Agentless violation outreach dual-domain fingerprinting method and system

Abstract

The application relates to the technical field of network security, and discloses a proxy-free illegal external connection double-domain fingerprint positioning method and system. The method establishes a time-versioned internal network asset fingerprint according to active scanning, passive traffic, address allocation, domain name resolution and access topology on the internal network side, and establishes an external access fingerprint with observable states according to external connection alarms on the Internet side; the double-domain fingerprints are time-aligned and candidate assets are screened, and the characteristics are maintained, the predictable transformation is determined, the intermediate node is regenerated or the path is invisible in the state of direct connection, network address conversion, proxy forwarding and mobile hotspots; the support evidence, conflict evidence and multi-window consistent relationship are fused to obtain the joint confidence of the candidate assets and the external connection path, and the real internal network assets, the network address at the alarm time and the access position are output; when the evidence is insufficient, the proxy-free review is executed and the fingerprint is updated. The application is suitable for illegal external connection positioning of printers, cameras and Internet of Things terminals.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring and network asset identification technology, specifically to a method and system for locating unauthorized external connections without agents using dual-domain fingerprinting. Background Technology

[0002] Controlled intranets typically monitor unauthorized internet access through endpoint agents, network boundary devices, and external alarm platforms. Printers, cameras, and some IoT terminals, due to limitations in their operating environment, computing power, or administrative privileges, find it difficult to install and continuously run agent programs. Internet-side external alarms typically only reflect the public network source address, access target, and session characteristics; they cannot directly determine the identity and access location of the intranet asset initiating the access.

[0003] Existing agentless asset identification technologies can establish intranet asset records using active scanning, passive traffic, address leases, domain name resolution, and access topology. However, these records are primarily applicable to intranet observation. When intranet assets access the internet via privately configured gateways, network address translation devices, proxy nodes, mobile hotspots, or portable Wi-Fi, the source address, source port, and protocol stack characteristics may be transformed, masked, or regenerated, resulting in a lack of a directly comparable unified identifier between intranet records and internet-side alarms. When multiple terminals share a public IP address or proxy exit, relying solely on the address and alarm time can easily generate multiple candidate assets.

[0004] Some association methods use time, access target, or single communication characteristics for matching, but there may be clock offsets between internal and external networks, and the visible range of fields may also differ at different collection locations. If the differences between missing data collection, invisible paths, and actual feature conflicts are not distinguished, or if address translation port behavior and proxy two-segment session relationships are not considered, intermediate node characteristics can easily be mistaken for terminal characteristics, making it difficult to form verifiable asset location results under conditions of multi-level forwarding and multiple terminals sharing an exit. Summary of the Invention

[0005] The technical problem this invention aims to solve is that existing monitoring of unauthorized external connections relies on single-point observation of terminal proxy programs or network boundaries, which is difficult to cover printers, cameras, and IoT terminals that cannot install proxy programs. When internal network assets access the Internet through privately set gateways, network address translation devices, proxy nodes, mobile hotspots, or portable WiFi, the address, port, time to live, and handshake characteristics are converted, obscured, or regenerated. There is a lack of a directly usable unified asset identifier between internal network asset records and Internet-side external connection alarms. Furthermore, the lack of data collection, the invisibility of the path, and the conflict with the real characteristics make it easy to confuse them. Therefore, it is difficult to restore the real internal network assets, access locations, and corresponding external connection paths at the time of the alarm.

[0006] To address the aforementioned technical problems, this invention provides a method for locating unauthorized external connections using a dual-domain fingerprint. This method is executed by an associated location server, which aligns the internal network asset fingerprints formed by active scanning and passive traffic observation on the internal network side with the external access fingerprints formed by external connection alarms on the internet side. It establishes path transformation hypotheses for direct connections, network address translation, proxy forwarding, and mobile hotspots, transforming internal network observation characteristics to expected observation conditions on the internet side. Under the same observation conditions, it forms supporting and conflicting evidence, and determines the joint confidence of candidate assets and external connection paths by combining consistency relationships across time windows. When unique location is not possible, it supplements evidence through controlled verification without requiring the installation of a terminal client.

[0007] The agentless unauthorized external connection dual-domain fingerprint positioning method provided by the present invention includes steps S1 to S5.

[0008] Step S1: Obtain asset detection data, communication traffic data, address allocation data, and access topology data from the intranet side. Establish an identity chain for asset identity, network address, and access location according to the effective time. Extract protocol stack response, application interaction, and connection timing features from the chain. Use the identity chain as an index to generate a time-versioned intranet asset fingerprint.

[0009] Specifically, the associated location server obtains active scan responses and passive traffic records from internal network collection nodes, address lease records from the Dynamic Host Configuration Protocol (DHCP) service, query records from the Domain Name System (DNS), and access topology records from the switching device control interface, address forwarding table, or wireless controller. These records do not use the current network address as a long-term, immutable asset identifier. Instead, they are first converted into data objects with a unified time base based on the record's source and validity period, and then associated with the corresponding asset instance.

[0010] The identity chain consists of asset identification nodes, network interface nodes, address lease nodes, and access location nodes. Asset identification nodes represent asset management identifiers or stable identities formed through multiple observations; network interface nodes represent the wired or wireless interfaces used for communication by the asset; address lease nodes represent the occupancy relationship of network addresses on network interfaces during the corresponding lease period; and access location nodes represent the switch ports, wireless access points, virtual LANs, and network areas connected to the network interfaces during the corresponding period. Connections between nodes are configured with valid start and end times, thus enabling the recovery of valid network addresses and access locations based on the occurrence time of external alarms, rather than replacing historical states with the current network state at the time of query.

[0011] Furthermore, the internal network acquisition nodes write the stable identity relationship reflected by the Media Access Control address and its vendor prefix, Dynamic Host Configuration Protocol (DHCP) client identifier, and hostname into the asset identification node or network interface node, and write the Internet Protocol (IP) address into the address lease node with a lease validity period. When the network interface changes its address or access location, the validity period on the original node ends and a new address lease node or access location node is established. When the same asset has multiple network interfaces, or when the Media Access Control address changes randomly, an identity cluster is established based on the consistency of the DHCP client identifier, hostname, protocol stack response, application interaction, and access location in adjacent time windows, enabling multiple time-sensitive network identities to be traced back to the same asset instance.

[0012] Active scan responses and passive traffic records are converted into asset feature units. Each asset feature unit can be represented as F_k = (n_k, v_k, t_k, o_k, r_k, τ_k), where n_k represents the feature name, v_k represents the feature value or feature sequence, t_k represents the observation time, o_k represents the observation location, r_k represents the initial acquisition reliability in the range [0, 1], and τ_k represents a reliability decay time constant greater than zero. The initial acquisition reliability is determined based on the acquisition method, record completeness, and consistency of repeated observations; the reliability decay time constant is determined based on the feature category and its historical changes. The server determines whether a feature participates in association at the alarm time based on the observation time, the reliability decay time constant, and the explicit validity period of the feature; features that no longer participate in the current association are retained in the historical time version for backtracking.

[0013] The asset feature units are organized according to their formation mechanism into identity association features, protocol stack response features, application interaction features, and behavioral timing features. Protocol stack response features are inferred from active probe responses or passive message headers, including initial time-to-live (TTL) values ​​and hop count relationships, transmission control protocol windows, and option arrangement relationships. Application interaction features reflect how the asset uses domain names and network services, including domain name query relationships, JA3 fingerprint encrypted handshake fingerprints, and normalized User-Agent field identifiers. Behavioral timing features reflect the relative relationships between continuous communication activities, including the order of access targets, connection cycles, traffic burst profiles, and changes in internal source ports. These features are incorporated into subsequent path transformations on a mechanism-by-mechanism basis, rather than concatenating all fields into a fixed string that must be identical.

[0014] Step S2: Receive external alarm data from the Internet side, aggregate alarm records of the same access process to form an external access event, extract external access features from it and record the observable state of the features to generate an external access fingerprint.

[0015] Specifically, external alarm data can be provided by internet-side security monitoring platforms, threat detection devices, access auditing devices, or traffic analysis devices. The associated location server standardizes the time representation, address representation, protocol name, domain name, and application identifier in the alarms. Based on public network source identifiers, access targets, and temporal proximity, records belonging to the same connection or continuous access process are merged into external access events. During the merging process, references to the original alarms are retained, allowing the standardized external access fingerprints to be used for verification against the original alarm content.

[0016] External access fingerprints include the protocol stack responses, application interactions, and behavioral timing characteristics of external access events actually presented on the Internet side, while recording the observable state for each feature. The observable state is used to distinguish between valid observations, missing data collection, and path-invisible features. A valid observation indicates that the alarm collection location has the conditions to observe the feature and has already obtained the feature value; a missing data collection indicates that the collection location has the conditions to observe, but failed to obtain the feature value due to missing packets, session truncation, or parsing failure; a path-invisible feature indicates that the feature has been obscured by address translation, encryption encapsulation, proxy reconstruction, or other intermediate processing before reaching the alarm collection location. Missing data collection and path-invisible features are not pre-interpreted as conflicts with candidate assets.

[0017] Step S3: Time-align the internal network asset fingerprint and external access fingerprint, filter candidate assets based on the valid identity chain and asset communication status within the alarm period, and generate a candidate asset set with dual-domain comparable features.

[0018] Specifically, when the intranet and internet sides record a common reference communication event, a fixed time offset is determined by the difference in recording time of the reference communication event on both sides. When no common reference communication event exists, the time window of the external access event is moved within a preset offset range, and the correspondence between the access target sequence and the connection activity sequence on both sides is compared. The offset with the highest correspondence is determined as the candidate time offset, and the time calibration reliability is determined based on the difference between the highest correspondence and the correspondence of adjacent offset positions. When the time calibration reliability is low, the candidate retrieval window is expanded, but the weight of evidence relying solely on precise time coincidence is reduced.

[0019] The associated location server queries the identity chain according to the calibrated alarm time, retaining only assets with valid address leases or access relationships at that time. It then combines passive traffic, dynamic host configuration protocol activity, or the online status of access devices to determine whether the corresponding asset is ready to initiate communication. Assets recorded as offline by a single data collection source but lacking records from other sources are not directly deleted; only assets confirmed as offline by all independent data collection sources form offline conflict evidence. After completing the online condition screening, the server builds an index based on comparable features between the two domains, using index-matched assets as a candidate asset set. The index is organized according to a feature formation mechanism, allowing domain access relationships, encrypted handshake relationships, application identifier relationships, protocol stack response relationships, and connection timing relationships to separately recall candidate assets, and subsequently determining their eligibility for comparison based on path visibility.

[0020] Step S4: Establish path transformation hypotheses for candidate assets, such as direct connection, network address translation, proxy forwarding, or mobile hotspot. Convert the internal network asset fingerprint into the expected external fingerprint under the corresponding path and compare it with the external access fingerprint. Integrate feature support, feature conflict, and cross-time window consistency to obtain the joint confidence of candidate assets and path transformation hypotheses.

[0021] Specifically, each path transformation assumes the setting of feature state rules and candidate path parameters. The feature state rules categorize features into four states based on their formation location and change pattern after traversing the corresponding path: maintained state, predictable transformation state, intermediate node regeneration state, and path invisible state. The maintained state indicates that the feature is still generated by the original asset and can be observed on the internet side after traversing the corresponding path; the predictable transformation state indicates that the feature value changes, but the expected value can be obtained based on forwarding hop count, port mapping, or link latency; the intermediate node regeneration state indicates that the internet-side feature is generated when the proxy node or gateway re-establishes a connection and cannot be directly used as a terminal identity feature; the path invisible state indicates that the feature cannot traverse the corresponding path to reach the observation location on the internet side.

[0022] Let the intranet asset fingerprint of asset a at time t be FP_in(a,t), the path transformation assumption be h, and the corresponding candidate path parameter be Θ_h. FP_in(a,t) represents the versioned intranet asset fingerprint hit by time t; when time t falls within the valid period of version V_v, FP_in(a,t) and FP_in(a,V_v) of that version represent the same asset fingerprint state. The corresponding expected external fingerprint can be represented as:

[0023] FP_out^pre(a,h,t)=T_h[FP_in(a,t);Θ_h].

[0024] Here, T_h represents the path feature transformation. For features that preserve state, T_h retains the corresponding feature values ​​and their reliability; for features with predictable transformed states, T_h generates predicted values ​​and allowable deviation ranges based on candidate path parameters; for features that regenerate states at intermediate nodes, T_h does not copy the original asset features, but instead generates path evidence requirements for connecting inner and outer sessions; for features with invisible path states, T_h sets their comparison states to invalid. Therefore, FP_out^pre represents the expected external fingerprint obtained through path transformation, and is under the same observation conditions as the external access fingerprint actually obtained on the Internet side.

[0025] For direct connection paths, application interaction characteristics and behavioral timing characteristics remain generated by internal network assets, and protocol stack response characteristics can be predicted based on the forwarding hop count between the observed internal and external network locations. For network address translation (NAT) paths, internal network addresses and media access control addresses are not visible on the internet side, application interaction characteristics remain generated by internal network assets, and internal source ports are converted to predicted external source ports according to candidate port mapping rules. For proxy forwarding paths, the protocol stack response and handshake characteristics generated by the proxy node re-establishing the transmission connection and encrypted session are marked as intermediate node regenerated characteristics, and asset location is formed based on the session chain between the candidate asset and the proxy node's internal session and the proxy node's external session to the access target. For mobile hotspot paths, the allowable variation range of protocol stack response and connection timing is determined according to the forwarding hop count, port allocation, and link latency relationship of the hotspot device, and equivalence comparison of internal network address characteristics obscured by the hotspot is stopped.

[0026] Furthermore, for network address translation paths, the server pairs the inner connections of candidate assets with the outer connections of external access events according to the access target and connection time, forming the inner source port sequence Ports_in and the outer source port sequence Ports_out, respectively. The server establishes a port mapping function g_h based on the pairing position, port difference, and port increment relationship of adjacent connections, enabling g_h to express mapping relationships generated by port holding, fixed offset, sequential allocation, or segmented allocation. After obtaining the predicted outer source port sequence using g_h(Ports_in), it is compared with Ports_out for order consistency, and the same mapping relationship is verified to be reproducible in subsequent external access events. Random port allocation does not require equal port values, but rather relies on the statistical consistency of target correspondence, connection order, and allocation boundaries to form path evidence with lower discriminative power.

[0027] For proxy forwarding paths, the server obtains inner sessions from candidate assets to proxy nodes from intranet traffic and outer sessions from proxy nodes to access targets from external alarm data. Session matching edges are established based on the correspondence between access targets, the order of session start and end, duration, and changes in bidirectional communication activity. When multiple inner and outer sessions form candidate matches, the server checks whether the matching edges continuously appear during multiple access processes and excludes combinations that would cause an outer session to be simultaneously occupied by mutually exclusive inner sessions, forming a session chain sequentially connected by the asset identity chain, inner sessions, proxy nodes, outer sessions, and external access events. The shared protocol stack characteristics generated by the proxy node itself are not used as the primary basis for distinguishing multiple intranet assets sharing the same proxy node.

[0028] A feature comparison between the fingerprint to be compared and the externally accessed fingerprint forms an evidence unit. Each evidence unit records the candidate asset, external access event, path change hypothesis, observation time, data acquisition source, feature reliability, feature discriminativeness, and comparison status. Feature discriminativeness is determined based on the proportion of corresponding features appearing in valid assets within the same time period and their stability across time windows; common features that appear repeatedly in many assets have lower discriminativeness, while features that appear in fewer assets and remain stable across time windows have higher discriminativeness. Supporting evidence is formed when comparable features match; conflicting evidence is formed when comparable features do not match and the difference cannot be explained by candidate path parameters; no supporting or conflicting evidence is formed when features are missing from the data collection or the path is not visible.

[0029] Optionally, for candidate asset a, external access event e, and path change hypothesis h, the normalization measure of supporting evidence S is... + (a, e, h) and the normalization quantity of conflict evidence S - (a, e, h) are represented as follows:

[0030] S + (a, e, h) = [Σ_(k∈K)] + ) w_k^+·r_k·q_k·s_k] / [Σ_(k∈K + ) w_k^+·r_k·q_k+ε];

[0031] S - (a, e, h) = [Σ_(j∈K)] - ) w_j^-·r_j·c_j] / [Σ_(j∈K - ) w_j^-·r_j+ε].

[0032] Where K⁺ represents the feature set participating in the support judgment, and K⁻ represents the feature set forming the conflict judgment; w_k^+, q_k, s_k, w_j^-, and c_j are all dimensionless numbers in the range [0, 1], representing the discriminative power of the support feature, the path comparability coefficient, the similarity, the conflict weight, and the conflict degree, respectively; r_k and r_j represent the effective reliability of the corresponding support feature and conflict feature at the alarm time, respectively, with values ​​in the range [0, 1], and are determined based on the initial acquisition reliability, the reliability decay time constant, or the explicit effective period; ε is a positive number set to prevent the denominator from being zero. q_k of path-invisible features is zero, and missing features are not included in K. - ;K + or K - When the set is empty, the corresponding summation term is zero, and the corresponding normalization term is zero.

[0033] The server determines the multi-window consistency quantity M(a, e, h) based on the support relationships of repeated occurrences of the same candidate asset within consecutive or periodic time windows. Let W_e be the set of historical windows adjacent to or having the same periodic phase as external access event e, ρ_u be the data reliability of window u, and Rep_u(a, h) be 1 if a valid support relationship between candidate asset a and path transformation hypothesis h is repeatedly formed in window u, and 0 otherwise. Then:

[0034] M(a, e, h) = [Σ_(u∈W_e) ρ_u·Rep_u(a, h)] / [Σ_(u∈W_e) ρ_u+ε].

[0035] Where ρ_u takes values ​​in the range [0, 1]; M(a, e, h) is zero when W_e is an empty set. The server obtains the joint confidence C(a, e, h) according to the following formula:

[0036] C(a,e,h)=σ[α·S + (a, e, h) - β·S - (a, e, h) + γ·M (a, e, h)];

[0037] σ(x)=1 / [1+exp(-x)].

[0038] Where σ represents a logical function that maps the input to the range [0, 1], α, β, and γ are non-negative fusion coefficients, and α + β + γ > 0. The fusion coefficients are determined based on the ability of supporting evidence, conflicting evidence, and multi-window consistency in verified external events to distinguish correct location results, and can also be configured based on the record completeness of the acquisition environment. Joint confidence is compared within the range of combinations of candidate assets and path transformation assumptions, enabling the server to simultaneously provide real internal network assets and corresponding external paths, rather than fixing the path first and then performing asset matching.

[0039] Step S5: Determine the location result based on the joint confidence level and the confidence interval between candidate assets. When the unique location condition is met, output the real intranet asset, the network address at the time of the alarm, the access location, the corresponding external connection path, and the associated evidence chain. When the unique location condition is not met, generate an agentless review task for the candidate assets, update the intranet asset fingerprint based on the review data, and redetermine the location result.

[0040] Specifically, the server sorts the candidate assets and path transformation hypothesis combinations corresponding to the same external access event according to their joint confidence scores. The highest joint confidence score is denoted as C_1, and the second highest joint confidence score corresponding to different candidate assets is denoted as C_2. When C_1 reaches the localization threshold θ_loc, and C_1 - C_2 reaches the differentiation threshold θ_gap, a unique localization result is generated; if there is no second highest candidate corresponding to different assets, C_2 is set to zero. The localization threshold, differentiation threshold, and candidate retention threshold are all located in [0, 1], and the candidate retention threshold is not higher than the localization threshold. When the joint confidence score reaches the candidate retention threshold but does not meet the unique localization condition, the corresponding candidate asset and path transformation hypothesis are retained, and a review task is generated; when all joint confidence scores are lower than the candidate retention threshold, the fingerprint coverage is insufficient or the path is unknown, and the external access fingerprint is retained for reprocessing after subsequent fingerprint database updates.

[0041] The agentless verification task does not require the installation of a client on the candidate assets. The associated location server, based on the candidate asset type and existing evidence gaps, drives the internal network acquisition nodes to perform controlled-rate active probing, querying the address lease and access topology corresponding to the alarm time, refreshing the current access relationships, and obtaining communication activities generated by the candidate assets in subsequent observation windows. The verification task avoids requesting data that cannot be obtained from the corresponding observation location based on the path's invisibility state, and prioritizes supplementing features that can distinguish existing candidate assets. The verification data is written as a new asset feature unit with acquisition source, acquisition time, and validity period into the internal network asset fingerprint, and then candidate generation, path transformation, and evidence comparison are re-executed.

[0042] The associated evidence chain connects the original external alarm, external access event, time calibration record, candidate asset and its identity chain version, path transformation hypothesis, candidate path parameters, evidence unit, review record, and location result in the order of processing. Each normalized record retains a reference to the original collection record, the predicted value obtained from the path transformation retains the rule version and candidate path parameters used, and the joint confidence score retains the supporting evidence, conflicting evidence, and multi-window consistency relationships involved in the calculation. This allows for reverse lookup of the asset's identity source, the network address source at the time of the alarm, the access location source, and the basis for path judgment along the location result.

[0043] On the other hand, the present invention also provides a dual-domain fingerprint location system for unauthorized external connections without agents, including an internal network asset fingerprint generation module, an external access fingerprint generation module, a time alignment and candidate generation module, a path transformation and association calculation module, and a location output and verification module.

[0044] The intranet asset fingerprint generation module acquires asset detection data, communication traffic data, address allocation data, and access topology data from the intranet side, establishes an asset identity chain with a valid period, converts active scanning responses and passive traffic observations into asset feature units, and forms intranet asset fingerprints indexed by asset instances and time versions. The external access fingerprint generation module receives external connection alarm data from the internet side, merges records belonging to the same access process to form external access events, extracts external access features, and records their valid observation, missing data collection, or path-invisible states.

[0045] The time alignment and candidate generation module calculates the time offset of records collected from internal and external networks, restores the asset identity chain and communication status based on the calibrated alarm period, and forms a candidate asset set through dual-domain comparable feature indexing. The path transformation and association calculation module establishes path transformation hypotheses for candidate assets, forms expected external fingerprints according to feature state rules and candidate path parameters, generates supporting evidence, conflicting evidence, and multi-window consistency relationships, and calculates the joint confidence of candidate assets and path transformation hypotheses. The location output and verification module generates unique location results, candidate asset results, or insufficient fingerprint coverage results based on the joint confidence and the confidence interval between candidate assets, establishes an associated evidence chain, and generates a proxyless verification task when unique location is not possible.

[0046] Furthermore, the system includes an intranet acquisition node set up in the controlled intranet, an alarm access node connected to the external alarm system on the internet side, an association and location server carrying the functional modules, and a verification interface connected to the network management device. The intranet acquisition node obtains passive traffic through a traffic mirroring link, performs controlled active scanning through an asset detection link, and obtains address leases, domain name resolutions, and access topologies from intranet basic services and network management devices. The alarm access node converts internet-side external alarms into standardized alarm records and sends them to the external access fingerprint generation module. The association and location server completes dual-domain association through fingerprint records, time windows, and event identifiers; the internet-side external alarm system does not directly access the intranet asset fingerprint storage area. The verification interface is used to query historical and current network identities and access locations and trigger controlled detection, limiting agentless verification to the controlled intranet.

[0047] In summary, this invention organizes intranet-side active scanning, passive traffic, address allocation, domain name resolution, and access topology data using an asset identity chain with a valid period, forming an intranet asset fingerprint that can be traced back to the alarm time. It also aggregates internet-side alarms into external access fingerprints with observable characteristics. After time alignment of the two domain fingerprints, the server establishes path transformation hypotheses for direct connections, network address translation, proxy forwarding, and mobile hotspots. It processes features such as preservation, predictable transformation, intermediate node regeneration, and path invisibility separately. Under the same observation conditions, it fuses supporting evidence, conflicting evidence, and multi-window consistency relationships to obtain the joint confidence of the asset and external connection path. When location conditions are insufficient, it supplements evidence through controlled network-side probing, historical lease queries, access topology queries, and subsequent communication observations, and preserves a traceable chain of related evidence.

[0048] Compared to existing technologies, this invention generates asset fingerprints through network-side data collection, without requiring client software to be installed on the located terminal, thus covering printers, cameras, and IoT terminals. An identity chain with a valid period separates asset instances from dynamic network addresses, media access control addresses, and access locations, enabling the server to restore historical network identities according to the alarm time. Path transformation processing avoids directly using port numbers after network address translation, handshake features regenerated by proxy nodes, or address fields obscured by mobile hotspots as terminal equivalence features, thereby preserving application, session, and timing evidence that distinguishes genuine assets under shared exit points and multi-level forwarding conditions.

[0049] This invention separately handles valid observations, missing data collection, and invisible paths. It only generates conflict evidence for comparable differences that cannot be explained by valid path parameters, and determines joint confidence by combining feature reliability, feature discriminativeness, and cross-window repetition relationships. This allows unique location, candidate retention, and insufficient fingerprint coverage to correspond to different levels of evidence sufficiency. The asset identity, network address at the time of alarm, access location, and external path in the location results are all linked to the original alarm, fingerprint version, path parameters, and verification records. This avoids outputting definitive conclusions beyond the observation conditions when evidence is insufficient, and also allows for relocation after supplementing discriminative features through agentless verification. Attached Figure Description

[0050] Figure 1 This is the overall flowchart of the agentless illegal external connection dual-domain fingerprint positioning method of the present invention.

[0051] Figure 2 This is a data processing relationship diagram between the intranet asset domain, the internet alarm domain, and the dual-domain associated location domain of this invention.

[0052] Figure 3 This is a schematic diagram illustrating the relationship between the asset identity chain, asset feature units, and time version index of this invention.

[0053] Figure 4 This is a schematic diagram of the fingerprint feature transformation mechanism corresponding to different external connection paths in this invention.

[0054] Figure 5 This is a schematic diagram of the structure of the non-agent, unauthorized external connection dual-domain fingerprint positioning system of the present invention.

[0055] Figure 6 This is a schematic diagram illustrating an application scenario for asset location using privately installed gateways, proxy nodes, and mobile hotspots.

[0056] Figure 7 This is a schematic diagram comparing the technical effects of direct matching of the original fields and the path transformation association processing of this invention. Detailed Implementation

[0057] The technical solution of the present invention will be further described below with reference to the accompanying drawings. The specific embodiments described are used to illustrate the data relationships, processing order, and a feasible configuration method among the various technical features, and are not intended to limit the present invention to a specific device model, network scale, alarm product, or fixed parameters. Without changing the data dependencies, the independent data acquisition, feature extraction, and index building processes can be executed in parallel.

[0058] The term "internal network asset" in this specification refers to a device connected to a controlled internal network and capable of network communication via wired or wireless interfaces. "Agentless" means that no client program for unauthorized external connection location is required to be installed on the operating system, firmware, or application environment of the asset being located. "External access event" refers to a data object aggregated from external connection alarm records belonging to the same connection or continuous access process on the internet side. "Path transformation hypothesis" refers to the rules and parameter combinations describing the impact of direct connection, network address translation, proxy forwarding, or mobile hotspots on feature visibility, forming subject, and value change methods. Network addresses include Internet Protocol addresses, and mobile hotspots include mobile phone hotspots and portable WiFi.

[0059] Unless otherwise specified, in the formulas of this specification, 'a' represents a candidate asset, 'e' represents an external access event, 'h' represents a path transformation hypothesis, and 't' represents time; subscripts are used to distinguish features, windows, connections, nodes, or versions; superscripts 'in' and 'out' represent the intranet side and the internet side, respectively; superscript 'pre' represents the expected value obtained after path transformation; and superscripts '+' and '-' represent supporting evidence types and conflicting evidence types, but do not indicate positive or negative operations on the corresponding quantities. Σ_(k∈K) +The notation ) indicates summation within a subscript-defined set; the dot “·” indicates multiplication; the forward slash “ / ” indicates division; square brackets indicate function variables or operation groups; exp indicates the natural exponential function; Ind indicates an indicator function that takes 1 if the condition is true and 0 otherwise; and |·| indicates absolute value. Similarity, reliability, discriminability, comparability coefficient, conflict level, and consistency are all normalized to [0, 1]. ε in the formula is a positive number set to prevent the denominator from being zero; when the comparison set is empty, the corresponding normalized value is zero and the evidence is marked as insufficient. FP_in(a, t) represents the internal network asset fingerprint in the version hit at time t, and FP_in(a, V_v) represents the same type of fingerprint in version V_v. In the accompanying drawings, the same names represent the same or corresponding functional objects, and the correspondence between the abbreviations in the illustrations and the symbols in the text is determined according to the description of the corresponding embodiment.

[0060] Example 1

[0061] This embodiment provides a method for agentless unauthorized external connection dual-domain fingerprint location executed by an associated location server. The overall process of this method is as follows: Figure 1 As shown, the process includes steps S1 (internal network asset fingerprint generation), S2 (external access fingerprint generation), S3 (time alignment and candidate asset generation), S4 (path transformation and joint confidence calculation), and S5 (location output and agentless verification). After step S5, a unique location condition is set. If the condition is true, the actual internal network asset, the network address at the time of the alarm, the access location, the external connection path, and the associated evidence chain are output. If the condition is false, an agentless verification task is generated, the verified data is written into the internal network asset fingerprint, and the process returns to step S3 for re-association. Figure 1 The dotted feedback path in the image indicates that the review process does not overwrite the original fingerprint, but instead creates a new time version and evidence record.

[0062] Figure 2 The data processing relationships in this embodiment are illustrated. Figure 2 The left side represents the internal network asset domain. Active scanning responses, passive traffic records, dynamic host configuration protocols, domain name systems, and access topology records are respectively entered into the time-sensitive identity chain and asset feature unit, which together form the internal network asset fingerprint. Figure 2 The right side is the Internet alarm domain. External original alarms are sequentially aggregated through access events and marked with characteristic observable status to form an external access fingerprint. Figure 2 The central section is a dual-domain correlation and positioning domain. The time version of the internal network asset fingerprint and the alarm window of the external access fingerprint jointly enter the time alignment process. The internal network feature index is used for candidate asset generation, and the actual external features are used for path transformation hypothesis verification. Subsequently, the fusion of supporting and conflicting evidence and the joint confidence level output are completed sequentially. Solid lines indicate the main data processing direction, and dashed lines indicate the auxiliary correlations formed by feature indexes, actual external features, or verification data.

[0063] In step S1, an intranet acquisition node is set up at the aggregation switch location of the controlled intranet. The intranet acquisition node connects to the traffic mirroring interface to obtain passive traffic without altering the forwarding path of the observed communication packets. The intranet acquisition node also connects to the controlled active probe interface to send protocol probe requests to the address range where the asset is located at a preset probe rate. The Dynamic Host Configuration Protocol (DHCP) server provides the associated location server with the address lease start and end times, client identifier, and lease status; the Domain Name System (DNS) provides the query time, query name, and response relationship; and the switching equipment or wireless controller provides the association records between the Media Access Control (MAC) address and the switch port, wireless access point, and virtual LAN.

[0064] The associated positioning server first unifies the time values ​​from different data sources. For records with a clearly defined time zone, they are converted to a unified time base; for records that only record the device's local time, the clock difference is determined based on the most recent time synchronization record between the acquisition node and the corresponding device; for data sources where synchronization records cannot be obtained, their time offset is corrected based on common communication events in subsequent step S3. Each input record saves the source identifier, original time, unified time, acquisition location, and integrity status, enabling the subsequent positioning process to distinguish between the record's own business time and the time the record arrives at the server.

[0065] The associated location server establishes an asset identity chain based on the input records. Each asset instance corresponds to an asset identifier node, and the wired or wireless network interface used by the asset corresponds to a network interface node. Dynamic Host Configuration Protocol (DHCP) leases are converted into address lease nodes, which connect to the corresponding network interface node using the network interface identifier, client identifier, and lease period. Switch address forwarding tables or wireless association records are converted into access location nodes, which connect to the corresponding network interface node using the Media Access Control (MAC) address and record validity period. The asset identifier node and network interface node maintain ownership relationships, while the network interface node, address lease node, and access location node maintain occupancy relationships with valid start and end times.

[0066] When the same Media Access Control (Media Access Control) address appears in multiple network address leases with non-overlapping times, the server connects each lease to the same network interface node. When the Media Access Control address undergoes randomization, the server does not directly identify the changed address as a new asset. Instead, it compares the Dynamic Host Configuration Protocol (DHCP) client identifier, hostname, active probe response, application interaction characteristics, and access location within adjacent time windows. If a continuous identity relationship can be formed, the network interface nodes before and after the change are connected to the same asset identifier node, and their validity periods are stored separately. If the above relationship is insufficient to support identity continuation, a new instance of the asset to be confirmed is created, without forced merging.

[0067] During proactive scanning, subsequent requests are selected based on the asset's response to the probe protocols. For assets that only respond to Address Resolution Protocol (ARP) or Internet Control Message Protocol (ICP), address reachability, response time-to-live (TTL), and response time are recorded. For assets with open Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) services, port response status, service negotiation results, TCP window, and option arrangement are further recorded. For assets that can return device certificates, service descriptions, or standard management protocol (SMLP) responses, content that stably represents the device category or product series is extracted. Probe tasks are configured with a rate and retry limit; failure to obtain a response is only recorded as a missing step in this probe round and is not directly considered an asset offline conclusion.

[0068] Passive traffic is recorded as a connection or transaction. For Transmission Control Protocol (TCP) communication, the source address, destination address, source port, destination port, and protocol are used as the basis for connection identification, and the connection start time, end time, message direction, and message length changes are recorded. For Domain Name System (DNS) transactions, domain name access records are formed based on the transaction identifier and query response relationship. For encrypted connections, the protocol version, cipher suite arrangement, extended arrangement, elliptic curve parameters, and dot-matrix parameters are obtained from the client handshake phase, and an encrypted handshake fingerprint is generated according to the JA3 fingerprint formation rules. For application communication containing a User-Agent field, case sensitivity, whitespace, variable session markers, and patch version content without location function are standardized, while product families and major version relationships are preserved.

[0069] The lifetime in passive messages is extrapolated based on commonly used initial lifetime levels. The server selects a candidate initial value that is not less than the observed lifetime and is closest to it. The difference between the candidate initial value and the observed value is used as the estimated forwarding hops before the collection point. If the extrapolation results for the same asset are inconsistent in adjacent windows, multiple candidate values ​​and their corresponding occurrence ratios are saved, rather than overwriting existing results with a single message. The connection period is formed based on the start time interval of adjacent accesses of the same type. The traffic burst profile is formed based on the uplink and downlink message volumes within a fixed time granularity. The source port behavior is formed based on the hold, offset, or incremental relationship of adjacent connection source ports.

[0070] The aforementioned probe responses and communication records are normalized into asset feature units F_k = (n_k, v_k, t_k, o_k, r_k, τ_k). Here, n_k is the feature name, v_k is the feature value, value set, or time sequence, t_k is the observation time, o_k is the observation location, r_k is the initial acquisition reliability within the range [0, 1], and τ_k is a reliability decay time constant greater than zero. Stable responses obtained from active scanning can be determined by the consistency of repeated probes, while passive traffic features can be determined by the handshake integrity, packet coverage, and number of recurrences. Identity association features use a longer reliability decay time constant and validity period, while dynamic addresses, access locations, and port behaviors use explicit validity periods corresponding to the lease period or statistical window. The server uses the asset identifier node as the primary index and the time window as the secondary index to combine the valid identity chain and asset feature units into an internal network asset fingerprint.

[0071] In step S2, the associated location server receives external alarms from the internet side through the alarm access node. Different alarm systems may provide different field names, which the alarm access node converts into a unified record. This unified record includes the original alarm identifier, alarm time, public network source information, access target, external source port, transmission protocol, application identification result, available protocol stack or handshake characteristics, and a reference to the original record. The original record reference points to unnormalized records in the alarm system, allowing for review of the alarm content after the location results are generated.

[0072] The server establishes event aggregation relationships using alarm records as nodes. When two alarm records have the same public network source identifier, and their access targets are the same or belong to the same target service, and the time interval between the records does not exceed the aggregation window, a session adjacency relationship is established between them; records with consecutive session adjacency relationships are merged into external access events. For multiple detection alarms generated by a single connection, they are directly aggregated using the session identifier; for alarms without a session identifier, they are aggregated using the public network source address, external source port, access target, and time proximity relationship. After aggregation, the order of the records is preserved, and the set of access targets is not processed into an unordered set, thus preserving information for subsequent time-series association.

[0073] Features in external access events are categorized into valid observation, missing data collection, or path-invisible states. If the alarm collection location can parse the complete client handshake and generate a JA3 fingerprint, the feature is set as a valid observation; if the handshake message is missing during collection but the parsing conditions were originally met, it is set as missing data collection; if the alarm collection location is outside the encrypted session endpoint and the User-Agent field in the encrypted payload cannot be observed, the corresponding feature is set as path-invisible. For intranet addresses and media access control addresses, since the internet-side observation location does not have direct observation conditions, they are set as path-invisible. External access events, extracted external features, and observable states together constitute the external access fingerprint.

[0074] In step S3, the server first performs time alignment between the internal network asset fingerprint and the external access fingerprint. When both the internal and external networks record a baseline communication event with the same access target, the same connection direction, and the same packet burst relationship, the difference between the start times of the event on both sides is used as the time offset. When there are multiple baseline communication events, the offset is calculated separately, and the median value is used as the time calibration value to reduce the impact of jitter in a single record.

[0075] When a common baseline communication event cannot be determined, the server moves the time window of the external access event within the candidate offset range Ω. Let Δ be a candidate offset, D_in and D_out represent the access target sequences on the intranet side and the Internet side, respectively, and B_in and B_out represent the connection activity sequences formed on both sides at the same time granularity, respectively. Then the evaluation value of the candidate offset can be expressed as:

[0076] J(Δ)=λ_D·Sim_D[D_in,Shift(D_out,Δ)]+λ_B·Sim_B[B_in,Shift(B_out,Δ)].

[0077] Where Sim_D represents the order similarity obtained from the normalized edit distance of the access target sequence, and Sim_B represents the activity similarity obtained from the normalized inner product of non-negative connected activity vectors of the same granularity, both of which are in [0, 1]; Shift represents moving the time sequence according to Δ, where Δ and the sequence timestamp use the same time unit; λ_D and λ_B are non-negative weights, and λ_D + λ_B = 1. When any input sequence is empty or the magnitude of the activity vector is zero, the similarity corresponding to it is zero; when neither of the two input relationships is available, the determined time calibration amount is not calculated, but the candidate retrieval window is expanded. The server determines the offset that makes J(Δ) reach its maximum value as the time calibration amount Δ*; when multiple offsets reach the same maximum value, the offset with the smaller absolute value is selected, and the parallel state is written into the calibration reliability. The difference between the maximum evaluation value and the second largest evaluation value is used to represent the calibration reliability; when the difference is small, the candidate time window corresponding to the alarm is expanded, and the reliability of evidence formed solely by precise time coincidence is reduced.

[0078] The server queries the asset identity chain according to the calibrated alarm time to obtain the initial set of assets with valid address leases or access locations during that period. It then queries passive traffic, Dynamic Host Configuration Protocol (DHCP) renewal records, switch port status, and wireless association status. When multiple independent data sources indicate that an asset was not online during the alarm period, offline conflict evidence is generated for that asset; if a single data source does not retrieve a record, only the corresponding source is marked as missing, and the asset is not directly deleted.

[0079] The server builds inverted indexes based on domain access relationships, JA3 fingerprints, normalized User-Agent fields, estimated initial lifetime, access target order, connection cycle, and port behavior. When an external access fingerprint matches an index item, the corresponding asset is added to the feature recall set. The candidate asset set is formed by the intersection of the initial asset set valid during the alarm period and the feature recall set. When there are insufficient comparable features in the external access fingerprint, assets with communication activity during the alarm window in the initial asset set are retained to prevent premature exclusion of real assets due to missing internet-side fields. Each candidate asset records the identity chain version, online status source, and index hit characteristics upon which it entered the candidate set.

[0080] In step S4, the server establishes direct path transformation hypothesis h_1, network address translation path transformation hypothesis h_2, proxy forwarding path transformation hypothesis h_3, and mobile hotspot path transformation hypothesis h_4 for each candidate asset. Each path transformation hypothesis includes feature state rules and path parameters to be estimated. The feature state rules set the features in the internal network asset fingerprint to a state of preservation, predictable transformation, intermediate node regeneration, or path invisibility, and generate the corresponding expected external fingerprint based on the state.

[0081] Under the direct path transformation assumption, domain name access relationships, client-generated JA3 fingerprints, User-Agent fields, and connection timing remain generated by candidate assets, and lifetime is varied based on the hop count difference between the intranet collection location and the internet-side collection location. Under the network address translation path transformation assumption, intranet addresses and media access control addresses are set to path-invisible, application interaction characteristics remain generated by candidate assets, and inner source ports are converted to predicted outer source ports according to port mapping functions. Under the proxy forwarding path transformation assumption, the re-established transmission connections and encrypted sessions by proxy nodes are set to be regenerated by intermediate nodes, and the inner session from the client to the proxy node and the outer session from the proxy node to the internet target are combined into a session chain. Under the mobile hotspot path transformation assumption, intranet addresses are set to path-invisible, and protocol stack characteristics and connection timing are transformed based on hotspot forwarding hop count, port allocation relationships, and link latency range.

[0082] The port mapping function for the Network Address Translation (NAT) path is formed through connection pairing. The server first pairs the inner connections of candidate assets with the outer connections of external access events according to the access target and time overlap, resulting in the inner source port sequence Ports_in = (p_1, p_2, ..., p_m) and the outer source port sequence Ports_out = (p′_1, p′_2, ..., p′_m). If the proportion of corresponding ports is equal, meeting the port hold condition, the port hold rule is adopted; if p′_i - p_i remains within the allowable deviation range across multiple paired connections, the port offset rule is adopted; if the outer ports monotonically change with the connection order, a mapping rule that changes according to the allocation order is established; otherwise, random mapping candidates are reserved. When the port mapping rule can be repeated in subsequent external access events, the path consistency of the corresponding NAT path is improved; when it cannot be repeated, the path consistency is reduced.

[0083] The proxy forwarding path is formed through two-segment session association. For each inner session from a candidate asset to the proxy node, the server searches for outer sessions that started after its start, before its end, or within the allowable forwarding delay range. The degree of correspondence between access targets, the degree of correspondence between durations, the changes in uplink and downlink communication activity, and the order of connection termination are converted into session matching values. When multiple inner sessions compete for the same outer session, the server determines the matching combination based on the session matching value and the repetition relationship across access events, preventing a single outer session from being simultaneously assigned to conflicting inner sessions. This ultimately forms a session chain where the asset identity chain, inner sessions, proxy nodes, outer sessions, and external access events are sequentially connected.

[0084] For each candidate asset and path transformation hypothesis combination, the server compares the expected external fingerprint after path transformation with the actual external access fingerprint item by item. Supporting evidence is generated when a feature is in a valid observation state and matches; conflicting evidence is generated when a feature is in a valid observation state, does not match, and the corresponding difference cannot be explained by the path parameters; features marked as missing data or with an invisible path are excluded from this comparison. Each piece of evidence is associated with the candidate asset, external access event, path transformation hypothesis, feature source, observation time, feature reliability, and feature discriminative power.

[0085] Feature distinguishability is determined based on the frequency of occurrence of the corresponding feature among valid assets during the alarm period, and adjusted according to its stability across time windows. Operating system default protocol stack features shared by multiple assets have low distinguishability; domain name sequences, JA3 fingerprints, or periodic communication relationships that appear in fewer assets and remain stable across multiple windows have high distinguishability; handshake features regenerated by proxy nodes and shared by multiple assets are not used as the primary basis for distinguishing shared proxy node intranet assets.

[0086] The server uses the normalization quantity S of supporting evidence. + The joint confidence level C(a, e, h) is calculated using the conflict evidence normalization measure S⁻ and the multi-window consistency measure M. + and S - Weighted normalization is performed based on supporting evidence and conflicting evidence that are included in the comparison.

[0087] M(a, e, h) = [Σ_(u∈W_e) ρ_u·Rep_u(a, h)] / [Σ_(u∈W_e) ρ_u+ε].

[0088] Where W_e is the set of adjacent historical windows or windows with the same periodic phase, ρ_u is the window reliability, and Rep_u(a,h) is 1 when the corresponding window repeatedly forms the same path transformation hypothesis, port mapping relationship, or session chain relationship, otherwise it is 0; M is zero when W_e is an empty set. The joint confidence is calculated according to the following formula:

[0089] C(a,e,h)=σ[α·S + (a, e, h) - β·S - (a, e, h) + γ·M (a, e, h)].

[0090] σ(x)=1 / [1+exp(-x)].

[0091] Here, α, β, and γ are non-negative fusion coefficients, and α + β + γ > 0. The resulting joint confidence level is located in [0, 1] and corresponds to the combination of asset and path transformation assumptions, rather than just a single network address.

[0092] In step S5, the server sorts the candidate assets and path change hypothesis combinations for the same external access event from highest to lowest joint confidence. The highest joint confidence is denoted as C_1, and the second highest joint confidence corresponding to different assets is denoted as C_2; if there is no second highest candidate corresponding to different assets, C_2 is set to zero. The location threshold θ_loc, the differentiation threshold θ_gap, and the candidate retention threshold θ_keep are all located in [0, 1], and satisfy θ_keep ≤ θ_loc. Each threshold is determined based on historical events that have been reviewed. In one feasible configuration, θ_loc can be set to 0.80, θ_gap to 0.15, and θ_keep to 0.55; the above values ​​are used to illustrate the judgment method, and will be recalibrated based on the completeness of data collection and historical location results during actual deployment.

[0093] When C_1 ≥ θ_loc and C_1 - C_2 ≥ θ_gap, the server generates a unique location result. When C_1 reaches the candidate retention threshold but does not meet the unique location condition, the corresponding candidate assets and path transformation assumptions are retained, and an agentless review task is generated. When all combinations are below the candidate retention threshold, the fingerprint coverage is insufficient or the path is unknown, and the external access fingerprint is saved for reprocessing after adding internal network asset fingerprints or path rules.

[0094] The agentless verification task selects verification actions based on existing evidence gaps. When a stable protocol stack response is lacking, the internal network data collection node re-executes active probing at a controlled rate; when the network address is ambiguous at the time of an alarm, the corresponding historical address lease is queried; when the access location is ambiguous, the switch's address forwarding table history, wireless association history, and current access status are queried; when multiple candidate assets have the same application characteristics, the access target order, connection cycle, and port behavior are compared in subsequent observation windows to see if they reappear. Verification actions are completed by network-side devices, without installing client programs on printers, cameras, or IoT terminals.

[0095] The verified data is converted into new asset feature units and written to the intranet asset fingerprint version corresponding to the collection time. The server then performs time alignment, candidate generation, path transformation, and evidence comparison again. If the unique location conditions are met after verification, the asset management identifier, Internet Protocol address at the time of alarm, Media Access Control address, switch port or wireless access point, virtual LAN, network area, corresponding external path, and joint confidence status of the real intranet asset are output. If the unique location conditions are still not met, the retained candidates and the missing distinguishing evidence are output, and a unique asset result is not forced.

[0096] Throughout the processing, the server assigns association identifiers to the original external alarms, external access events, time calibration records, candidate assets, identity chain versions, path change assumptions, port mapping rules or session chains, supporting evidence, conflicting evidence, review records, and location results. Subsequent generated records save the association identifiers of their directly input records, thus forming an association evidence chain from the location results back to the original alarms and intranet collection records. When the location results are reviewed or the fingerprint version is updated, the original evidence chain is not overwritten; instead, a new processing record referencing the original result is formed, allowing the location basis and its changes to be traced back.

[0097] Through the above steps, the fingerprints of internal network assets and external access are not directly matched based on a single address or parameter. Instead, evidence comparison is performed after identity chain recovery, dual-domain time alignment, and path observation conditions are unified upon alarm activation. Address leases, access topology, protocol stack responses, domain name relationships, JA3 fingerprints, User-Agent fields, and port behavior are associated according to their formation location and path status. This allows internal network assets that cannot install agent programs to enter the location process corresponding to external alarms from the Internet side.

[0098] Example 2

[0099] This embodiment further explains the concept based on Embodiment 1. Figure 3 The document illustrates the formation and query methods for the asset identity chain, asset feature units, and time version index. This embodiment is applicable to situations where intranet assets use dynamic network addresses, have multiple network interfaces, move between different access locations, or experience media access control address randomization. During implementation, the Internet Protocol address is not used as a long-term immutable asset primary key. Instead, asset instances, network interfaces, address leases, and access locations are modeled separately, and the network state corresponding to any alarm time is restored through the validity period.

[0100] like Figure 3 As shown on the upper left, the asset identity chain includes asset identifier nodes, network interface nodes, address lease nodes, and access location nodes. Asset identifier nodes represent device instances in a managerial sense, and their node identifier remains unchanged while the asset is confirmed to belong to the same device. Network interface nodes represent a wired network interface card (NIC), wireless NIC, virtual network interface, or other communication interface of the device. Address lease nodes represent the fact that a specific Internet Protocol (IP) address is used by the corresponding network interface within a continuous period. Access location nodes represent the switch ports, wireless access points, virtual LANs, and network areas connected to the network interface within a continuous period.

[0101] An asset identifier node can be represented as A = (asset_id, state, t_create, t_retire), where asset_id is the asset instance identifier assigned by the server, state indicates the confirmed, pending, merged observation, or decommissioned status, and t_create and t_retire represent the asset instance's creation and decommissioning times, respectively. A network interface node can be represented as I = (interface_id, anchor_set, type, T_I), where anchor_set stores the interface identity anchor points obtained from multiple observations, type indicates the interface category, and T_I indicates the interface node's validity period. Identity anchor points include media access control addresses, dynamic host configuration protocol client identifiers, device hostnames, certificate device identifiers, or interface identifiers provided by the asset management system. Different identity anchor points store their source and validity period separately, and are not required to appear simultaneously in every observation.

[0102] An address lease node can be represented as L = (lease_id, ip_addr, interface_id, T_L, source_ref), where ip_addr is the leased Internet Protocol address, T_L is the left-closed, right-open lease validity interval [t_start, t_end), and source_ref is the original lease record reference. Using a left-closed, right-open interval ensures that the end time of the previous lease does not overlap with the start time of the next lease. When the Dynamic Host Configuration Protocol (DHCP) server only provides the lease duration and not the end time, a provisional end time is generated by adding the lease duration to the time the lease is confirmed to be effective; the end time of the corresponding node is extended upon receiving a renewal record; and the original validity period ends upon receiving a release record, conflict detection record, or a new mutually exclusive lease.

[0103] An access location node can be represented as P = (position_id, interface_id, device_id, access_id, vlan_id, zone_id, T_P, source_ref). Here, device_id represents the switching device or wireless control device, access_id represents the switch port or wireless access point, vlan_id represents the virtual LAN, zone_id represents the network zone, and T_P represents the valid period of the access location. The switch address forwarding table typically reflects the state near the observation time. The server determines the start and end of the location relationship based on continuous polling records. When wireless association records contain online and offline events, the corresponding event times are directly used to constitute the valid period. If the same network interface switches between adjacent ports within a short period, separate location nodes are established, and boundary uncertainty intervals are set with the recording time precision.

[0104] An edge from an asset identifier node to a network interface node indicates that the interface belongs to an asset; an edge from a network interface node to an address lease node indicates that the address is used by the interface during the lease period; and an edge from a network interface node to an access location node indicates that the interface is located at that access location during the corresponding period. Each edge stores the relationship type, validity period, data source, and relationship reliability. The continued existence of a node does not mean that its relationship is always valid. For example, an address lease node is retained for historical queries after the lease ends, but its occupancy relationship with the network interface node is no longer involved in current status queries.

[0105] The server establishes an identity chain based on two levels: deterministic and continuous relationships. Deterministic relationships are formed by asset management identifiers, long-term unchanging device certificate identifiers, Dynamic Host Configuration Protocol (DHCP) client identifiers, or system registration relationships. Continuous relationships are used to handle media access control address randomization, interface changes, and missing data source records. For two network interface nodes I_x and I_y to be judged, the server calculates the identity continuity value G(I_x, I_y) based on the identity anchor points, hostnames, protocol stack responses, application interactions, behavioral timing, and the continuity of access locations within adjacent time windows.

[0106] G (I_x, I_y) = Σ_m [η_m·U_m (I_x, I_y)] - Σ_n [ζ_n·X_n (I_x, I_y)].

[0107] Where U_m represents the degree of validity of the m-th continuity support relationship, and X_n represents the degree of validity of the n-th mutual exclusion relationship, both ranging from [0, 1]; η_m and ζ_n represent the non-negative support weight and non-negative conflict weight, respectively, and the effective weights of each group are normalized to sum to 1. When the set of support relationships or the set of mutual exclusion relationships is empty, the corresponding summation term is zero, so the value range of G(I_x, I_y) is [-1, 1]. Continuity support relationships can be formed by the same client identifier, the same hostname, stable protocol stack response, the same application access sequence, and location migration continuity. Mutual exclusion relationships can be formed by two interfaces continuously online in different access locations within the same time period, the same strong identity anchor being effectively occupied by another asset at the same time, or obvious incompatibility of device categories.

[0108] When the identity continuation value reaches the merging threshold and there is no highly reliable mutual exclusion relationship, the two network interface nodes are connected to the same asset identifier node. When the identity continuation value is within the observation range, the two are placed in the same identity cluster, but permanent merging is not performed temporarily; it will be recalculated after obtaining new Dynamic Host Configuration Protocol (DHCP) records, active scan responses, or access location records. When the identity continuation value is below the observation threshold or there is an unresolvable mutual exclusion relationship, they are kept as different asset instances. In this way, changes in media access control addresses will not necessarily create new assets, and the same hostname or similar User-Agent fields will not individually cause two simultaneously online terminals to be merged.

[0109] Figure 3 The upper right side illustrates the formation process of asset feature units. Active probe responses and passive traffic observations respectively enter the feature normalization process, forming F_k = (n_k, v_k, t_k, o_k, r_k, τ_k). The feature name n_k is used to determine the subsequent comparison method; the feature value v_k can be a scalar, categorical value, set, sequence, or statistical distribution; the observation time t_k represents the time when the feature was acquired; the observation location o_k represents the location of the feature acquisition in the network path; the initial acquisition reliability r_k represents the credibility of this record for identity association and is normalized to [0, 1]; the reliability decay time constant τ_k is greater than zero and is used to determine the effective reliability of the feature at the query time as it changes over time; address leases, access locations, and other relationships with clearly defined start and end times participate in the query according to their explicit validity periods.

[0110] Based on the feature formation mechanism, the server divides asset feature units into identity association features, protocol stack response features, application interaction features, and behavioral timing features. Identity association features are connected to asset identifier nodes or network interface nodes; protocol stack response features are connected to network interface nodes that generate corresponding messages; and application interaction and behavioral timing features are connected to asset instances and observation windows. During normalization, the domain name query name is converted to lowercase and the trailing separator is removed, while preserving the relationship between the normalized domain name and the alias resolution chain. During normalization, the User-Agent field removes session-related dynamic fragments but retains the product family, main version, and device type. The JA3 fingerprint simultaneously saves the digest value and the normalized handshake field used to generate the digest, allowing for verification of the original composition when digests are identical or resolution rules are upgraded.

[0111] Feature reliability is jointly determined by source reliability, record completeness, and repeatability stability. Lease records directly generated by the Dynamic Host Configuration Protocol (DHCP) server have high source reliability during their validity period; address usage relationships inferred solely from passive messages have low source reliability when a complete handshake is missing; and consistent active scan responses across multiple probe cycles improve repeatability stability. For time-varying features, the server can calculate its effective reliability at query time t using the following formula:

[0112] r_k(t) = r_k(t_k)·exp[-(t-t_k) / τ_k], where t≥t_k and τ_k>0.

[0113] Where r_k(t_k) is the initial reliability within the range [0, 1], and τ_k is the reliability decay time constant corresponding to the stable period of this feature. t, t_k, and τ_k use the same time unit, so r_k(t) remains within the range [0, 1]. For address leases and access locations with a definite end time, infinite decay is not used; instead, they participate in queries within the validity period and cease to be used as evidence of the current state outside the validity period. For long-term stable device certificate identifiers or vendor device identifiers, a longer validity period can be set; for source port behavior and short-cycle access sequences, a shorter validity period adapted to the statistical window is set.

[0114] When the same feature is obtained from multiple data sources, the last arriving record does not directly overwrite previous records. The server first determines whether the observation times of each record overlap, whether the observation locations are the same, and whether the feature values ​​can be true simultaneously. Records that can be true simultaneously are aggregated, and reliability is improved based on the number of independent data sources; records that cannot be true simultaneously but have similar source reliability are saved separately, and feature conflict states are set; if one record can be verified by the original data with higher reliability, the low-reliability record and conflict marker are retained, but the verified feature value is used in the current time version. This preserves the differences between data sources and avoids losing information needed for subsequent auditing due to overwriting processing.

[0115] Figure 3 The lower section shows the time-version index. The server uses the time when the asset status changes as the version boundary, employing a copy-on-write method to create versions V1, V2, and V3. Copy-on-write means that the new version references unchanged identity chain nodes and feature units from the previous version, only adding, terminating, or replacing changed relationships. State changes that can trigger a new version include the start or end of an address lease, a change in access location, a change in network interface ownership, an update of stable identity anchors, continuous changes to important protocol stacks or application features, and the confirmation of identity cluster merging or splitting.

[0116] Let the validity period of version V_v be T_v = [t_v, t_(v+1)); for the current version that has not yet ended, let positive infinity or the upper bound of the current system query be t_(v+1). The internal network asset fingerprint of asset a in this version can be represented as:

[0117] FP_in (a, V_v) = (A_a, I_a^v, L_a^v, P_a^v, F_a^v, Q_a^v).

[0118] Wherein, A_a represents the asset identifier node, I_a^v represents the set of valid network interface nodes in version V_v, L_a^v represents the set of valid address lease nodes, P_a^v represents the set of valid access location nodes, F_a^v represents the set of asset feature units that are still valid in this version, and Q_a^v represents the data quality status. The data quality status records the time precision, source completeness, unresolved identity relationships, and feature conflicts, enabling subsequent association processes to adjust the reliability of evidence based on version quality.

[0119] Figure 3 Asset instance A shown has network interface I1 and network interface I2. During the period from t0 to t1, network interface I1 is associated with address lease L1 and access location P1, forming version V1. At t1, after a change in the network interface, address lease, or access relationship, network interface I2 is associated with address lease L2 and access location P2, forming version V2. At t2, the asset feature unit or other status is updated again, forming version V3. V1, V2, and V3 are connected sequentially, each storing its validity period. The dashed lines in the diagram represent identity chain nodes or asset feature units being written to the corresponding time version, while the solid lines between versions represent identity continuation and status update relationships.

[0120] When an external alarm occurs at time t*, the server does not query the latest version, but instead searches for a version in the time version index that satisfies t_v≤t*<t_(v+1). Figure 3 The "time hit" dotted line indicates that a query is initiated to the time version index at the alarm time t*, and the query result is not fixed in advance; the actual hit version is determined by the above-mentioned valid period conditions. Figure 3 Using version V2 as an example of historical recovery, the server recovers the valid address leases, access locations, and asset feature units from version V2. If t* is within the boundary uncertainty interval formed by the time precision of the two data sources, adjacent versions are read simultaneously, and the degree of boundary uncertainty is written into the corresponding evidence reliability, without arbitrarily selecting a single version.

[0121] For late records, the server inserts them into the historical version based on the record's business time, rather than writing them into the current version. If a late record changes the address lease or access location of an existing version, a revised version is generated within the affected time interval, retaining the original version and the source of the revision. Existing location results continue to reference the original version, while generating a pending verification marker; during relocation, the revised version is referenced to form a new chain of evidence. For asset identity merging or splitting, the server also retains the asset instance identifiers and mapping relationships before the change, ensuring that early alerts can still be interpreted according to the identity chain used at the time.

[0122] The time-version index also provides query entry points based on asset identifier, network address, media access control address, access location, and time interval. Based on the external alarm time and known network address, corresponding asset instances can be retrieved; based on the asset instance and alarm time, the address and location at that time can be restored; based on the access location and time interval, a set of assets that appeared at that location can be obtained. All query results carry version identifiers, validity periods, and source references, and serve as input for candidate asset generation and associated evidence chains.

[0123] Through the identity chain and time version processing in this embodiment, the network address, media access control address, and asset instance are no longer set as a permanent one-to-one correspondence. Dynamic address reallocation, terminal location movement, coexistence of multiple network interfaces, and media access control address randomization are all represented as relationship changes with a valid period. Alarm location uses the historical version that was hit at the time of the alarm, which can output the real and valid network address and access location at that time, and provide internal network asset fingerprints with time boundaries and source basis for subsequent path changes and dual-domain evidence comparison.

[0124] Example 3

[0125] This embodiment further explains the concept based on Embodiment 1. Figure 4 The illustrated approach includes path transformation assumptions, network address translation port mapping, proxy two-segment session association, and conflict evidence handling. Internal network asset fingerprints and external access fingerprints are formed at different observation locations, and the fields obtainable on both sides and the subjects forming those fields are not the same. This embodiment first changes the comparison state of fingerprint features based on candidate external paths, and then compares features that can be under the same observation conditions, rather than performing fixed, item-by-item equal-value matching on the original fields on both sides.

[0126] like Figure 4 As shown on the left, the internal network asset fingerprint FP_in(a, t) serves as the common input for each path transformation branch, where a represents the candidate asset and t represents the alarm time after calibration with the external access event. To simplify the diagram, Figure 4FP_in(a,t) is labeled as F_in(a,t), FP_out^pre(a,h,t) is labeled as F_out(a,h,t), and h_1 to h_4 are labeled as h1 to h4. The above diagrams refer to the same internal network asset fingerprint, expected external fingerprint, and four types of path transformation assumptions in the text. The formulas in the text and subsequent calculations uniformly adopt FP_in, FP_out^pre, and h_1 to h_4. Figure 4 In this context, MAC stands for Media Access Control Address. Figure 4 The middle section, from top to bottom, shows the direct path h_1, network address translation path h_2, proxy forwarding path h_3, and mobile hotspot path h_4. Each path branch outputs the expected external fingerprint FP_out^pre(a, h, t), which is related to... Figure 4 The actual external access fingerprints on the right are compared under the same observation conditions, forming supporting evidence, conflicting evidence, or incomparable states.

[0127] Each path transformation hypothesis can be represented as H_h = (type_h, R_h, Θ_h, T_h, Q_h), where type_h represents the path type, R_h represents the characteristic state rule, Θ_h represents the path parameters to be estimated, T_h represents the transformation performed according to the characteristic state rule and the path parameters, and Q_h represents the data quality state of the path transformation hypothesis. Path parameters are not obtained from a single alarm, but are estimated using the inner connections related to candidate assets, the outer connections related to external access events, and the repetition relationships of adjacent time windows. When path data is insufficient, parameter ranges and uncertain states are preserved; unestimated parameters are not set to arbitrary fixed values.

[0128] The feature state rule R_h outputs a hold-behind state, a predictable change state, an intermediate node regeneration state, or a path-invisible state for each feature. A hold-behind state indicates that the feature is still generated by the candidate asset, and its semantics and comparison value remain consistent after being transferred from the intranet collection location to the internet-side collection location. A predictable change state indicates that the feature value changes, but the change can be explained by hop count, port mapping, latency, or encapsulation parameters. An intermediate node regeneration state indicates that the internet-side feature is generated when the gateway or proxy node re-establishes a connection and cannot be directly attributed to the candidate asset. A path-invisible state indicates that the corresponding intranet feature cannot be obtained from the internet-side observation location.

[0129] State rules are not only set based on feature names, but also determined by observation location and connection method. The same JA3 fingerprint can be kept in a persistent state in an end-to-end encrypted tunnel, and in an intermediate node regenerated state in a proxy path that performs transport layer security protocol decryption and re-encryption; the same User-Agent field can be kept in a normal Hypertext Transfer Protocol proxy by proxy forwarding, and can be in a predictably transformed or regenerated state when the proxy rewrites the request header; the same Time-to-Live can change according to the number of hops in a normal forwarding path, and is regenerated by the proxy node when the proxy re-establishes the Internet Protocol connection.

[0130] for Figure 4 For the direct connection path h_1 at the top, the server sets the domain name access relationship, JA3 fingerprint, User-Agent field, and access target order generated by the client to a maintainable state. The time-to-live (TTL) is set to a predictable change state, with allowed values ​​determined based on the difference in forwarding hops between the internal network collection location and the internet-side collection location. Let the estimated initial TTL of the candidate asset at the internal network collection location be TTL_0, and the observed TTL_out at the internet side be TTL_out. Then, the candidate path hop count can be expressed as d_h = TTL_0 - TTL_out. When d_h is a non-negative integer and falls within the allowed hop count range of the current network topology, protocol stack support evidence is formed; if all allowed initial values ​​cannot yield a reasonable hop count, and the corresponding packet records are complete, then protocol stack conflict evidence is formed.

[0131] for Figure 4 The network address translation path h_2 in the second line has its internal Internet Protocol address and Media Access Control address set to a path-invisible state, making it uncomparable to the public source address. The domain name relationships, JA3 fingerprints, User-Agent fields, and connection sequence generated by the client and not modified by intermediate devices remain comparable. The internal source port is set to a predictable change state, and the server estimates the port mapping rule g_h by pairing internal and external connections.

[0132] An inner connection f_i^in can be represented as a combination of source address, source port, access target, protocol, start time, end time, and bidirectional traffic profile. An outer connection f_j^out can be represented as a combination of public network source address, external source port, access target, protocol, start time, end time, and bidirectional traffic profile. The server first generates an allowed pairing set based on the calibrated time window, target correspondence, and protocol consistency. When the start time of the inner connection is earlier than that of the outer connection, and the difference between the two is within the forwarding latency range, and the access targets are the same or belong to the same target service, a candidate connection pairing edge is established.

[0133] The association value of the candidate connection pair edge can be represented as:

[0134] Match_ij=μ_t·S_t(f_i^in, f_j^out)+μ_d·S_d(f_i^in, f_j^out)+μ_b·S_b(f_i^in, f_j^out)+μ_o·S_o(f_i^in, f_j^out).

[0135] Where S_t represents the correspondence between start and end times, S_d represents the correspondence between access targets, S_b represents the similarity of uplink and downlink traffic burst profiles, and S_o represents the consistency of connection order. All four terms are normalized to [0, 1]. μ_t, μ_d, μ_b, and μ_o are non-negative weights, and μ_t + μ_d + μ_b + μ_o = 1, so the value range of Match_ij is [0, 1]. The server selects pairings from the allowed pairing set that do not violate connection occupancy relationships according to the association value, so that an outer connection does not simultaneously belong to conflicting inner connections.

[0136] After connection pairing is completed, the inner source port sequence Ports_in and the outer source port sequence Ports_out are obtained respectively. Candidate rules are then established sequentially according to port preservation, fixed offset, sequential allocation, segmented allocation, and random mapping. The port preservation rule is expressed as g_h(p_i) = p_i; the fixed offset rule is expressed as g_h(p_i) = p_i + b, where b is the port offset; the sequential allocation rule takes the connection order i as input, causing the predicted outer port to change continuously according to the allocation direction; the segmented allocation rule first determines the allocation boundary, and then performs sequential allocation within each port segment. When the port value exceeds the effective port range, it is processed according to the cyclic relationship of the port space.

[0137] Suppose a candidate port mapping rule applies to m paired connections, where the inner source port and the actual outer source port of the i-th paired connection are p_i^in and p_i^out, respectively. Then the fit of this rule in the current window can be expressed as:

[0138] E_g=(1 / m)·Σ_(i=1)^m Ind[|g_h(p_i^in)-p_i^out|≤δ_p].

[0139] Where m is the number of established connection pairs and m > 0, p_i^in and p_i^out represent the inner source port and actual outer source port of the i-th pair connection, respectively, Ind represents an indicator function that takes 1 when the condition is met and 0 otherwise, and δ_p is the allowable port deviation in non-negative integer form; when port mapping uses a cyclic port space, the minimum cyclic distance is used instead of the absolute difference. When m = 0, E_g is not calculated, and the port mapping evidence is marked as insufficient. For maintain and fixed offset rules, δ_p can be set to a smaller value; for sequential and segmented allocation rules, the port increment direction, adjacent connection order, and allocation boundary are also compared. The server not only selects the rule with the highest fit in the current window, but also calculates the rule parameter changes in subsequent windows. When the same rule type and parameter range remain stable in multiple windows, path consistency is improved; if a rule is only occasionally met in a single window and cannot be reproduced, its evidence discriminability is reduced.

[0140] When a privately set up gateway can be directly observed by internal network data collection nodes, the server also establishes an internal connection relationship between the candidate asset and the privately set up gateway, as well as the access location relationship of the privately set up gateway. If multiple downstream assets share a privately set up gateway, and the internal network data collection location can obtain communication between the downstream assets and the gateway, then the port mapping evidence is associated with the downstream asset identity chain. If the internal network data collection location can only observe the uplink interface of the privately set up gateway, then the unknown terminal behind the gateway is not forcibly identified as a known asset. Instead, the privately set up gateway is identified as the currently locatable access asset, and the identity of the terminal behind the gateway is retained as pending verification. This processing avoids generating definitive conclusions beyond the scope of evidence when the observation range does not cover the downstream terminal.

[0141] for Figure 4 The third line, the proxy forwarding path h_3, further distinguishes between tunnel-type proxies and connection-reconstruction-type proxies. Tunnel-type proxies forward the payload between the client and the target after establishing a tunnel, preserving the client's encrypted handshake characteristics and some application interaction features. Connection-reconstruction-type proxies establish connections with both the client and the target separately, and their Internet Protocol stack responses, Transmission Control Protocol options, and encrypted handshake characteristics are regenerated by the proxy node. The server determines the corresponding characteristic states based on the proxy protocol negotiation record, certificate relationships, and the inner and outer handshake subjects.

[0142] The proxy two-segment session consists of an inner session (s_in) from the candidate asset to the proxy node and an outer session (s_out) from the proxy node to the access target. The candidate session chain first satisfies a temporal causal relationship, meaning the start time of the outer session is no earlier than the time of the inner request that triggered the access, and the interval between the two is within the proxy processing latency range. Second, it satisfies a target relationship, meaning the target recorded in the inner proxy request matches the outer access target, or the two can correspond through domain name resolution and service mapping. Third, it satisfies a communication activity relationship, meaning the burst positions of requests and responses in the inner session can correspond to the uplink and downlink activities of the outer session.

[0143] The server treats the inner and outer sessions as nodes on opposite sides of a bipartite graph, using session matching values ​​as edge weights. For explicit proxy requests, the target relationship has higher weight; for encrypted proxies where the target field is not visible, traffic burst profiles and cross-event repetition relationships have higher weight. The server selects a matching set with higher total edge weights that does not violate session occupancy constraints and connects the matching results with proxy nodes, candidate asset identity chains, and external access events to form a session chain. When multiple assets share a proxy node, the JA3 fingerprint, User-Agent field, or protocol stack response of the proxy node itself is reduced in distinguishability; the continuous correspondence between the inner and outer sessions is used to distinguish the real initiating asset.

[0144] for Figure 4 In the fourth line, for the mobile hotspot path h_4, the server sets the equivalence relationship between the internal network interface address and the public network source address to be invisible. It retains the application access sequence, client-generated handshake characteristics not modified by the hotspot, and periodic communication relationships as candidate comparable features. If the located asset simultaneously maintains controlled internal network access and connects to a mobile hotspot or portable WiFi via another wireless interface, the controlled internal network may not be able to observe the actual external connection. The server uses the asset's online status at the time of the alarm, previously established stable application fingerprints, cross-window access cycles, and the allowed hop count and port behavior of the hotspot path for correlation. When actual internal external connections are lacking, port-to-port mapping evidence is not generated; instead, the requirements for stable application characteristics and multi-window repetitive relationships are increased.

[0145] The lifetime transformation parameters of a mobile hotspot include the additional hop count range generated by hotspot forwarding, port mapping parameters including the port hold-up, sequential allocation, or randomization state performed by the hotspot for wireless terminal connections, and timing parameters including the allowable latency range generated by wireless access and the mobile network. The server uses multiple connections in the same external access event group to jointly estimate the above parameters. When the latency or port difference of a single connection exceeds the range, a soft conflict is initially formed. Only when differences that cannot be explained by the hotspot path consistently appear in multiple complete connections is it upgraded to evidence of a path conflict.

[0146] After the path transformation is complete, the server generates a comparison state for each feature. Features that are validly observed and consistent form supporting evidence; features that are validly observed but inconsistent, and whose corresponding differences cannot be explained by any valid candidate path parameters, form conflicting evidence; features with missing data or whose paths are not visible form incomparable states. Incomparable states retain the reason for not participating in the calculation, without increasing the number of supports or conflicts.

[0147] Conflict evidence can be further categorized into identity timeliness conflicts, online status conflicts, protocol capability conflicts, path parameter conflicts, and feature value conflicts. Identity timeliness conflicts indicate that the alarm time does not fall within the validity period of the candidate asset address lease or access relationship; online status conflicts indicate that multiple independent data collection sources confirm that the candidate asset did not have communication capabilities at that time; protocol capability conflicts indicate that the asset's capabilities, confirmed by active probing and historical communication, do not support the protocol used by the external access event; path parameter conflicts indicate that the time to live, port mapping, or session causality cannot fall within the allowed range of the corresponding path; and feature value conflicts indicate that the high reliability characteristics that should be maintained are inconsistent on both sides.

[0148] The absence of candidate assets from a single data source, missing individual messages, incomplete handshakes, or the inability to see internal network fields at the internet-side observation location do not constitute the aforementioned conflicts. For address leases at boundary moments, session sequence relationships with clock uncertainties, and short-term changing User-Agent fields, soft conflicts can be initially established, with conflict weights reduced based on source reliability. Only inconsistencies with a clearly defined validity period or repeatedly proven by multiple independent records are considered as conflict evidence with higher weight.

[0149] For candidate asset 'a', external access event 'e', ​​and path transformation hypothesis 'h', the server forms a joint confidence level based on supporting evidence normalization, conflicting evidence normalization, and cross-window consistency. The cross-window consistency level checks not only for duplicate identical feature values ​​but also for duplicate identical path types, port mapping rules, proxy session chains, and time phases. If a candidate asset achieves a high single-window similarity solely based on common features generated by shared proxy nodes but cannot establish a persistent relationship between inner and outer sessions, its cross-window consistency remains low. If another candidate asset consistently forms the same port mapping rules or session chains across multiple events, the joint confidence level of that asset and the corresponding path combination is increased.

[0150] The determination of path transformation hypotheses includes confirmed paths, candidate paths, and unknown paths. Confirmed paths indicate that the key parameters of the path have been verified in the current and adjacent events, and there are no highly reliable path conflicts. Candidate paths indicate that existing evidence can explain the main feature changes, but parameter stability or session chains still need to be verified. Unknown paths indicate that direct connections, network address translation, proxy forwarding, and mobile hotspots cannot reasonably explain the currently comparable features. In the unknown path state, the original features and conflict locations are retained for recalculation after adding new tunnel, forwarding, or encapsulation path rules.

[0151] Figure 4 The comparison under the same observation conditions on the right indicates that only the expected external fingerprint processed by the corresponding path state rules is compared with the actual external access fingerprint. Direct paths output preserved features and hop count predictions; network address translation paths output port-mapped connection features; proxy forwarding paths output dual-segment session chains and preserved client features; and mobile hotspot paths output application and time sequence features with allowed variation ranges. Each branch will not use features already set to be invisible to the path or regenerated by intermediate nodes as direct terminal identity features, thus enabling the joint confidence score to reflect the combined explanatory power of candidate assets and external paths.

[0152] Example 4

[0153] This embodiment provides a proxy-free, unauthorized external connection dual-domain fingerprint positioning system, and combines it with... Figure 5 This section describes each functional module and its specific implementation. The system includes an internal network asset fingerprint generation module, an external access fingerprint generation module, a time alignment and candidate generation module, a path transformation and association calculation module, and a location output and verification module. Each module can be implemented by different service processes within the associated location server, or by different functional units within the same processing process. Module division is used to represent data processing responsibilities and input / output relationships; it does not require each module to correspond to an independent physical device.

[0154] The internal network asset fingerprint generation module acquires internal network asset detection data, communication traffic data, address allocation data, and access topology data. It establishes an identity chain between asset identity, network address, and access location based on data validity time. It generates protocol stack responses, application interactions, and connection timing characteristics from active scanning responses and passive traffic records, and generates internal network asset fingerprints indexed by asset instance and time version. This module also stores the collection source, collection time, reliability, validity period, and data quality status, enabling internal network asset fingerprints to be traced back to the time of alarms.

[0155] The external access fingerprint generation module receives external alarm data from the internet side, standardizes the time, address, protocol, application, and access target fields from different alarm sources, aggregates alarm records belonging to the same access process into external access events, forms protocol stack, application, and connection timing characteristics from these external access events, and marks the status of each characteristic's valid observation, collection, or path invisibility, thus generating an external access fingerprint. This module maintains the reference relationship between the standardized records and the original external alarms.

[0156] The time alignment and candidate generation module calibrates the time offset between internal network asset fingerprints and external access fingerprints, queries the valid identity chain and asset communication status according to the calibrated alarm period, and generates a candidate asset set using a dual-domain comparable feature index. This module expands the candidate time window when time calibration reliability is insufficient, and retains assets with valid network identities and communication activities when external access fingerprint comparable features are insufficient, avoiding premature deletion of candidate assets due to the lack of a single data source.

[0157] The path transformation and association calculation module establishes path transformation hypotheses for candidate assets, including direct connection, network address translation (NAT), proxy forwarding, and mobile hotspots. Based on corresponding feature state rules, it converts the internal network asset fingerprint into a projected external fingerprint. The module compares the projected external fingerprint with the actual external access fingerprint, generating supporting evidence, conflicting evidence, and incomparable states. It also calculates the joint confidence of the candidate asset and the path transformation hypothesis by incorporating cross-time window consistency relationships. This module is also used to estimate NAT port mapping rules and proxy two-segment session relationships.

[0158] The location output and verification module generates unique location, candidate retention, or insufficient fingerprint coverage results based on joint confidence, location threshold, and confidence intervals between different candidate assets. When the unique location condition is met, this module outputs the actual internal network asset, the network address at the time of the alarm, the access location, the external connection path, and the associated evidence chain. When the unique location condition is not met, it generates a verification task that does not require installing a client on the candidate asset, and triggers internal network asset fingerprint updates and re-associations based on the verification data.

[0159] In terms of specific implementation, such as Figure 5 As shown, the system includes an intranet acquisition node set up in the controlled intranet, an alarm access node connected to the external alarm system on the Internet side, an associated positioning server, and a verification interface connected to the network management device. Figure 5The dashed area on the left represents the controlled intranet, the solid area in the middle represents the associated location server, and the dashed area on the right represents the internet side. Solid arrows indicate fingerprint data, alarm data, processing results, or storage / writing relationships, while dashed arrows indicate the relationships between review tasks, controlled detection, identity queries, and review data feedback. The solid line for "Standardized Alarms" in the diagram represents the data path transmitted from the alarm access node to the external fingerprint generation module after the alarm access node completes field standardization. It is led out from the internet-side alarm system to reduce cross-cutting and does not indicate bypassing the alarm access node. The "Assets, Locations, Paths, and Associated Evidence Chains" on the right is the output generated by the location output and review module through the result interface. The alarm access node can only act as a transfer node for this result and does not participate in the location result calculation. The dashed line marking "Review Data" indicates that the location output and review module receive the review result according to the task identifier and transfer the review result to the intranet asset fingerprint generation module to form a new fingerprint version.

[0160] The objects to be located within the controlled intranet include printers, cameras, IoT terminals, and other network devices. These objects are connected to switches or wireless access devices and do not require proxy communication with the associated location server. Mirroring ports on the switches or network routing devices form traffic mirroring links, sending passive traffic copies to the intranet collection nodes. The intranet collection nodes send probe requests to the controlled address range via asset detection links and obtain address allocations, domain name resolutions, and access topology records from the Dynamic Host Configuration Protocol (DHCP) server, Domain Name System (DNS) server, switching devices, and wireless controllers.

[0161] The intranet acquisition node can be configured with two logical interfaces. The first logical interface receives traffic mirroring but does not send packets to the observed link; the second logical interface manages communication and controlled active probing. Packets received by the traffic mirroring interface enter a passive parsing queue, forming passive traffic records based on connections, transactions, and time windows. The active probing interface generates a probing plan based on asset type, address range, and verification tasks, and controls the number of probing requests sent per unit time according to a rate limiter. Both types of records are sent to the intranet asset fingerprint generation module after the intranet acquisition node completes timestamp marking, source marking, and integrity checks.

[0162] To ensure dumb terminals can be identified, the intranet data collection nodes do not invoke the terminal's local program interface. Active probing utilizes the terminal's existing network protocol responses, while passive data collection uses copies of messages generated during normal terminal communication. Identity and topology queries use records already stored in the intranet's basic services and network management devices. For assets that do not respond to active probing, the intranet asset fingerprint generation module can still generate asset records based on address leases, access topology, and passive communication. For assets with low communication frequency, low-frequency retries can be triggered by the verification interface, but a lack of response is not automatically considered an asset non-existent.

[0163] Figure 5 The central location server is equipped with a processor, memory, network interface, and persistent storage. The processor executes data processing instructions corresponding to five functional modules. The memory stores candidate assets, path parameters, and evidence calculation status for the current processing task. The network interface receives data collected from the internal network and alarm access data, and sends verification queries to the network management device. The persistent storage device is configured with a dual-domain fingerprint storage area and an evidence chain storage area. In actual deployment, the two storage areas can be located in different logical areas of the same database system, or they can be set up in mutually isolated database services.

[0164] The intranet asset fingerprint generation module consists of a data access unit, an identity chain construction unit, a feature extraction unit, and a version management unit. The data access unit verifies the source identifier, time format, and integrity status of intranet collected records and writes the records to a processing queue. The identity chain construction unit establishes time-related relationships based on the data structure of asset identifier nodes, network interface nodes, address lease nodes, and access location nodes. The feature extraction unit extracts protocol stack responses, domain name relationships, JA3 fingerprints, User-Agent fields, and behavioral timing features from active scanning responses and passive traffic. The version management unit establishes time versions based on lease, topology, interface ownership, or changes in stable characteristics and writes the intranet asset fingerprint to a dual-domain fingerprint storage area.

[0165] Internal network asset fingerprints are stored using an asset identifier and version identifier as a combined index, while auxiliary indexes are established for network address and validity period, media access control address and validity period, access location and validity period, and feature value and validity period. These auxiliary indexes are used to reverse-engineer candidate assets from external alarm timestamps and externally comparable features. Each index record contains a reference to the original collection record, thus allowing the source of the collection that formed the index entry to be retrieved after recalling candidate assets through the index.

[0166] The alarm access node is located between the external alarm system on the internet side and the associated location server. The alarm access node obtains external alarms through a read-only alarm interface, message subscription interface, or alarm file receiving interface, but does not send internal network asset data to the external alarm system. The alarm access node is equipped with a source adaptation unit and a field normalization unit. The source adaptation unit identifies the data formats of different alarm systems, and the field normalization unit converts the alarm identifier, time, public network source information, access target, protocol, and fingerprint fields into a unified structure and generates a reference pointing to the original alarm. Optionally, the alarm access node also includes a result transfer unit, which only receives the asset, location, path, result level, and evidence reference summary generated by the location output and verification module, and transfers it to the internet-side result interface; this result transfer unit does not read internal network asset fingerprints or evidence chain details.

[0167] The external access fingerprint generation module is configured with an event aggregation unit, an external feature extraction unit, and an observable status marking unit. The event aggregation unit aggregates alarm records based on session identifier, public network source identifier, access target, and temporal proximity. The external feature extraction unit generates external source port sequences, observation lifetimes, domain names or target sequences, JA3 fingerprints, User-Agent fields, and connection activity profiles. The observable status marking unit sets valid observation, missing collection, or path-invisible statuses based on alarm collection location, protocol encryption status, and message integrity. The generated external access fingerprint is written to a dual-domain fingerprint storage area, but uses different data partitions and access permissions than the internal network asset fingerprint.

[0168] The time alignment and candidate generation module includes a time calibration unit, a historical status query unit, and a feature index recall unit. The time calibration unit prioritizes using baseline communication events recorded jointly by internal and external networks to calculate offsets. When baseline events are lacking, it performs sliding correlation on the access target sequence and connection activity sequence. The historical status query unit queries valid address leases, access locations, and online status based on the calibrated alarm window. The feature index recall unit queries domain names, JA3 fingerprints, User-Agent fields, protocol stack responses, access target order, connection cycles, and port behavior indexes, and combines the results with the historical status query results to form a candidate asset set.

[0169] The path transformation and association calculation module includes a path rule unit, a parameter estimation unit, a fingerprint transformation unit, and an evidence fusion unit. The path rule unit stores the feature status rules corresponding to direct connections, network address translation, proxy forwarding, and mobile hotspots. The parameter estimation unit estimates forwarding hops, port mapping, proxy sessions, and allowed latency based on connection pairing results. The fingerprint transformation unit directly writes the preserved features from the internal network asset fingerprint into the expected external fingerprint, transforms predictable transformation features according to path parameters, replaces intermediate node regenerated features with session chain requirements, and sets path-invisible features to not participate in comparison. The evidence fusion unit generates evidence units and calculates joint confidence, writing the path parameters, transformation rule version, and comparison results into the evidence chain storage area.

[0170] The location output and verification module is configured with a result judgment unit, an evidence chain organization unit, and a verification task generation unit. The result judgment unit sorts candidate assets and path combinations, determining the result type based on the highest joint confidence level and its confidence interval relative to the second-highest candidate asset. The evidence chain organization unit connects the original alarm reference, time calibration, candidate asset identity chain version, path transformation hypothesis, supporting evidence, conflicting evidence, and result records. The verification task generation unit selects active probing, historical lease query, access topology query, or subsequent communication observation tasks based on candidate differences and sends them to the corresponding intranet devices via the verification interface. After the verification interface returns data, this unit receives the verification results according to the task identifier and transfers the collection records used for fingerprint updates to the intranet asset fingerprint generation module.

[0171] The verification interface includes a query adaptation unit and a probe control unit. The query adaptation unit reads the Dynamic Host Configuration Protocol (DHCP) lease, switch address forwarding table, wireless association records, and port status according to the interface format provided by the network management device. The probe control unit converts the verification task into a probe request that the intranet acquisition nodes can execute, and sets the target address, probe type, rate limit, retry conditions, and task validity period. The data returned by the verification interface carries a task identifier, enabling the intranet asset fingerprint generation module to associate the verification results with the external access events and candidate assets that triggered the task.

[0172] Figure 5 The positioning output and verification module outputs asset, location, path, and associated evidence chain to the internet-side result interface. The result interface can be provided directly by the associated positioning server or carried by the result transfer unit of the alarm access node. The result interface can return the asset management identifier, network address at the time of the alarm, media access control address, switch port or wireless access point, virtual LAN, network area, path type, result level, and evidence citation. The result level is used to distinguish between unique positioning, candidate retention, and insufficient fingerprint coverage; the evidence citation is used to query specific supporting evidence and conflicting evidence, and does not require the result recipient to directly read the internal network asset fingerprint storage area.

[0173] The associated location server implements interface isolation for dual-domain data. Internet-side alarm access nodes can only write standardized alarms to the external fingerprint generation module and receive result summaries provided by the location output and verification modules; they cannot query internal network asset fingerprints or evidence chain details. Internal network acquisition nodes can only upload internal network observation data and receive controlled verification tasks; they cannot read original alarms from the internet side. The path transformation and association calculation module reads the two data partitions through internal event identifiers, time windows, and standardized fingerprints. This interface relationship enables technical association of dual-domain data while preventing the entire internal network asset database from being exposed to the internet-side alarm system.

[0174] The system can be deployed centrally or with intranet data collection nodes deployed in different network areas, while the five functional modules are centrally deployed on the associated location server. Multiple intranet data collection nodes upload records using their respective data collection location identifiers. The server retains the observation location in the feature unit to calculate the forwarding hop count and determine the independence of the data source. Alarm access nodes can connect to multiple internet-side alarm systems simultaneously and distinguish collection capabilities and field visibility ranges through source identifiers. When adding new data collection nodes or alarm sources, only the corresponding source adaptation relationship needs to be added; the data structure of asset identity chain, path transformation, and evidence fusion remains unchanged.

[0175] When a processing task is interrupted, the server resumes the task based on the external access event identifier and the current processing stage. Internal network asset fingerprints, external access fingerprints, and evidence chain records are all written using versioning; incomplete path parameters are not estimated to overwrite already confirmed fingerprint versions. Verification tasks are configured with status fields to distinguish between pending, in progress, completed, timed out, and canceled states; duplicate verification data is deduplicated based on the task identifier and collection record summary. This allows the location process to continue even after data delays, short-term offline status of collection nodes, or server restarts.

[0176] The functional modules in this embodiment correspond to the steps and flow of Embodiment 1. The intranet asset fingerprint generation module executes step S1, the external access fingerprint generation module executes step S2, the time alignment and candidate generation module executes step S3, the path transformation and association calculation module executes step S4, and the location output and verification module executes step S5. The modules communicate using time-versioned fingerprints, candidate asset records, path transformation hypotheses, evidence units, and verification tasks, enabling the method processing to be streamlined. Figure 5 The system architecture shown is implemented.

[0177] Example 5

[0178] This embodiment combines Figure 6 and Figure 7 Using a controlled network equipped with office terminals, security equipment, and IoT devices as an application scenario, this paper illustrates the deployment conditions, equipment configuration, processing parameters, execution process, and output results of the agentless unauthorized external connection dual-domain fingerprint positioning method. Figure 6 The "dual-domain associated location server" mentioned above refers to the aforementioned associated location server. Figure 6Asset A is a network printer, asset B is a network camera, and asset C is an IoT terminal. None of the three assets have client programs installed for external location tracking. Asset A accesses the internet target via a privately configured gateway after performing network address translation; asset B accesses the internet target via a connection-reconstruction proxy node; and asset C, while maintaining controlled network access, forms another external connection path via a mobile hotspot or portable Wi-Fi. These three scenarios can occur separately or be handled by the same system within different time windows.

[0179] The controlled network in this embodiment includes aggregation switches, access switches, wireless access points, a Dynamic Host Configuration Protocol (DHCP) server, a Domain Name System (DNS) server, and a network management platform. The network management platform provides switch address forwarding tables, port status, VLAN affiliation, and wireless terminal association records. Aggregation switches support replicating the ingress / egress traffic and key network area traffic of the controlled network to mirror ports. The DHCP server stores address lease start and end times, and the DNS server stores query times and query names. The internet-side external connection alarm system provides alarm time, public network source address, external source port, access target, transmission protocol, and handshake or application characteristics that can be parsed from the collection location. If a field cannot be observed from the alarm location, the alarm access node marks it as path invisible and does not use it as a null value in similarity calculations.

[0180] In a hardware configuration adapted to a gigabit-level controlled network, the intranet acquisition node employs a general-purpose computing device with a multi-core processor, RAM, persistent storage, and two network interfaces. One network interface operates in traffic mirroring reception mode, while the other is used for management communication and controlled active probing. The association and location server employs a server with a multi-core processor, large-capacity RAM, and persistent storage. The persistent storage stores time-versioned dual-domain fingerprints, feature indexes, and associated evidence chains. Alarm access nodes can be deployed in conjunction with the association and location server or configured as independent devices capable only of reading external alarms. Actual processing capacity scales based on the mirrored traffic volume, number of assets, and alarm concurrency; the hardware model and processor architecture do not affect the data processing relationships in this embodiment.

[0181] Internal network data acquisition nodes and associated location servers use a unified time source. Device clock tolerances are further corrected by a time calibration process. Active scanning is performed using address segmentation, with a regular probe interval of thirty minutes for the same asset. A maximum of two retries are allowed for a single no-response attempt. Probes triggered by verification tasks take precedence over periodic probes, but are still limited by the number of requests per unit time. Passive traffic generates connection activity sequences at five-second granularity and generates access target order, source port behavior, and traffic burst profiles within a five-minute window. The above values ​​illustrate a feasible configuration; adjustments can be made while maintaining the same processing relationships as network size or asset communication cycles change.

[0182] External alarms use a five-minute initial event aggregation window. The candidate offset range for time calibration is set to ±120 seconds; when the dispersion of offsets obtained from multiple baseline communication events exceeds a preset range, the candidate time window is expanded forward and backward by one aggregation window. Candidate asset generation uses both the identity chain and feature index valid at the alarm time, and does not require the public network source address to be directly equal to the internal network address as a necessary condition for candidate generation. In one configuration of this embodiment, the location threshold θ_loc is set to 0.80, the differentiation threshold θ_gap is set to 0.15, and the candidate retention threshold θ_keep is set to 0.55. The thresholds are part of the server's operational configuration and can be recalibrated based on historical events that have been manually reviewed; they do not constitute a limitation on the scope of application of the method.

[0183] Before the system is put into processing, the intranet data collection nodes establish time-versioned asset fingerprints for assets A, B, and C during baseline observation. Asset A's identity chain includes the printer asset identifier, network interface, dynamic address lease, and access switch port. Its active fingerprint includes port response, transmission control protocol option arrangement, and estimated initial time to live. Its passive fingerprint includes print service communication, domain name lookup relationships, and periodic status access. Asset B's identity chain includes the camera asset identifier, fixed address or reserved lease, access location, and device category. Its passive fingerprint includes video management target, encrypted handshake characteristics, connection duration, and periodic heartbeats. Asset C's identity chain includes the IoT terminal asset identifier, wired or wireless interface, controlled network address, and access location. Its fingerprint includes device service response, stable access target sequence, connection cycle, and obtainable JA3 fingerprint.

[0184] Features acquired during baseline observation are not permanent static templates. The server generates corresponding time versions based on address leases, access locations, and feature validity periods. When a device address changes, the old address lease relationship is terminated and a new version is generated; when a device switches from a wired interface to a wireless interface, the validity periods of both interfaces are saved separately; short-term source port behavior is only valid within the corresponding statistical window; device categories, service certificates, or application features that have remained consistent through multiple observations adopt longer validity periods. After an alarm occurs on the Internet side, the server selects the historical version that matches the alarm time, and does not use the current address at the time of alarm processing to replace the address at the time of alarm.

[0185] During the process of asset A connecting to the outside world through a privately configured gateway, the internal network acquisition node first obtains the connection record from asset A to the privately configured gateway, and the external connection alarm system obtains the connection record from the public network side of the privately configured gateway to the target internet access point. The privately configured gateway hides asset A's internal network address and media access control address, and performs mapping on the source port. The server therefore marks the address and media access control address as path-invisible, marks the access target order, the JA3 fingerprint not modified by the gateway, and the User-Agent field as preserved, and marks the time-to-live and source port as predictably changeable.

[0186] The server pairs the inner connections of asset A with the public network connections based on the calibrated connection start time, access target, protocol, and traffic burst location. As an example of port mapping processing, if the source ports of consecutive inner connections are 49172, 49176, 49180, and 49184, and the corresponding source ports of outer connections are 53312, 53316, 53320, and 53324, then the paired ports maintain the same offset, and the server establishes a fixed offset candidate rule. This numerical sequence is a configuration illustration example, used only to illustrate the formation process of port mapping rules, and does not represent specific field measurement results. The server continues to verify whether the port increment direction and offset are maintained in subsequent windows; if they can be repeatedly true, evidence supporting the network address translation path is formed; if they cannot be repeatedly true, the rule is adjusted to sequential allocation or random mapping candidate, rather than directly confirming the asset based on a single port correspondence.

[0187] The evidence chain corresponding to asset A sequentially connects the original external alarm, the standardized external access event, the alarm time calibration record, the asset identity chain version at the time of the alarm, the internal and external connection pairing, the port mapping rules, the result of maintaining feature comparison, and the path determination result. When the combination of asset A and the network address translation path satisfies the unique location condition, the server outputs the asset management identifier of asset A, the internal network address at the time of the alarm, the media access control address, the access switch port, the private gateway path, and the evidence reference. The output public network source address is still saved as an external access event attribute and is not written into the internal network address field of asset A.

[0188] During the process of Asset B connecting to external networks via a proxy node, the controlled network mirror traffic includes the inner session from Asset B to the proxy node, while the internet-side alarms include the outer session from the proxy node to the access target. Because the proxy node re-establishes the transport connection and encrypts the session, the external JA3 fingerprint, transport control protocol options, and time-to-live reflect the proxy node's characteristics, not Asset B's. The server sets these characteristics to the intermediate node's regenerated state and does not use the proxy node's fingerprint as evidence of conflict with Asset B.

[0189] The server obtains the request time, resolvable target relationship, connection duration, and bidirectional communication activity sequence from the inner session of asset B to the proxy node, and then obtains the corresponding information from the outer session of the proxy node. A two-segment session chain is established when the inner request precedes the outer connection and the interval between the two is within the proxy processing latency range; the access target can be matched through domain name resolution or service mapping; and the burst positions of the uplink request and downlink response can form a sequential correspondence. If multiple assets use the proxy node simultaneously, the server performs exclusive matching on the inner sessions competing for the same outer session and uses the repeated correspondence in multiple external access events to determine the real initiating asset.

[0190] The location evidence chain for asset B connects asset B's identity chain, internal sessions, proxy nodes, external sessions, and external alarms. The proxy node's public IP address and handshake fingerprint are used to confirm the path node, not to directly represent the actual internal network asset. When the unique location condition is met, the system outputs asset B and its access location, and marks the external path as proxy forwarding; when the correspondence between the two sessions is insufficient, the system retains asset B and other candidate assets whose alarms can still be interpreted, generates subsequent communication observation tasks, and does not force a unique result to be output.

[0191] During the processing of asset C's external connections via mobile hotspot or portable WiFi, the external connection does not pass through the controlled network exit, and the internal network data collection nodes may not be able to obtain the internal packets corresponding one-to-one with this connection. The server associates asset C's identity chain in the controlled network during the alarm period, the previously formed stable application fingerprint, the order of external access targets, JA3 fingerprint, connection period, and the allowed hop count and port change range of the mobile hotspot. Due to the lack of internal and external connection pairing, the server does not generate one-to-one network address translation port evidence and enhances the role of cross-time window consistency in joint confidence.

[0192] When asset C repeatedly exhibits the same access target sequence, similar connection periods, and maintainable handshake characteristics in multiple separate alarm windows, and other candidate assets have conflicting protocol capabilities, online status, or stability characteristics during the corresponding time periods, the system can generate a joint location result for asset C and the mobile hotspot path. If the external access fingerprint only contains the public network address and access time, and cannot form a distinctive characteristic relationship with asset C, the system outputs insufficient fingerprint coverage and does not directly identify it as a real asset based on the condition that asset C was once online. Subsequently, the location output and verification module can arrange low-frequency active probing, historical access location query, and subsequent communication observation. The verification process does not require the installation of programs in asset C.

[0193] After the verification task returns, the server writes the obtained data into the internal network asset fingerprint version corresponding to the collection time. If the query results prove that the candidate asset was not located at its original access location during the alarm period, the server establishes an identity timeliness conflict; if the new proactive probe again obtains stable protocol capabilities consistent with external events, it forms supplementary supporting evidence; if subsequent observations show the same access cycle and target order again, the cross-window consistency relationship is updated. The server saves the result records before and after recalculation and their fingerprint versions, enabling the location conclusion to explain what new evidence caused the change.

[0194] Figure 7 This figure is used to compare the differences in data processing results between direct matching of the original field and path transformation association processing in this embodiment. This figure does not represent the statistical performance calculated based on a specific number of samples. The boxes, arrows and result statuses in the sub-figures only represent the two processing routes and the possible result categories, and do not include measured curves or preset performance values. Figure 7 In Figure 7 (a) indicates that the Internet Protocol address, Media Access Control address, Time to Live, and port on the intranet and Internet sides are compared field by field. After private gateways, proxy nodes, or mobile hotspots change the address, port, and protocol stack characteristics, real assets may be excluded due to field inequality, or multiple assets may form multiple candidates with the same score because they share the same exit or proxy characteristics.

[0195] Figure 7 In Figure 7 (b) indicates that the server first performs feature state determination, processes the features into preservation, predictable transformation, intermediate node regeneration or path not visible, and then transforms them into supporting evidence, conflicting evidence and cross-window consistent relationship under the same observation conditions. Figure 7In (b), "intermediate node reconstruction" is a diagrammatic abbreviation for "intermediate node regeneration state," and the two have the same meaning. Therefore, the path invisibility field is no longer used as a basis for rejecting assets, predictable changes are interpreted by hop count or port mapping rules, the characteristics of the regenerated proxy node are no longer incorrectly attributed to the terminal, and the application and timing characteristics that can be retained continue to be used to distinguish candidate assets.

[0196] Figure 7 In Figure 7 (c) indicates that the system outputs a unique location, candidate retention, or insufficient fingerprint coverage based on the sufficiency of the evidence, and triggers agentless review when the evidence is insufficient. Figure 7 The processing described does not guarantee that all alarms output unique assets, but rather ensures that the output corresponds to currently observable evidence. Its technical effectiveness lies in preserving the possibility of associating real assets under conditions of address translation, path masking, or session reconstruction, while explicitly preserving the uncertain state for events that cannot be distinguished by existing evidence.

[0197] The processing differences for the three external connection scenarios can be represented in the table below.

[0198]

[0199] Once the location is established, the results record should be traceable back to at least the original external alarm, alarm field normalization record, external access fingerprint, asset identity chain version at the time of the alarm, candidate generation basis, path transformation assumptions and parameters, item-by-item supporting evidence and conflicting evidence, threshold determination record, and review task record. Reviewers or network administrators can query the corresponding evidence references from the location results and confirm the formation process between the located asset, the address at the time of the alarm, the access location, and the external path. If belated address leases, topology records, or alarm data are subsequently obtained, the server will reprocess them with a new version while retaining the original results, without overwriting the already formed historical evidence chain.

[0200] This embodiment also applies to devices that cannot respond to a complete active scan. Network printers, network cameras, or IoT terminals only need to maintain their original network communication capabilities, and the internal network acquisition nodes can form asset fingerprints from traffic mirroring, network infrastructure services, and controlled probe responses. For devices that do not generate any observable traffic and do not respond to controlled probes, the system still retains their address leases and access locations, but when external evidence is insufficient, the output fingerprint coverage is insufficient, and no unique location conclusion exceeding the observation conditions is generated.

[0201] Through the above deployment and processing Figure 6The three types of unauthorized external connection paths shown are all converted into a joint location problem of assets and paths. The system output includes not only the real internal network assets, but also the valid network address, access location, external connection path type, and traceable evidence chain at the time of the alarm. When the existing evidence cannot meet the unique location conditions, fingerprints are supplemented through network-side queries, controlled active probing, or subsequent communication observation, and then the dual-domain association is re-executed, thereby completing the closed-loop processing without relying on the terminal client program.

[0202] The above detailed embodiments illustrate the method flow, key data structures, path transformation processing, system modules, and application scenarios of the present invention. Each step, module, and data object can be implemented by the same computing device, or by multiple computing devices connected through a controlled communication link, depending on the scale and deployment method of the controlled network. While maintaining consistency in input, processing relationships, and output results, the execution order of each step can be adjusted according to data dependencies.

[0203] Equivalent substitutions and conventional adjustments made by those skilled in the art based on the disclosure in this specification to the data acquisition interface, feature normalization method, storage structure, threshold configuration, or deployment location will not affect the processing relationships between time-versioned dual-domain fingerprints, path transformation associations, support and conflict evidence fusion, and agentless verification in the technical solution of this invention.

Claims

1. A method for locating unauthorized external connections using dual-domain fingerprinting without a proxy, characterized in that, Performed by the associated location server, including: S1. Obtain asset detection data, communication traffic data, address allocation data and access topology data from the intranet side. Establish an identity chain of asset identity, network address and access location according to the effective time. Extract protocol stack response, application interaction and connection timing features from it. Generate time-versioned intranet asset fingerprints using the identity chain as an index. S2 receives external alarm data from the Internet side, aggregates alarm records of the same access process to form external access events, extracts external access features from them and records the observable state of the features, and generates external access fingerprints. S3, perform time alignment on the two types of fingerprints, filter candidate assets based on the valid identity chain and asset communication status within the alarm period, and generate a candidate asset set with dual-domain comparable features; S4. For candidate assets, establish path transformation hypotheses such as direct connection, network address translation, proxy forwarding, or mobile hotspot. Convert the internal network asset fingerprint into the expected external fingerprint under the corresponding path and compare it with the external access fingerprint. Integrate feature support, feature conflict, and cross-time window consistency to obtain the joint confidence of candidate assets and path transformation hypotheses. S5 determines the location result based on the joint confidence level and the confidence level interval between candidate assets. When the unique location condition is met, it outputs the real internal network asset, the network address at the time of the alarm, the access location, the corresponding external connection path, and the associated evidence chain. When the unique location condition is not met, it generates an agentless review task for candidate assets, updates the internal network asset fingerprint based on the review data, and redetermines the location result.

2. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 1, characterized in that, In step S1, the identity chain is formed by connecting asset identification nodes, network interface nodes, address lease nodes, and access location nodes according to their respective valid start and end times. Address lease nodes associate dynamically allocated network addresses with corresponding network interface nodes, and access location nodes associate the network interface nodes with switch ports or wireless access points. The response characteristics obtained from active probing and the communication characteristics obtained from passive traffic are normalized into asset feature units. Each asset feature unit is associated with the collection source, collection time, validity period, and quality status. When the network address or access location of an asset changes, the identity chain is continued based on the asset identification nodes and network interface nodes that are still in a valid state. The asset feature units before and after the change are written into the corresponding time versions, allowing the network identity and communication characteristics of the same asset at different times to be traced back.

3. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 2, characterized in that, In steps S2 and S3, firstly, external alarm records are merged based on public network source identifiers, access targets, and temporal proximity. Features that can be observed but not successfully acquired at the alarm collection location are marked as missing features, and features that cannot be observed at the collection location due to external path obstruction are marked as invisible features. Then, the time offset between the two sides is determined using communication events jointly recorded by the intranet side and the Internet side. When there are no jointly recorded communication events, the offset that maximizes the consistency between the access target sequence and the connection activity sequence on both sides is selected as the time calibration amount by moving the time window of the external access event. The identity chain is queried according to the calibrated alarm time period to filter assets with valid network identities and communication activities during that time period, and a candidate asset set is generated using the index hit results of comparable features.

4. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 3, characterized in that, In step S4, the path transformation assumption includes feature state rules corresponding to external paths. These feature state rules divide the features in the internal network asset fingerprint into states that are maintained after path transmission, undergo predictable transformations according to path parameters, are regenerated by intermediate nodes, and are invisible on the Internet side. For features in the maintained state, the corresponding expected external features are directly generated. For features in the predictable transformation state, the expected external features are generated after transformation according to candidate path parameters. For features in the regenerated state, path evidence is formed by associating the candidate asset with the internal session of the intermediate node and the external session of the intermediate node with the access target. For features in the invisible state, similarity or conflict judgments are stopped, thereby converting the internal network asset fingerprints under different external paths into fingerprints to be compared under the same observation conditions as the external access fingerprints.

5. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 4, characterized in that, In step S4, the result of a feature comparison between the fingerprint to be compared and the external access fingerprint is recorded as an evidence unit. The evidence unit includes the corresponding candidate asset, path transformation hypothesis, observation time, collection source, feature reliability, feature discriminativeness, and comparison status. Supporting evidence is formed when the comparable features match, and conflicting evidence is formed when the comparable features do not match and the discrepancy cannot be explained by the path transformation hypothesis. Missing collection or invisible path does not form conflicting evidence. The association support amount is accumulated based on the reliability and discriminativeness of the supporting evidence, and the conflict suppression amount is accumulated based on the reliability of the conflicting evidence. The association support amount is corrected by using the repeated support relationship of the same candidate asset in different time windows to obtain the joint confidence level, so that the common features generated by the common intermediate node are not used as the main basis for distinguishing multiple internal network assets.

6. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 5, characterized in that, For path transformation hypotheses corresponding to network address translation, the inner connections of candidate assets are paired with the outer connections in external access events according to the access target and connection time. The relative relationships between the source port sequences of the paired connections are compared to generate port mapping rules that can characterize port persistence, port offset, or changes in allocation order. The inner source port sequences of candidate assets are converted into predicted outer source port sequences using the port mapping rules, and the sequence consistency and cross-time window stability are verified with the actual outer source port sequences. When the same port mapping rule remains valid in consecutive external access events, the verification results form path evidence supporting the candidate asset and network address translation path. When the port mapping rule cannot be stably reproduced, the joint confidence of the corresponding path transformation hypothesis is reduced.

7. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 5, characterized in that, Assuming a path transformation for proxy forwarding, the internal session from the candidate asset to the proxy node is obtained from intranet communication traffic, and the external session from the proxy node to the access target is obtained from internet-side external alarm data. A session chain between the internal and external sessions is established according to the correspondence of the access target, the sequence of session start and end times, and the changing relationship of bidirectional communication activities. The protocol stack response and handshake features generated by the proxy node re-establishing the connection are marked as intermediate node generation features, and direct identification of candidate assets based on them is stopped. The session chain and the valid identity chain of the candidate asset during the alarm period are used as evidence for asset location. When multiple candidate assets share the proxy node, the multiple candidate assets are distinguished according to the continuous correspondence between the internal and external sessions in multiple access processes.

8. The agentless unauthorized external connection dual-domain fingerprint positioning method according to claim 5, characterized in that, In step S5, the candidate asset with the highest joint confidence is selected as the pending asset. A unique location result is generated only when the joint confidence reaches the location threshold and the interval between it and the second highest joint confidence reaches the distinction threshold. Otherwise, a review task is generated for the retained candidate assets. The review task drives the internal network side acquisition node to re-obtain the detection response of the candidate asset without installing a client on the candidate asset, query the address lease and access topology at the time of the external access event, and obtain the communication activity corresponding to the external access event in the subsequent observation window. After writing the review data into the corresponding time version, path transformation and evidence comparison are performed again, and the original alarm, time calibration record, candidate asset, path transformation hypothesis, evidence unit, review record and location result are associated in the processing order to form the associated evidence chain.

9. A dual-domain fingerprint positioning system for unauthorized external connections without an agent, characterized in that, include: The intranet asset fingerprint generation module is used to acquire asset detection data, communication traffic data, address allocation data and access topology data from the intranet side, establish an identity chain between asset identity and network address and access location according to the validity time of the data, form an intranet feature representation from the asset detection data and communication traffic data, and generate an intranet asset fingerprint with a time version. The external access fingerprint generation module is used to receive external alarm data from the Internet side, aggregate alarm records belonging to the same access process into external access events, form external feature representations from the external access events, record the observable state of each feature, and generate external access fingerprints. The time alignment and candidate generation module is used to align the internal network asset fingerprint with the external access fingerprint in time. It determines candidate assets based on the valid identity chain and asset communication status within the corresponding time period of the external access event, and forms a set of candidate assets based on the comparable feature representations of both sides. The path transformation and association calculation module is used to establish path transformation hypotheses corresponding to direct connection, network address translation, proxy forwarding or mobile hotspot for candidate assets, convert the intranet feature representation into the expected external feature representation, compare the expected external feature representation with the external access fingerprint, and combine the feature support relationship, feature conflict relationship and cross-time window consistency relationship to obtain the joint confidence of candidate assets and path transformation hypotheses. The location output and verification module is used to determine the location result based on the joint confidence level and the confidence interval between candidate assets. When the unique location condition is met, it outputs the real internal network asset, the network address at the time of the alarm, the access location, the corresponding external connection path, and the associated evidence chain. When the unique location condition is not met, it generates an agentless verification task for candidate assets, updates the internal network asset fingerprint based on the verification data, and redetermines the location result.

10. The agentless unauthorized external connection dual-domain fingerprint positioning system according to claim 9, characterized in that, The system includes an intranet acquisition node set up in a controlled intranet, an alarm access node connected to an external alarm system on the Internet side, an association positioning server carrying the module, and a verification interface connected to a network management device. The intranet acquisition node obtains communication traffic data through a traffic mirroring link, asset detection data through an asset detection link, and address allocation data and access topology data from intranet basic services and network management devices. The alarm access node converts the external alarm data into standardized alarm records and sends them to the association positioning server. The association positioning server associates intranet-side data with Internet-side data only through standardized fingerprint records and event identifiers, and queries the network identity and access location of candidate assets or triggers controlled detection through the verification interface to complete positioning and verification when no client is installed on the candidate asset.

Images