Unwanted tunneling alert system

A computer-implemented method comprising:

• as implemented by one or more computer systems comprising computer hardware and memory, the one or more computer systems configured with specific executable instructions,
• identifying a first address included in both a first log and in a second log, wherein the first log identifies one or more second addresses corresponding to one or more users granted access to a network, and wherein the second log identifies one or more third addresses requested via the network;
• determining a score at least partly indicative of a likelihood that a malicious tunneling connection is present based at least partly on the first address;
• and
• initiating termination a first connection if the score satisfies a threshold value.

One or more non-transitory computer-readable mediums comprising one or more program instructions recorded thereon, the instructions configured for execution by a computing system comprising one or more processors to cause the computing system to:

• identify a first address included in both a first log and in a second log, wherein the first log identifies one or more second addresses corresponding to one or more users granted access to a network, and wherein the second log identifies one or more third addresses requested via the network;
• determine a score at least partly indicative of a likelihood that a malicious tunneling connection is present based at least partly on the first address;
• and
• initiate termination a first connection if the score satisfies a threshold value.