention. This model includes an encoder, a decoder, an activation function, and a loss function, and introduces a gated recurrent unit and an attention mechanism. This model is used to extract and reconstruct data features.

[0032] Step 4-3: During model training, the improved Adam optimizer—RAdam—is used to update parameters. During training, the relative loss change reaches a preset threshold as the stopping condition.

[0033] Step 4-4: Employ error distribution modeling and a dynamic threshold mechanism to automatically adjust the threshold based on the error distribution during training;

[0034] Steps 4-5: During data detection, the input data is standardized and noise-reducing preprocessed. The sample reconstruction error is calculated based on the reconstruction model. Finally, the abnormal state of the data is determined according to the set dynamic threshold, thereby completing the security detection.

[0035] Further, step S5 includes:

[0036] After the control end and the controlled end establish a connection, keyboard and mouse operation commands are captured in real time through window event listeners;

[0037] The instructions are stored in plaintext in the backend database;

[0038] The instructions are encrypted using the AES-256 encryption algorithm.

[0039] Encrypted commands are transmitted to the controlled terminal via the RTC Data Channel or TURN server relay channel.

[0040] Further, step S6 includes:

[0041] Accept the encryption command and perform AES-256 decryption using the session-negotiated key;

[0042] Input the decrypted plaintext commands into the RobotGo module;

[0043] The module parses instructions and drives the controlled terminal to perform keyboard / mouse operations.

[0044] Furthermore, in step S6, the RobotGo module is a cross-platform Go language automation library that can simulate keyboard and mouse operations on Windows, macOS, and Linux.

[0045] Compared with the prior art, the advantages of the present invention are as follows:

[0046] (1) This invention provides an enterprise-level remote office method that controls remote computer access through office platform account authorization, avoids exposing the control terminal account password, realizes centralized management and secure access of remote devices, and improves operation and maintenance efficiency and security.

[0047] (2) Based on WebRTC and other technologies, this invention realizes the browser remote control function without downloading a client, which improves the convenience of remote office work.

[0048] (3) The present invention introduces a malicious script detection method based on an autoencoder to achieve security monitoring of keyboard input and file upload, enhance internal protection capabilities, and improve the security of remote computers. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart of the method of the present invention;

[0051] Figure 2 This is a flowchart illustrating the identity verification process of the method of the present invention.

[0052] Figure 3 This is a flowchart illustrating the WebRTC connection establishment and video stream transmission process in the method of this invention.

[0053] Figure 4 This is a structural diagram of the automatic encoder anomaly detection model in the method of the present invention;

[0054] Figure 5 This diagram illustrates the keyboard and mouse command processing and encrypted transmission in the method of this invention. Detailed Implementation

[0055] To facilitate understanding by those skilled in the art, the present invention will be further described below in conjunction with embodiments and accompanying drawings. The content mentioned in the embodiments is not intended to limit the present invention.

[0056] like Figure 1 As shown, the present invention provides an enterprise-level remote office method incorporating an intelligent security mechanism, comprising the following steps:

[0057] Step S1: Access the remote office platform through a web browser, perform two-factor authentication using account password and mobile phone verification code. After successful authentication, the platform confirms the user's identity and assigns roles accordingly. The control end selects and confirms the remote office computer to be controlled; the controlled end also receives the connection request in the platform and prepares to respond.

[0058] The remote office platform in step S1 includes a front-end interface and a back-end for the controlled device. The front-end interface is built using Vue3 and ElementPlus, while the back-end uses the Gin framework. Gin is a high-performance, lightweight Go language web framework suitable for building efficient web applications and RESTful APIs. Integration and interaction between the front-end and back-end are achieved through the Electron framework to ensure a cross-platform desktop application experience.

[0059] like Figure 2 As shown, the two-factor authentication in step 1 uses an account password and a mobile phone verification code for identity authentication.

[0060] The account password is stored in the database using MD5 encryption, and the user's mobile phone number is stored using AES-256 encryption. Before requesting to send a mobile verification code, it needs to be verified by an image verification code to prevent the platform from being bombarded with verification code requests. The mobile verification code is generated using cryptographically secure random numbers and stored in the Redis database for short-term storage and fast retrieval during verification. Mobile sending needs to be integrated with cloud providers such as Tencent Cloud / Alibaba Cloud. After the user enters the mobile verification code, if the verification is successful, the Redis record is immediately deleted to ensure single-use validity. At the same time, five consecutive incorrect verifications trigger a 30-minute account cooldown. After the account password and mobile verification code are entered correctly, the user is allowed to access the remote office platform.

[0061] Step S2: The control terminal selects the remote office computer assigned by the administrator to the platform account for remote work. During the connection process, the control terminal and the controlled terminal ensure security through an authentication mechanism.

[0062] In step S2, after the remote computer runs the controlled application, the controlled computer collects the MAC address, CPU ID, and disk serial number, hashes and encrypts them to generate a unique identification code device ID and a corresponding encrypted session token as a connection code. Then, the controlled computer periodically sends status packets to the device ID registration server to update its network status information, including the public IP address and port number, NAT type, recommended relay data forwarding server, and connection code. The specific process is as follows:

[0063] The controlled device sends a request to the STUN server, which returns the controlled device's public IP address and port number (IP:Port), as well as the NAT type. The relay data forwarding server is manually configured by the administrator. The controlled device then sends the public IP address and port number, NAT type, recommended relay data forwarding server, and connection code to the device ID registration server. The device ID registration server stores the device ID of each remote computer and its corresponding network status information, including the public IP address and port number, NAT type, recommended relay data forwarding server, and connection code, in a database. When the controlling device enters a unique device ID, the platform queries the database for the device's network status information. After obtaining the network status information, the controlling device negotiates with the controlled device via the WebSocket signaling server to establish data communication using either a direct UDP connection via the STUN server or a TURN relay server. Therefore, the administrator only needs to modify the accessible device IDs in the user information to control user access permissions to remote computers.

[0064] like Figure 3 As shown, in step S3: the remote office platform control terminal establishes a WebRTC connection with the controlled terminal, and the screen interface data of the controlled terminal is encoded and compressed into a video stream and sent to the control terminal through P2P direct connection or TURN server.

[0065] The specific implementation process of step S3 is as follows:

[0066] Step 3-1: The control end queries the network status information of the controlled end's device ID from the device ID registration server, creates a PeerConnection object, generates an Offer SDP, and then sends the Offer SDP to the controlled end via the WebSocket signaling server. Upon receiving the Offer SDP, the controlled end creates a PeerConnection and generates an Answer SDP. Both parties exchange ICE Candidates via the WebSocket signaling server.

[0067] Step 3-2: After the control end and the controlled end obtain each other's network information, if they are on the same local area network (LAN), the platform can directly establish a P2P connection for communication. If they are on different LANs or have firewall configurations, the platform first attempts to achieve intranet penetration through a STUN server. If STUN penetration fails and encounters symmetric NAT or a strict firewall, the platform will automatically switch to a designated TURN server as a data relay station based on network status information. Data will be relayed through the Pion TURN server. Pion TURN is a toolkit for building TURN clients and servers in Go, ensuring communication is conducted through TLS-encrypted TCP streams to be compatible with firewall restrictions, ultimately achieving secure and reliable data communication between the control end and the controlled end.

[0068] Step 3-3: Configure the STUN / TURN server on the WebSocket signaling server. The WebSocket signaling server uses the ICE protocol to automatically select the optimal connection path, giving priority to P2P direct connection. If the connection fails, it will be downgraded to TURN relay, thus enabling communication between the control end and the controlled end on the Internet.

[0069] Steps 3-4: After establishing real-time data communication between the control end and the controlled end, the controlled end obtains the screen interface data of the controlled device and stores the data in a buffer. The controlled end encodes and compresses the screen interface data in the buffer, such as H.264 / H.265 encoding, to obtain video stream data. When the control end and the controlled end are directly connected via UDP, the video stream will be transmitted in real-time via RTP and RTCP working together on UDP. When the control end and the controlled end communicate using a TURN relay server, TCP packets are used to transmit video stream data.

[0070] Steps 3-5: After receiving and parsing the video stream data, the control terminal displays the video stream on the remote control page of the controlled terminal. Users can remotely control the controlled terminal as needed through the interface, realizing interaction between the control terminal and the controlled terminal.

[0071] Step S4: The control terminal records the user's keyboard and mouse operations in real time and stores the commands in the Redis database. The command data is scanned by an autoencoder-based detection model to identify malicious scripts and provide data support for manual review. Reviewers can view historical commands through Redis but do not participate in script detection.

[0072] like Figure 4 As shown, in step S4, the automatic encoder is used to perform anomaly detection on uploaded files and instructions entered within a specified period. The specific implementation process is as follows:

[0073] Step 4-1: First, collect and organize known backdoor and Trojan virus data, and process this data as a dataset. Then, preprocess the dataset, including data cleaning, data standardization, feature engineering, and data partitioning;

[0074] The text cleaning process includes two steps: First, the text in the original text is cleaned and cleaned. Convert to lowercase letters to generate the cleaned text. :

[0075]

[0076] Secondly, special characters in the text are removed and spaces are standardized by replacing consecutive spaces with single spaces, resulting in the standardized text. :

[0077]

[0078] The data standardization process described above used the TF-IDF algorithm for vectorization. In term frequency calculation, TF (term frequency) is defined as the transmission rate of a word w in document d. Total number of words in document d The ratio, specifically expressed mathematically, is as follows:

[0079]

[0080] Inverse document frequency (IDF) is used to measure the importance of a word in the entire corpus, and its calculation formula is as follows:

[0081]

[0082] in, The inverse document frequency of word w; N is the total number of all words in the corpus; The number of documents containing the word w. The rarity of a word within the entire corpus can be assessed by calculating the IDF (Index Difference of Fragmentation).

[0083] TF-IDF is a weighted method used in text mining and information retrieval to evaluate the importance of a word in a document set. It combines TF and IDF, weighting words by multiplying TF and IDF. The specific formula is:

[0084]

[0085] The TF-IDF value represents the TF-IDF value of word w in document d, used to measure the importance of a word in that document. TF represents the frequency of word w in the document, while IDF reflects the rarity of word w in the entire document set. By multiplying the two, TF-IDF can highlight words that appear frequently in a specific document but are relatively rare in the document set, thus helping to identify keywords in the document.

[0086] A document vector is a vector formed by using the TF-IDF of each word in a document as its elements. The specific representation of a document vector is as follows:

[0087]

[0088] in, The vector corresponding to d is a vector with dimensions equal to the size of the vocabulary. , , , This refers to the first to the nth word in the entire vocabulary.

[0089] Document vectors are typically constructed by calculating the TF-IDF values ​​of words, but the N-gram method is also widely used when processing certain text features. N-grams segment text into fixed-length sequences of characters or words. For example, for character-level 3-grams, we can extract all substrings of length 3 from the text, specifically represented as:

[0090]

[0091] Then, a frequency vector is constructed by calculating the frequencies of the 3-gram:

[0092]

[0093] in, , , , Indicates possible 3-gram strings; Represents 3-gram The frequency of occurrences in the text. In this way, not only can vocabulary-based document vectors be created, but also local features in the text can be extracted based on the N-Gram method and represented by frequency vectors, thus providing a more dimensional representation for text classification and similarity calculation.

[0094] The feature reduction process described is achieved through principal component analysis, and the specific steps are as follows:

[0095] The formula for PCA projection is:

[0096]

[0097] Where W is a dimension of The PCA projection matrix has a value of k that is much smaller than d. In this process, This represents the feature vector after dimensionality reduction, with dimension . x is the original high-dimensional feature vector with dimension . W is the PCA projection matrix, while W' is the linear transformation matrix used to compress the original high-dimensional data from d dimensions to k dimensions. This process reduces the dimensionality of the data through linear transformation while retaining the most important information in the data.

[0098] The normalization process uses the Min-Max scaling method, and its formula is:

[0099]

[0100] in, Represents the normalized eigenvectors; This represents the training dataset; This represents the minimum value of a feature in the training set; This represents the maximum value of the feature in the training set.

[0101] Step 4-2: Construct an autoencoder model that combines a gated recurrent unit and multi-head attention. This model includes an encoder, a decoder, an activation function, and a loss function, and introduces a gated recurrent unit and an attention mechanism. This model is used to extract and reconstruct data features.

[0102] The encoder's function is to map the input feature x to a low-dimensional representation z, which is accomplished through two layers of nonlinear transformation. The specific steps are as follows:

[0103] First, the encoder progressively encodes the input feature x using a gated recurrent unit. After linear projection and biasing, the input feature is activated by gated ReLU to generate the first hidden state. :

[0104]

[0105] in, The function is defined as:

[0106]

[0107] in, This represents element-wise multiplication; express The weight matrix, which is the matrix parameter connecting the input layer to the first hidden layer; express The bias vector is the bias parameter added to the result of the linear transformation; for Learnable gate parameters; It is a pre-activation value; For gating input; Sigmoid gate; For standard function.

[0108] then, The second hidden state is obtained through the second layer of gating transformation. :

[0109]

[0110] in, express The weight matrix, which is the matrix parameter connecting the input layer to the second hidden layer; express Bias vector; for Learnable gate parameters;

[0111] at last, The encoded low-dimensional representation z is obtained through linear transformation:

[0112]

[0113] in, The weight matrix represents the linear transformation of the encoder; express Bias vector;

[0114] The decoder section employs an attention-enhanced structure, dynamically focusing on potential anomalous features during reconstruction. First, attention weights are applied to the encoded representation z. Represented as:

[0115]

[0116] in, This is a historical encoded state matrix; The attention function is then used for upsampling via a two-layer gated feedforward network.

[0117]

[0118]

[0119] in, This represents the first hidden state in the decoder, which is the decoder's response to... Preliminary results of upsampling; Represented as The weight matrix; express Bias vector; for Learnable gate parameters; This represents the second hidden state in the decoder. A more refined reconstructed feature output is obtained after further upsampling; Represented as The weight matrix; express Bias vector; for Learnable gate parameters.

[0120] at last, The reconstructed output is generated through linear transformation and the Sigmoid activation function. :

[0121]

[0122] The Sigmoid activation function ensures that the output is in the range [0,1], thereby generating a reconstruction result with a structure similar to the original input x. ; Represented as The weight matrix; express Bias vector.

[0123] The loss function employs perceptual loss, optimizing the model by analyzing the differences in high-level features between the original input and the reconstructed output. This approach better captures complex patterns in text or instruction data, making it particularly suitable for anomaly detection. This method enhances the model's generative capabilities, especially in anomaly detection of file uploads and instruction streams, improving detection accuracy. The specific expression is as follows:

[0124]

[0125] in, Represents the input vector With reconstructed vector Perceptual loss between; This indicates the extraction of features through a pre-trained network; and These are the original input and the reconstructed output, respectively. The squared loss function represents the L2 norm.

[0126] Step 4-3: During model training, an improved Adam optimizer—RAdam (Rectified Adam)—is used. RAdam ensures stability in the early stages of training by adjusting the learning rate, thereby helping the model converge better, and is especially suitable for complex anomaly detection tasks.

[0127] The RAdam optimizer updates its parameters and uses a preset threshold as a stopping condition during training when the relative loss changes.

[0128] The optimization process described above can be expressed mathematically as follows:

[0129]

[0130] in, represents the training parameters of the model; m represents the total number of training samples. This represents the i-th input sample; Indicates the encoder's response to the sample The reconstruction output; The mean squared error loss function is used. This indicates the search for an optimal set of model parameters. This minimizes the mean squared error loss.

[0131] RAdam optimizer update:

[0132]

[0133]

[0134]

[0135]

[0136]

[0137] in, This represents the first moment estimate at the current time step; This represents the first moment estimate of the previous time step; The current gradient; This represents the decay rate controlling the first-order moment estimation; This represents the second moment estimate at the current time step; This represents the second moment estimate of the previous time step; This represents the decay rate controlling the second-order moment estimation; This represents the first-order estimate after correcting for the bias. This represents the second-order estimate after correcting for the bias. Indicates the current time step; This represents the first moment estimate of the decay rate. Power of; The learning rate; The second moment is used to estimate the decay rate. Power of; This indicates the actual step size for parameter updates; This represents a hyperparameter that controls the rate of time decay. This is to prevent small constants from being divided by zero; This indicates the updated parameter value; This indicates the parameter value before the update.

[0138] The preset threshold, used as a training termination condition, can be mathematically expressed as follows:

[0139]

[0140] in, This represents the loss value for the current round; This represents the loss value from the previous round; The threshold value is set.

[0141] Step 4-4: Employ error distribution modeling and a dynamic threshold mechanism to automatically adjust the threshold based on the error distribution during training;

[0142] The error distribution modeling process described above calculates the validation set error, and its mathematical expression is as follows:

[0143]

[0144] in, For the i-th sample in the validation set; This is the output for the i-th sample in the corresponding model; Loss for a single sample; Represents the set of errors over the entire validation set; The number of samples in the validation set.

[0145] The statistics included are the mean. and standard deviation The mathematical expressions for each are:

[0146] ;

[0147] ;

[0148] Steps 4-5: During data detection, the input data is standardized and noise-reducing preprocessed. The sample reconstruction error is calculated based on the reconstruction model. Finally, the abnormal state of the data is determined according to the set dynamic threshold, thereby completing the security detection.

[0149] The detection process consists of three parts: preprocessing, reconstruction error calculation, and judgment, and its specific mathematical expression is as follows:

[0150] (1) Data preprocessing: The test text vector After cleaning and calculating TF-IDF features, PCA is used for dimensionality reduction to obtain the preprocessed vector:

[0151] ;

[0152] Among them, PCA This represents the principal component analysis function; This represents a text cleaning function; This represents the original test text.

[0153] (2) Reconstruction process: The test sample is passed through the encoder and decoder After processing, the reconstructed text vector is obtained. :

[0154]

[0155] This process transforms the original data into a low-dimensional representation and then regenerates the original approximate reconstruction.

[0156] (3) Calculate the reconstruction error: Reconstruction error The calculation formula is:

[0157]

[0158] in, The error of the test sample is represented, reflecting the difference between the original data and the reconstructed data; D represents the total length of the feature vector. Indicates the test sample at the 1st The true value of the dimension; Indicates the test sample at the 1st The reconstruction value of the dimension.

[0159] (4) Identifying Malicious Samples: Malicious samples are identified based on the magnitude of the reconstruction error.

[0160] ;

[0161] in, This indicates the result of the malicious sample assessment. If the reconstruction error exceeds a preset threshold... If the condition is met, the sample is considered malicious; otherwise, the text is considered normal.

[0162] like Figure 5As shown, in step S5: the control terminal encrypts the instruction using the AES-256 algorithm and then transmits it to the controlled terminal via the RTC DataChannel or TURN server;

[0163] like Figure 5 As shown, in step S6: the control terminal decrypts the received encrypted instructions using AES-256, and then sends them to RobotGo for parsing and simulation of keyboard and mouse operations to achieve remote control.

[0164] The control frontend is developed based on the Vue3 framework. After the control frontend and the controlled terminal establish a connection, keyboard and mouse commands can be captured in real time through Vue3's window event listening function, and these commands are sent to the control backend. The backend stores the commands in plaintext in a Redis database, encrypts them using the AES-256 encryption algorithm, and transmits them through WebRTC's RTC Data Channel. The RTC Data Channel is an important channel in WebRTC for the direct transmission of arbitrary data between browsers. Based on the SCTP protocol, it provides both the reliability and ordering of TCP and supports the low-latency transmission of UDP. When the P2P connection fails, it automatically switches to a TURN server for relay forwarding, reliably transmitting the encrypted commands to the controlled terminal.

[0165] After receiving encrypted commands from the controlling end, the controlled device decrypts the commands using the AES-256 decryption algorithm based on the key negotiated during the connection establishment phase, obtaining the corresponding plaintext control commands. These plaintext commands are then processed by the RobotGo module on the controlled device's backend. The RobotGo module is a cross-platform Go language automation control library capable of simulating keyboard input and mouse operations on Windows, macOS, and Linux. Through this module, the controlled device can accurately execute operation commands issued by the controlling end, achieving a complete replication of keyboard input, mouse clicks, movement, scrolling, and other operations on the target computer during remote control, thus achieving secure, efficient, and seamless remote control. This process requires no additional plugins, improving cross-platform compatibility and ease of use.

[0166] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An enterprise-level remote office method incorporating intelligent security mechanisms, characterized in that, Includes the following steps: Step S1: The user accesses the remote office platform through a web browser and performs two-factor authentication. After successful authentication, the platform confirms the user's identity and assigns roles accordingly. The control end selects and confirms the remote office computer to be controlled. The controlled end receives the connection request in the platform and prepares to respond. Step S2: The control terminal selects the remote office computer assigned by the administrator to the user account for remote work. During the connection process, the control terminal and the controlled terminal ensure security through an authentication mechanism. Step S3: The control end establishes a WebRTC connection with the controlled end. The screen interface data of the controlled end is encoded and compressed into a video stream and sent to the control end through P2P direct connection or TURN server. Step S4: The control terminal records the user's keyboard and mouse operations in real time and stores the commands in the Redis database. The command data is scanned by an autoencoder-based detection model to identify malicious scripts and provide data support for manual review. Reviewers can view historical commands through Redis but do not participate in script detection. Step S5: The control terminal encrypts the command using the AES-256 algorithm and transmits it to the controlled terminal via the RTC Data Channel or TURN server; Step S6: The control terminal decrypts the received encrypted commands using AES-256 and then sends them to RobotGo for parsing and simulation of keyboard and mouse operations to achieve remote control.

2. The enterprise-level remote office method according to claim 1, characterized in that, In step S1, the remote office platform includes: a front-end interface and a back-end of the controlled terminal; the front-end interface of the controlled terminal is built using Vue3 and ElementPlus; the back-end is developed using Go language and uses the Electron framework to realize the integration and interaction between the front-end and the back-end.

3. The enterprise-level remote office method according to claim 1, characterized in that, In step S1, after the controlled terminal runs, it generates a device ID and connection code, and periodically reports its status to the registration server and updates network information.

4. The enterprise-level remote office method according to claim 1, characterized in that, In step S2, the administrator assigns a remote office computer device ID to the user account through the management account on the control terminal. The user selects the remote office computer assigned by the administrator on the control terminal to work remotely. The control terminal queries the registration server for the identity information of the remote office computer device ID and initiates a connection to the controlled terminal based on the identity information.

5. The enterprise-level remote office method according to claim 1, characterized in that, The specific implementation process of step S3 is as follows: Step 3-1: The control end creates a PeerConnection object and generates an Offer SDP after querying the network status information of the controlled end's device ID from the device ID registration server. Then, it sends the Offer SDP to the controlled end through the WebSocket signaling server. After receiving the Offer SDP, the controlled end creates a PeerConnection and generates an Answer SDP. The two parties exchange ICE Candidates through the WebSocket signaling server. Step 3-2: After the control end and the controlled end obtain each other's network information, if they are on the same local area network, they communicate directly through a P2P connection; if they are on different local area networks or there is a firewall configuration, the platform first achieves intranet penetration through the STUN server; if STUN penetration fails, the platform automatically switches to the TURN server as a data relay station according to the network status information, and uses TLS-encrypted TCP streams for data transmission, thereby ensuring secure and reliable communication between the control end and the controlled end. Step 3-3: Configure the STUN / TURN server on the WebSocket signaling server. The WebSocket signaling server uses the ICE protocol to automatically select the optimal connection path, giving priority to P2P direct connection. If the connection fails, it will be downgraded to TURN relay, so as to realize the communication between the control end and the controlled end on the Internet. Steps 3-4: After establishing real-time data communication between the control end and the controlled end, the controlled end obtains the screen interface data of the controlled device and stores the data in a buffer. The controlled end encodes and compresses the screen interface data in the buffer to obtain video stream data. When the control end and the controlled end are directly connected via UDP, the video stream will be transmitted in real-time via RTP and RTCP working together on UDP. When the control end and the controlled end communicate using a TURN relay server, TCP packets are used to transmit video stream data. Steps 3-5: After receiving and parsing the video stream data, the control terminal displays the video stream on the remote control page of the controlled terminal. Users can remotely control the controlled terminal as needed through the interface, realizing interaction between the control terminal and the controlled terminal.

6. The enterprise-level remote office method according to claim 1, characterized in that, In step S4, the automatic encoder is used to perform anomaly detection on uploaded files and instructions entered within a specified period. The specific implementation process is as follows: Step 4-1: First, collect and organize known backdoor and Trojan virus data and process it as a dataset; then, preprocess the dataset, including data cleaning, data standardization, feature engineering, and data partitioning. Step 4-2: Construct an autoencoder model that combines a gated recurrent unit and multi-head attention. This model includes an encoder, a decoder, an activation function, and a loss function, and introduces a gated recurrent unit and an attention mechanism. This model is used to extract and reconstruct data features. Step 4-3: During model training, the improved Adam optimizer—RAdam—is used to update parameters. During training, the relative loss change reaches a preset threshold as the stopping condition. Step 4-4: Employ error distribution modeling and a dynamic threshold mechanism to automatically adjust the threshold based on the error distribution during training; Steps 4-5: During data detection, the input data is standardized and noise-reducing preprocessed. The sample reconstruction error is calculated based on the reconstruction model. Finally, the abnormal state of the data is determined according to the set dynamic threshold, thereby completing the security detection.

7. The enterprise-level remote office method according to claim 1, characterized in that, Step S5 includes: after the control terminal and the controlled terminal establish a connection, capturing keyboard and mouse operation commands in real time through window event listening; storing the commands in plaintext in the backend database; encrypting the commands using the AES-256 encryption algorithm; and transmitting the encrypted commands to the controlled terminal through the RTC Data Channel or TURN server relay channel.

8. The enterprise-level remote office method according to claim 1, characterized in that, Step S6 includes: accepting the encryption command and performing AES-256 decryption using the session negotiation key; inputting the decrypted plaintext command into the RobotGo module; and parsing the command through the RobotGo module and driving the controlled terminal to perform keyboard / mouse operations.

9. The enterprise-level remote office method according to claim 8, characterized in that, In step S6, the RobotGo module is a cross-platform Go language automation library that can simulate keyboard and mouse operations on Windows, macOS, and Linux.

Images