# US 12,192,218 B2 · Unwanted tunneling alert system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,218 B2 - Document ID: US12192218B2 - Status: Granted - Kind: B2 - Application number: 18/360,713 - Filed: 2023-07-27 - Published: 2023-11-16 - Granted: 2025-01-07 - Earliest claimed: 2014-08-13 - Assignees: Palantir Technologies Inc. - Applicants: Palantir Technologies Inc. - Inventors: Juan Ricafort; Harkirat Singh; Philip Martin - Web page: https://patentgrep.com/patent/US12192218B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various systems and methods are provided that detect malicious network tunneling. For example, VPN logs and data connection logs may be accessed. The VPN logs may list client IP addresses that have established a VPN connection with an enterprise network. The data connection logs may list client IP addresses that have requested connections external to the enterprise network and remote IP addresses to which connections are requested. The VPN logs and the data connection logs may be parsed to identify IP addresses that are present in the VPN logs as a client IP address and in the data connection logs as a remote IP address. If an IP address is so present, user data and traffic data associated with the IP address may be retrieved to generate a risk score. If the risk score exceeds a threshold, an alert to be displayed in a GUI is generated. ## Claims ### Claim 1 A computing system comprising: one or more computer processors; and one or more non-transitory computer-readable storage mediums storing program instructions configured for execution by the one or more computer processors to cause the computing system to: identify a first network address included in a first log and in a second log, wherein the first log identifies one or more second network addresses corresponding to one or more users granted access to a network, and wherein the second log identifies one or more third network addresses requested via the network; determine based at least partly on the first network address, a score at least partly indicative of a likelihood that a malicious tunneling connection is present; and initiate termination a first connection if the score satisfies a threshold value. ### Claim 2 (depends on 1) The computing system of claim 1, wherein one or more non-transitory computer-readable storage medium further store program instructions that cause the computing system to: generate user interface data that, when executed, causes a user device to display a user interface that depicts a notification derived from the score, wherein a user interface-based interaction with the notification causes the computing system to adjust determination of a future score. ### Claim 3 (depends on 2) The computing system of claim 2, wherein the notification comprises at least one of a number of users that are connected to a known virtual private network (VPN) client during a time period associated with the notification, an indication of whether characteristics of traffic between the network and a second user device matches a tunneled connection profile, an indication of an amount of outbound data transmitted by the second user device to a remote user device, an indication of whether suspicious file transfer protocol (FTP) activity was detected, an indication of whether a country mismatch was detected, or an indication of whether a suspected case of a VPN compromise is present. ### Claim 4 (depends on 2) The computing system of claim 2, wherein one or more non-transitory computer-readable storage medium further store program instructions that cause the computing system to, based on the user interface-based interaction with the notification, update the user interface data such that the user interface includes a window depicting at least one of information of a user associated with the first network address, an indication of whether the user is a person of interest, an indication of a geographic location of the user, or an indication of a geographic location to where the user tunneled. ### Claim 5 (depends on 2) The computing system of claim 2, wherein the one or more non-transitory computer-readable storage mediums further store program instructions that cause the computing system to: receive an indication that the notification is a false positive; and adjust the determination of the future score based on the received indication that the notification is a false positive. ### Claim 6 (depends on 5) The computing system of claim 5, wherein the one or more non-transitory computer-readable storage mediums further store program instructions that cause the computing system to adjust weights of one or more factors used to derive the future score based on the received indication that the notification is a false positive. ### Claim 7 (depends on 2) The computing system of claim 2, wherein, in connection with a determination that the second log indicates that a tunneled connection is established over a first port, the determined future score is lower than if the tunneled connection is established over a second port. ### Claim 8 A computer-implemented method comprising: as implemented by one or more computer systems comprising computer hardware and memory, the one or more computer systems configured with specific executable instructions, identifying a first address included in both a first log and in a second log, wherein the first log identifies one or more second addresses corresponding to one or more users granted access to a network, and wherein the second log identifies one or more third addresses requested via the network; determining a score at least partly indicative of a likelihood that a malicious tunneling connection is present based at least partly on the first address; and initiating termination a first connection if the score satisfies a threshold value. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising, generating user interface data that, when executed, causes a user device to display a user interface that depicts a notification derived from the score, wherein a user interface-based interaction with the notification causes the computing system to adjust determination of a future score. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the notification comprises at least one of a number of users that are connected to a known virtual private network (VPN) client during a time period associated with the notification, an indication of whether characteristics of traffic between the network and a second user device matches a tunneled connection profile, an indication of an amount of outbound data transmitted by the second user device to a remote user device, an indication of whether suspicious file transfer protocol (FTP) activity was detected, an indication of whether a country mismatch was detected, or an indication of whether a suspected case of a VPN compromise is present. ### Claim 11 (depends on 9) The computer-implemented method of claim 9, further comprising, based on the user interface-based interaction with the notification, updating the user interface data such that the user interface includes a window depicting at least one of information of a user associated with the first address, an indication of whether the user is a person of interest, an indication of a geographic location of the user, or an indication of a geographic location to where the user tunneled. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, further comprising: receiving an indication that the notification is a false positive; and adjusting the determination of the future score based on the received indication that the notification is a false positive. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, further comprising adjusting weights of one or more factors used to derive the future score based on the received indication that the notification is a false positive. ### Claim 14 (depends on 9) The computer-implemented method of claim 9, wherein, in connection with a determination that the second log indicates that a tunneled connection is established over a first port, the determined future score is lower than if the tunneled connection is established over a second port. ### Claim 15 One or more non-transitory computer-readable mediums comprising one or more program instructions recorded thereon, the instructions configured for execution by a computing system comprising one or more processors to cause the computing system to: identify a first address included in both a first log and in a second log, wherein the first log identifies one or more second addresses corresponding to one or more users granted access to a network, and wherein the second log identifies one or more third addresses requested via the network; determine a score at least partly indicative of a likelihood that a malicious tunneling connection is present based at least partly on the first address; and initiate termination a first connection if the score satisfies a threshold value. ### Claim 16 (depends on 15) The medium of claim 15, wherein the instructions are further configured to cause the computing system to: generate user interface data that, when executed, causes a user device to display a user interface that depicts a notification derived from the score, wherein a user interface-based interaction with the notification causes the computing system to adjust a determination of a future score. ### Claim 17 (depends on 16) The medium of claim 16, wherein the notification comprises at least one of a number of users that are connected to a known virtual private network (VPN) client during a time period associated with the notification, an indication of whether characteristics of traffic between the network and a second user device matches a tunneled connection profile, an indication of an amount of outbound data transmitted by the second user device to a remote user device, an indication of whether suspicious file transfer protocol (FTP) activity was detected, an indication of whether a country mismatch was detected, or an indication of whether a suspected case of a VPN compromise is present. ### Claim 18 (depends on 16) The medium of claim 16, wherein the instructions are further configured to cause the computing system to, based on the user interface-based interaction with the notification, update the user interface data such that the user interface includes a window depicting at least one of information of a user associated with the first address, an indication of whether the user is a person of interest, an indication of a geographic location of the user, or an indication of a geographic location to where the user tunneled. ### Claim 19 (depends on 16) The medium of claim 16, wherein the instructions are further configured to cause the computing system to: receive an indication that the notification is a false positive; and adjust the determination of the future score based on the received indication that the notification is a false positive. ### Claim 20 (depends on 19) The medium of claim 19, wherein the instructions are further configured to cause the computing system to adjust weights of one or more factors used to derive the future score based on the received indication that the notification is a false positive.