An asset feature correlation type intelligent weak password detection and early warning method and system

Abstract

The application discloses a kind of weak password detection and early warning method and system based on asset feature correlation formula intelligence, method includes: input asset information;Generation asset feature correlation dictionary;Configuration detection task;Select automatic or manual weak password detection task;Scan or identify port;Password collision;Automatic weak password detection report and risk early warning and notification generation;Its efficient asset information management, intelligent password dictionary generation, flexible detection task configuration, diversified detection mode, accurate port scanning identification, automatic report generation and real-time risk early warning and notification etc. together constitute an efficient, accurate and practical weak password detection and early warning system;The application aims at improving network security protection level, ensures asset security.

Description

Technical Field

[0001] This invention belongs to the field of computer network information security technology, and specifically relates to a method and system for detecting and warning of weak passwords based on asset feature association. Background Technology

[0002] With the popularization and development of the Internet, cybersecurity issues have become increasingly prominent, among which weak password attacks have become one of the commonly used attack methods by cyber hackers. Weak passwords refer to passwords that are simple and easy to guess or infer. They are usually composed of simple numbers, letters, or continuous strings, lacking sufficient complexity and randomness, and are therefore vulnerable to cracking and attacks.

[0003] To enhance the security of business systems and prevent potential risks posed by weak passwords, weak password detection technology has emerged. This technology uses a series of algorithms and rules to automatically analyze and detect user-set passwords, determining whether they meet password complexity requirements and whether they are easily guessed or cracked. Once a weak password is detected, the tool takes appropriate measures, such as prompting the user to change the password or automatically rejecting the password setting, thereby protecting user accounts and tool security.

[0004] Existing technical solutions involve creating a password dictionary based on a large number of common password samples, then attempting to connect to the target tool by traversing the passwords in the dictionary, analyzing the response results to identify weak passwords, and then ending the task. However, the effectiveness of such tools largely depends on their built-in password dictionary. If the passwords in the dictionary are not comprehensive enough or are not updated in a timely manner, the tool may fail to detect some new or complex weak passwords. Furthermore, after obtaining the detection results, it cannot provide timely feedback to the relevant personnel, which increases the risk caused by weak passwords due to timeliness issues.

[0005] Patent application CN115412302A discloses a method, apparatus, electronic device, and storage medium for detecting weak passwords. It detects network information assets based on asset detection indication information, including network protocols, and / or ACL and routing configuration information, and / or firewall NAT configuration information, and / or traffic analysis. Network information assets include IP addresses, ports, and application services. The method detects the presence of weak passwords in these IP addresses, ports, and application services; if present, it issues a weak password warning. By integrating network protocols, ACL and routing configuration information, firewall NAT configuration information, and traffic analysis, it achieves network information asset detection. The configuration information can be tailored to the actual production environment, thereby improving asset coverage and detection depth, effectively enhancing asset discovery coverage and capabilities. However, because it does not generate a custom dictionary based on asset characteristics, the weak password detection results are inaccurate. For example, when dealing with assets in specific industries or with unique business needs, a general dictionary cannot cover the special password rules that may exist, easily overlooking truly weak passwords. Furthermore, the inability to define automated weak password scanning tasks leads to tedious and inefficient manual operations. Taking large-scale network assets as an example, if scanning needs to be initiated manually every time, it not only consumes manpower but also easily leads to missing the best scanning opportunity due to human negligence, increasing the risk of the system being attacked by weak passwords. Summary of the Invention

[0006] To overcome the shortcomings of the existing technology, the present invention aims to provide a method and system for detecting and warning weak passwords based on asset feature association. By integrating and analyzing business and personnel information, a more accurate and comprehensive asset feature association dictionary is dynamically constructed. Furthermore, because it associates business and personnel information, the system generates risk warning information simultaneously upon detecting a weak password, immediately notifying the relevant parties and administrators associated with the weak password, thus identifying and addressing potential security risks. The technical effects or advantages of this invention are reflected in its efficient asset information management, intelligent password dictionary generation, flexible detection task configuration, diverse detection modes, accurate port scanning and identification, automated report generation, and real-time risk warnings and notifications, which together constitute an efficient, accurate, and practical weak password detection and warning system, aiming to improve network security protection levels and ensure asset security.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] A method for intelligent weak password detection and early warning based on asset feature correlation includes the following steps:

[0009] Step 1: Enter asset information

[0010] Asset information is imported through manual entry, which can be either single entry or batch import. The attributes of the asset information include IPv4 address, business, department name, personnel name, personnel contact number, personnel email address, and personnel date of birth.

[0011] Step 2: Generate an asset feature association dictionary

[0012] Feature extraction is performed on the asset information entered in step 1 to dynamically generate an asset feature association dictionary;

[0013] Step 3: Configure the detection task

[0014] Based on the asset feature association dictionary generated in step 2, configure the task executor, detection time, detection scope, protocol, scanning cycle, and password dictionary used for the inspection;

[0015] Step 4: Choose to automate or manually execute the weak password detection task.

[0016] In automated detection mode, the weak password detection task is automatically executed according to the detection time, detection range, protocol, scanning cycle and password dictionary used in step 3.

[0017] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0018] Step 5: Scan or identify ports

[0019] Based on the automated or manual detection mode selected in step 4, the asset information entered in step 1 is identified, and open ports and protocols are identified through port scanning identification technology.

[0020] Step 6: Password Collision

[0021] Based on the password dictionary configured in step 3, perform password collision on the ports and protocols identified in step 5 to discover any weak password information.

[0022] Step 7: Automated generation of weak password detection reports

[0023] The test report is automatically generated based on the pre-made report template. The weak password information found in step 6 is used to generate a weak password test report, which includes the test report name, tester, test time, test scope, list of weak passwords found, risk analysis and rectification suggestions.

[0024] Step 8: Risk Warning and Notification

[0025] Based on the weak password detection report generated in step 7, risk warning information is automatically generated and notified to relevant parties and administrators via email or SMS through the "personnel email address" or "personnel contact number" entered in the asset information in step 1. The risk warning information includes the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password.

[0026] The specific method for step 1 is as follows:

[0027] Asset information is entered through the asset management module, including manual single-entry entry or batch import. The IPv4 address, business unit, department name, personnel name, contact number, email address, and date of birth entered in the asset entry module are validated using regular expressions. For personnel email addresses, the JavaMail API is used to verify email validity.

[0028] For the batch import function, a CSV file is used as a template. After the user fills it out and uploads it, the JAVA code parses and processes the file provided by the user, performs read and write operations on the file, extracts the asset information entered by the user, and inserts it into the database.

[0029] The specific method for step 2 is as follows:

[0030] The built-in common password dictionary file is loaded using Java's I / O module, and the IPv4 address, business, department name, personnel name, personnel contact number, personnel email, and personnel date of birth are extracted from the asset information entered in step 1 using JDBC (Java Database Connectivity) or JPA (Java Persistence API) modules; the password dictionary is generated using Java's string processing functions; and the asset feature association dictionary is generated and stored using Java's collection framework.

[0031] The specific method for step 3 is as follows:

[0032] Design a configuration interface using Java's graphical user interface (GUI) library, including the task executor, detection time, detection range, protocol, scanning cycle, and password dictionary used.

[0033] The specific method for step 4 is as follows:

[0034] The Java timer is used to implement the periodic execution of the automated detection mode; the Java collection framework is used to store the configuration information of the preset detection range, protocol and password dictionary; a background service is written to implement the automated service function, which automatically triggers the weak password detection task according to the preset detection time and detection cycle configuration information.

[0035] For manual detection mode, a button or command interface based on a graphical user interface is provided. The graphical user interface calls the corresponding Java function or method to immediately trigger the weak password detection task. The functions and methods designed in the program use the same configuration information and detection logic as the automated detection mode, but are not constrained by detection time and detection cycle, allowing users to flexibly trigger manually as needed.

[0036] The specific method for step 5 is as follows:

[0037] The port scanning or identification function accepts and verifies the IPv4 address entered by the user in step 1. The IP management module uses Java's network programming API to scan and probe the ports and services of the IPv4 address. After the scan is completed, the service identification module interacts with the open ports through specific protocols to identify the open ports and protocols.

[0038] The specific method for step 6 is as follows:

[0039] Design a password collision module to read the password dictionary configured in step 3, and use the configured password dictionary to perform password collision on the ports and protocols identified in step 5 to discover existing weak password information.

[0040] The password collision module uses Java's network programming API to attempt to establish a connection with the service on the target port and authenticates each password using a built-in dictionary of common passwords or an asset feature association dictionary.

[0041] The specific method for step 7 is as follows:

[0042] First, load the pre-made report template, which includes HTML, PDF, or other format documents with fixed format and layout; receive the detected weak password information from the password collision module and fill it into the weak password detection report. The information filled in includes the detection report name, the person who detected it, the detection time, the detection scope, the list of weak passwords found, the risk analysis, and the rectification suggestions.

[0043] Using a Java template engine simplifies the process of loading and populating templates; the template engine allows users to define the structure and style of templates and dynamically pass data to the report template via Java code, or use Java file processing APIs (such as FileWriter, PrintWriter, or PDF libraries such as iText) to directly generate weak password detection reports.

[0044] The specific method for step 8 is as follows:

[0045] When the password collision module detects weak password information, it transmits the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures containing the weak password to the risk warning and notification module. The risk warning and notification module first analyzes this information and determines the risk level based on the preset risk assessment logic. Then, the risk warning and notification module accesses the asset information configured in step 1, including the "personnel's email address" or "personnel's contact number".

[0046] The risk warning and notification module uses Java's email sending library or SMS sending service's Java SDK to send risk warning notifications based on the configured "person's email address" or "person's contact number". The risk warning information will include the IPv4 address with weak password, port, protocol, account, password, risk level, and suggested remediation measures to ensure that security vulnerabilities are dealt with in a timely manner.

[0047] A smart weak password detection and early warning system based on asset feature correlation includes:

[0048] Asset Management Module: Used to import asset information manually. Manual entry methods include single-entry entry or batch import. Asset information attributes include IPv4 address, business, department name, personnel name, personnel contact number, personnel email, and personnel date of birth.

[0049] Password dictionary management module: Used to manage the system's built-in commonly used password dictionary and the asset feature association dictionary dynamically generated based on asset information in the asset management module;

[0050] The detection task configuration module is used to configure the task executor, detection time, detection scope, protocol, scanning cycle, and password dictionary used for the dynamically generated asset feature association dictionary based on asset information in the asset management module.

[0051] Detection mode selection module: Used to select whether to perform weak password detection tasks automatically or manually. In automatic detection mode, weak password detection tasks are automatically performed according to the configured detection time, detection range, protocol, scanning cycle and password dictionary used.

[0052] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0053] Port scanning or identification module: Used to identify asset information entered by the asset management module based on the automatic or manual detection mode selected in the detection mode selection module, and to identify open ports and protocols through port scanning and identification technology;

[0054] Password collision module: Based on the password dictionary configured by the detection task configuration module, it performs password collision on the ports and protocols identified by the port scanning or identification module to discover weak password information.

[0055] Report Management Module: Used to automatically generate test reports based on pre-made report templates. It generates weak password detection reports based on weak password information found by the password collision module, including the test report name, tester, test time, test scope, list of weak passwords found, risk analysis, and rectification suggestions.

[0056] Risk Warning Management Module: Based on the weak password detection report generated by the Report Management Module, this module automatically generates risk warning information and notifies relevant parties and administrators via email or SMS through the "personnel email address" or "personnel contact number" in the asset information entered in the Asset Management Module. The risk warning information includes the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password.

[0057] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0058] 1. Improve dictionary accuracy: This invention generates a dictionary by associating asset features, making the dictionary more targeted and adaptable, improving the efficiency and accuracy of weak password detection, and reducing the omission rate of security vulnerabilities.

[0059] 2. Flexible and versatile operation modes: This invention can achieve both timed automated execution and manual operation, meeting the needs of different users and improving the system's flexibility and ease of use.

[0060] 3. Simplify and optimize the reporting process: This invention automates the generation of weak password detection reports by using pre-made report templates, eliminating the tedious steps of manual sorting and analysis, and improving work efficiency and report accuracy.

[0061] 4. Real-time risk warning: Upon discovering a weak password, this invention can automatically generate a risk warning and notify relevant parties and administrators of the vulnerability through associated asset information, ensuring that security vulnerabilities are addressed in a timely manner and reducing security risks.

[0062] In summary, this invention significantly improves the efficiency and accuracy of weak password detection by innovating through asset feature association to generate a highly accurate dictionary, flexible and versatile operating modes, an optimized process for automated detection report generation, and an instant risk warning mechanism. This reduces the rate of missed security risks and ensures timely detection and handling of security threats. These features not only enhance the system's adaptability and flexibility but also improve work efficiency and user experience, offering significant advantages in security and convenience. Attached Figure Description

[0063] Figure 1 This is a flowchart illustrating the design process of the method of this invention.

[0064] Figure 2 This is a functional architecture diagram of the system of the present invention. Detailed Implementation

[0065] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0066] like Figure 1 As shown, a method for intelligent weak password detection and early warning based on asset feature correlation specifically includes the following steps:

[0067] Step 1: Enter asset information

[0068] Import asset information manually, either by entering it one entry at a time or in batches. The asset information attributes include IPv4 address, business unit, department name, personnel name, personnel contact number, personnel email address, and personnel date of birth. This step mainly provides a reliable basis for subsequent password dictionary generation, task scope configuration, and risk warning sending.

[0069] The specific method for step 1 is as follows:

[0070] Asset information is entered through the asset management module, including manual single-entry entry or batch import. The IPv4 address, business unit, department name, personnel name, contact number, email address, and date of birth entered in the asset entry module are validated using regular expressions. For personnel email addresses, the JavaMail API is used to verify email validity.

[0071] For the batch import function, a CSV file is used as a template. After the user fills it out and uploads it, the JAVA code parses and processes the file provided by the user, performs read and write operations on the file, extracts the asset information entered by the user, and inserts it into the database.

[0072] Step 2: Generate an asset feature association dictionary

[0073] In addition to the built-in common password dictionary, the system extracts features from the asset information entered in step 1 and dynamically generates an asset feature association dictionary, which improves the accuracy of weak password detection.

[0074] The specific method for step 2 is as follows:

[0075] The built-in common password dictionary file is loaded using Java's I / O module, and the IPv4 address, business name, department name, personnel name, personnel contact number, personnel email address, and personnel date of birth are extracted from the asset information entered in step 1 through JDBC (Java Database Connectivity) or JPA (Java Persistence API) modules. The password dictionary is generated using Java's string processing functions (such as StringBuilder, String.format, etc.). The generated asset feature association dictionary is stored using Java's collection framework (such as HashSet or ArrayList) to ensure the uniqueness and iterability of the dictionary.

[0076] Step 3: Configure the detection task

[0077] Based on the asset feature association dictionary generated in step 2, the system allows users to configure the task executor, detection time, detection scope, protocol, scanning cycle, and password dictionary used for the inspection; this flexibility enables the system to adapt to different security needs and environments.

[0078] The specific method for step 3 is as follows:

[0079] When developing the task configuration function, the powerful features of the Java language should be fully utilized to implement this functionality. An intuitive and easy-to-use configuration interface should be designed using Java's graphical user interface (GUI) library (such as Swing or JavaFX), including the task executor, detection time, detection range, protocol, scan cycle, and password dictionary used; allowing users to easily define various parameters of the inspection task.

[0080] Java's collection framework (such as HashSet and ArrayList) supports efficient management of user-input configuration data, while Java's file I / O functionality allows programs to easily read and save configuration files. Java's concurrent programming features ensure the correct transmission and efficient processing of configuration parameters during task execution.

[0081] Step 4: Choose to automate or manually execute the weak password detection task.

[0082] Based on the detection tasks configured in step 3, the detection modes include automated detection mode and manual detection mode;

[0083] In automated detection mode, the weak password detection task is automatically executed according to the detection time, detection range, protocol, scanning cycle and password dictionary used in step 3.

[0084] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0085] The specific method for step 4 is as follows:

[0086] When developing automated and manual execution of detection tasks, Java timers (such as java.util.Timer or java.util.concurrent.ScheduledExecutorService) are used to implement the periodic execution of the automated detection mode; Java's collection framework (such as HashSet, ArrayList, etc.) is used to store the preset detection range, protocol, and password dictionary configuration information. A background service is written to implement the automation service function, which automatically triggers weak password detection tasks according to the preset detection time and detection cycle configuration information.

[0087] For manual detection mode, a button or command interface based on a graphical user interface (such as via command line parameters or REST API) is provided. The graphical user interface calls the corresponding Java function or method to immediately trigger the weak password detection task. The functions and methods designed in the program use the same configuration information and detection logic as the automated detection mode, but are not constrained by detection time and detection cycle, allowing users to flexibly trigger manually as needed.

[0088] Step 5: Scan or identify ports

[0089] Based on the automated or manual detection mode selected in step 4, the asset information entered in step 1 is identified, and open ports and protocols are identified through port scanning technology. This information will serve as the basis for password cracking and help the system identify potential vulnerabilities and risks.

[0090] The specific method for step 5 is as follows:

[0091] The port scanning or identification function accepts and verifies the IPv4 address entered by the user in step 1. The IP management module uses Java's network programming API (such as the Socket class) to scan and probe the ports and services of the IPv4 address. After the scan is completed, the service identification module interacts with the open ports through specific protocols to identify the open ports and protocols.

[0092] Step 6: Password Collision

[0093] Based on the password dictionary configured in step 3, password collision is performed on the ports and protocols identified in step 5 to discover existing weak password information.

[0094] The specific method for step 6 is as follows:

[0095] Design a password collision module to read the password dictionary configured in step 3, and use the configured password dictionary to perform password collision on the ports and protocols identified in step 5 to discover existing weak password information.

[0096] The password collision module uses Java's network programming APIs (such as the Socket or DatagramSocket classes) to attempt to establish a connection with the service on the target port and authenticates each password using a built-in dictionary of common passwords or an asset feature association dictionary.

[0097] Step 7: Automated generation of weak password detection reports

[0098] The system automatically generates a detection report based on the pre-made report template. It generates a weak password detection report based on the weak password information found in step 6, including the report name, the person who conducted the detection, the detection time, the scope of the detection, a list of weak passwords found, risk analysis, and rectification suggestions. This allows users to quickly understand the security status of their assets.

[0099] The specific method for step 7 is as follows:

[0100] The automated report generation function is responsible for organizing the detected weak password information into easy-to-read reports so that users can quickly understand the security status of their assets. The program will design a report generation module that works closely with the previous password collision module to complete the report output.

[0101] First, load the pre-made report template, which includes HTML, PDF, or other format documents with fixed format and layout; receive the detected weak password information from the password collision module and fill it into the weak password detection report. The information filled in includes the detection report name, the person who detected it, the detection time, the detection scope, the list of weak passwords found, the risk analysis, and the rectification suggestions.

[0102] Use Java template engines (such as Thymeleaf, FreeMarker, etc.) to simplify the template loading and population process; template engines allow users to define the structure and style of templates and dynamically pass data to the report template through Java code, or use Java file processing APIs (such as FileWriter, PrintWriter, or PDF libraries such as iText) to directly generate weak password detection reports.

[0103] Step 8: Risk Warning and Notification

[0104] Based on the weak password detection report generated in step 7, risk warning information is automatically generated and notified to relevant parties and administrators via email or SMS through the "personnel email address" or "personnel contact number" entered in the asset information in step 1. The risk warning information includes the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password, ensuring that security vulnerabilities are dealt with in a timely manner.

[0105] The specific method for step 8 is as follows:

[0106] The program design includes a risk warning and notification module to promptly inform relevant parties and administrators of detected weak password risks. This module works in conjunction with the previous modules to complete a closed-loop process for weak password detection.

[0107] When the password collision module detects weak password information, it transmits the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures containing the weak password to the risk warning and notification module. The risk warning and notification module first analyzes this information and determines the risk level based on the preset risk assessment logic. Then, the risk warning and notification module accesses the asset information configured in step 1, including the "personnel's email address" or "personnel's contact number".

[0108] The risk warning and notification module uses Java's email sending library (such as JavaMail API) or SMS sending service (such as Twilio, Alibaba Cloud SMS service, etc.) Java SDK to send risk warning notifications based on the configured "person's email address" or "person's contact number". The risk warning information will include the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password, to ensure that security vulnerabilities are dealt with in a timely manner.

[0109] like Figure 2 As shown, an intelligent weak password detection and early warning system based on asset feature correlation includes:

[0110] Asset Management Module: This module is used to import asset information manually. Manual entry can be done by entering data one entry at a time or by importing in batches. The attributes of the asset information include IPv4 address, business entity, department name, personnel name, contact number, email address, and date of birth. This module forms the foundation for the password dictionary management module, task management module, and risk warning management module, ensuring that other modules can obtain complete asset information to support customized detection tasks and accurate risk warnings.

[0111] Password dictionary management module: This module manages the system's built-in commonly used password dictionary and the asset feature association dictionary dynamically generated based on asset information in the asset management module, ensuring that weak password checks for assets are more targeted in subsequent tasks.

[0112] The detection task configuration module is used to configure the task executor, detection time, detection scope, protocol, scanning cycle, and password dictionary used for the dynamically generated asset feature association dictionary based on asset information in the asset management module.

[0113] Detection mode selection module: Used to combine the detection tasks configured in the detection task configuration module. The detection modes include automated detection mode and manual detection mode.

[0114] In automated detection mode, weak password detection tasks are automatically executed based on the configured detection time, detection range, protocol, scanning cycle, and password dictionary used.

[0115] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0116] Port scanning or identification module: Used to identify asset information entered by the asset management module based on the automatic or manual detection mode selected in the detection mode selection module, and to identify open ports and protocols through port scanning and identification technology;

[0117] Password collision module: Based on the password dictionary configured by the detection task configuration module, it performs weak password collision on the ports and protocols identified by the port scanning or identification module to discover existing weak password information.

[0118] The detection task configuration module, detection mode selection module, port scanning or recognition module, and password collision module work closely with the asset management module and password dictionary management module to achieve dynamic detection of weak passwords for assets, thereby improving detection efficiency and accuracy.

[0119] Report Management Module: This module automatically generates detection reports based on pre-made report templates. It generates weak password detection reports from weak password information discovered by the password collision module, including the report name, the person who detected the weak password, the detection time, the detection scope, a list of weak passwords found, risk analysis, and rectification suggestions. This module can quickly provide analysis results of weak password detection, providing users with comprehensive feedback on the status of asset security and helping to quickly formulate response strategies.

[0120] Risk Warning Management Module: Based on the weak password detection report generated by the Report Management Module, this module automatically generates risk warning information and notifies relevant parties and administrators via email or SMS through the "personnel email address" or "personnel contact number" in the asset information entered in the Asset Management Module. The risk warning information includes the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password.

[0121] This invention is developed using the Java language and employs JavaFX to build an interactive interface, enabling users to operate the system intuitively and conveniently, thus lowering the user threshold. Different types of data are stored using MySQL relational data storage.

[0122] The key points and areas for protection of this invention are as follows:

[0123] 1. Generation and application of user feature password dictionaries based on business and personnel association attributes

[0124] One of the key aspects of this invention lies in the input and management of IP assets with business and personnel-related attributes. The system can generate specific password dictionaries based on different business and personnel-related attributes. This allows for a more comprehensive discovery of security risks and improves the security of target assets.

[0125] 2. Combination of automated and manual inspection

[0126] This invention combines automated and manual inspection, ensuring both efficiency and accuracy while allowing for more in-depth and detailed checks when necessary. This flexibility ensures the system's comprehensiveness and reliability.

[0127] 3. Real-time risk warning

[0128] This invention not only performs checks such as "asset and port scanning and identification" and "personnel and password collision", but also marks the situation of "weak passwords" and generates "password risk warning". This warning mechanism helps to discover and respond to potential security threats in a timely manner.

[0129] 4. Comprehensive Inspection Report

[0130] This invention provides a pre-configurable weak password detection report template, which reduces labor costs and the possibility of errors in manually compiling reports. At the same time, this standardized report format also enhances the effectiveness of statistical reporting.

[0131] The technical problem to be solved by this invention is:

[0132] Weak password scanning technology is designed to detect weak passwords used on a network. Weak passwords typically refer to passwords that are easily attacked or guessed. These passwords may be too simple, common, or based on easily accessible information, allowing hackers or malicious users to easily crack accounts or systems. Weak password scanning technology tests the security of a system by attempting to use various possible username and password combinations to discover these potential security vulnerabilities. Weak password scanning technology can help organizations identify and harden systems vulnerable to password attacks, thereby improving network security.

[0133] To address the weaknesses of existing technologies, this invention aims to solve the following problems:

[0134] 1. Enhanced Security: Existing weak password detection systems typically rely on generic password dictionaries, neglecting the impact of personalized user information. This invention generates a customized password dictionary by combining IP address association attributes (such as department name, personnel information, etc.), thereby more accurately simulating password combinations that attackers might use, improving the targeting and effectiveness of detection.

[0135] 2. Enhanced flexibility: This invention allows users to customize inspection parameters (such as detection range, protocol, detection time, and scanning cycle), making weak password scanning more flexible and customizable. The inspection strategy can be adjusted according to the needs of different scenarios to adapt to diverse network environments.

[0136] 3. Improved detection efficiency: This invention first confirms the liveness status and open ports of the target host, and only performs scanning when the host is confirmed to be available, reducing invalid scanning operations and improving detection efficiency.

[0137] 4. Real-time feedback mechanism: Once a weak password is discovered, this invention not only generates an inspection report, but also immediately notifies the relevant parties and administrators via email or SMS, which speeds up the risk response and enhances the timeliness of security management.

[0138] 5. Simplified operation process: Automated checks reduce the workload of administrators while retaining the option of manual checks, providing the possibility for manual intervention in special cases, making the system suitable for both large-scale deployment and handling of individual special cases.

[0139] 6. Enhanced User Experience: This invention improves users' awareness and management efficiency of weak password issues through an intuitive interface and automated detection report output, making it easier for users to understand and take measures.

[0140] In the existing technological system, there are obvious shortcomings in the detection and management of weak passwords, mainly in the following aspects:

[0141] Dictionary adaptability is insufficient:

[0142] Traditional tools use fixed and universal dictionaries, which lack adaptability to specific asset characteristics, resulting in low efficiency in weak password detection and potential omission of critical security risks.

[0143] This invention generates a dictionary by associating it with asset characteristics, making the dictionary more targeted and adaptable, improving the efficiency and accuracy of weak password detection, and reducing the omission rate of security vulnerabilities.

[0144] Inflexible operating mode:

[0145] Traditional tools mainly rely on manual operation, which is insufficient to cope with different usage scenarios and has low operating efficiency.

[0146] This invention can achieve both timed automated execution and manual operation, meeting the needs of different users and improving the system's flexibility and ease of use.

[0147] Report generation is cumbersome and inefficient.

[0148] Existing tools require tedious manual data sorting and analysis to generate reports after weak passwords are discovered, which increases the workload and may introduce human error.

[0149] This invention automates the generation of weak password detection reports by using pre-made report templates, eliminating the tedious steps of manual sorting and analysis, and improving work efficiency and report accuracy.

[0150] Delayed risk response:

[0151] Traditional tools lack effective risk warning and real-time notification mechanisms after discovering weak passwords, resulting in security vulnerabilities not being addressed in a timely manner and increasing potential security risks.

[0152] Upon discovering a weak password, this invention can automatically generate a risk warning and notify relevant parties and administrators of the vulnerability by linking it to asset information, ensuring that security vulnerabilities are addressed in a timely manner and reducing security risks.

[0153] Glossary of relevant technical terms

[0154] 1. Weak Password: A password that is easily guessed, cracked, or brute-forced. Weak passwords are usually composed of simple letters, numbers, or symbols, are short, and lack complexity and randomness.

[0155] 2. Dictionary Generation Algorithm: An algorithm used to generate password dictionaries. Dictionary generation algorithms can generate dictionaries containing various possible password combinations according to certain rules and strategies, for use in password cracking or weak password detection.

[0156] 3. Scanning Time: This refers to the time required to perform weak password detection. The scanning time depends on the performance of the weak password detection system and the complexity of the algorithm.

[0157] 4. False Positive Rate: This refers to the proportion of valid passwords incorrectly marked as weak passwords during weak password detection. A lower false positive rate indicates a higher accuracy of the weak password detection system.

[0158] 5. User Interface (UI): This is the interface through which a user interacts with a computer program or device. User interfaces can be implemented through a graphical user interface (GUI) or a command-line interface (CLI).

[0159] 6. Interaction Mode: This refers to the way a user interacts with a computer program or device. Common interaction modes include keyboard input, mouse clicks, and touchscreen operation.

[0160] 7. Liveness Probe: A network scanning technique used to determine whether a target host is active. A SYN half-open connection is a common method for liveness probes, which uses the SYN flag in the TCP protocol to determine whether the target host can establish a TCP connection.

[0161] 8. Social Engineering Password Dictionary: A password dictionary built based on the principles of social engineering, used to guess the passwords a user might use. Building a social engineering password dictionary typically requires collecting a large amount of information from the target's social networking sites, forums, etc., such as name, date of birth, home address, etc., and then organizing, analyzing, and summarizing this information to generate a list of possible passwords.

[0162] 9. Concurrency: This refers to the number of tasks that can be executed simultaneously within the same timeframe, also known as concurrency level. In this tool, the current concurrency level represents the number of threads simultaneously performing password cracking, which can be dynamically adjusted according to actual conditions.

[0163] 10. Regular Expression: A regular expression is a text pattern that includes ordinary characters (such as letters from a to z) and special characters (called "metacharacters") that can be used to describe and match specific patterns in a string.

[0164] 11. Graphical User Interface (GUI): A graphical user interface is a computer operating interface that uses a graphical display. It is a human-computer communication interface format that allows users to use input devices such as a mouse to manipulate icons or menu options on the screen to select commands, access files, launch programs, or perform other everyday tasks.

[0165] 12. Command interface: A type of program provided to users by the operating system. It receives user input commands, interprets and executes them, and returns the execution result to the user.

[0166] 13. Closed-loop handling: Closed-loop handling is a management process that ensures problems are fully addressed, including identification, analysis, resolution, and feedback.

Claims

1. A method for intelligent weak password detection and early warning based on asset feature correlation, characterized in that, Specifically, the following steps are included: Step 1: Enter asset information Asset information is imported through manual entry, which can be either single entry or batch import. The attributes of the asset information include IPv4 address, business, department name, personnel name, personnel contact number, personnel email address, and personnel date of birth. Step 2: Generate an asset feature association dictionary Feature extraction is performed on the asset information entered in step 1 to dynamically generate an asset feature association dictionary; Step 3: Configure the detection task Based on the asset feature association dictionary generated in step 2, configure the task executor, detection time, detection scope, protocol, scanning cycle, and password dictionary used for the inspection; Step 4: Choose to automate or manually execute the weak password detection task. In automated detection mode, the weak password detection task is automatically executed according to the detection time, detection range, protocol, scanning cycle and password dictionary used in step 3. In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios; Step 5: Scan or identify ports Based on the automated or manual detection mode selected in step 4, the asset information entered in step 1 is identified, and open ports and protocols are identified through port scanning identification technology. Step 6: Password Collision Based on the password dictionary configured in step 3, perform password collision on the ports and protocols identified in step 5 to discover any weak password information. Step 7: Automated generation of weak password detection reports The test report is automatically generated based on the pre-made report template. The weak password information found in step 6 is used to generate a weak password test report, which includes the test report name, tester, test time, test scope, list of weak passwords found, risk analysis and rectification suggestions. Step 8: Risk Warning and Notification Based on the weak password detection report generated in step 7, risk warning information is automatically generated and notified to relevant parties and administrators via email or SMS through the "personnel email address" or "personnel contact number" entered in the asset information in step 1. The risk warning information includes the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password.

2. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 1 is as follows: Asset information is entered through the asset management module, including manual single-entry entry or batch import. The IPv4 address, business unit, department name, personnel name, contact number, email address, and date of birth entered in the asset entry module are validated using regular expressions. For personnel email addresses, the JavaMail API is used to verify email validity. For the batch import function, a CSV file is used as a template. After the user fills it out and uploads it, the JAVA code parses and processes the file provided by the user, performs read and write operations on the file, extracts the asset information entered by the user, and inserts it into the database.

3. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 2 is as follows: The built-in common password dictionary file is loaded using Java's I / O module, and the IPv4 address, business, department name, personnel name, personnel contact number, personnel email, and personnel date of birth are extracted from the asset information entered in step 1 using JDBC (Java Database Connectivity) or JPA (Java Persistence API) modules; the password dictionary is generated using Java's string processing functions; and the asset feature association dictionary is generated and stored using Java's collection framework.

4. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 3 is as follows: Design a configuration interface using Java's graphical user interface (GUI) library, including the task executor, detection time, detection range, protocol, scanning cycle, and password dictionary used.

5. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 4 is as follows: The Java timer is used to implement the periodic execution of the automated detection mode; the Java collection framework is used to store the configuration information of the preset detection range, protocol and password dictionary; a background service is written to implement the automated service function, which automatically triggers the weak password detection task according to the preset detection time and detection cycle configuration information. For manual detection mode, a button or command interface based on a graphical user interface is provided. The graphical user interface calls the corresponding Java function or method to immediately trigger the weak password detection task. The functions and methods designed in the program use the same configuration information and detection logic as the automated detection mode, but are not constrained by detection time and detection cycle, allowing users to flexibly trigger manually as needed.

6. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 5 is as follows: The port scanning or identification function accepts and verifies the IPv4 address entered by the user in step 1. The IP management module uses Java's network programming API to scan and probe the ports and services of the IPv4 address. After the scan is completed, the service identification module interacts with the open ports through specific protocols to identify the open ports and protocols.

7. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 6 is as follows: Design a password collision module to read the password dictionary configured in step 3, and use the configured password dictionary to perform password collision on the ports and protocols identified in step 5 to discover existing weak password information. The password collision module uses Java's network programming API to attempt to establish a connection with the service on the target port and authenticates each password using a built-in dictionary of common passwords or an asset feature association dictionary.

8. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 7 is as follows: First, load the pre-made report template, which includes HTML, PDF, or other format documents with fixed format and layout; receive the detected weak password information from the password collision module and fill it into the weak password detection report. The information filled in includes the detection report name, the person who detected it, the detection time, the detection scope, the list of weak passwords found, the risk analysis, and the rectification suggestions. Using a Java template engine simplifies the process of loading and populating templates; the template engine allows users to define the structure and style of templates and dynamically pass data to the report template via Java code, or use Java's file processing API to directly generate weak password detection reports.

9. The method for intelligent weak password detection and early warning based on asset feature association as described in claim 1, characterized in that, The specific method for step 8 is as follows: When the password collision module discovers weak password information, it transmits the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures containing the weak password to the risk warning and notification module. The risk warning and notification module first analyzes this information and determines the risk level based on the preset risk assessment logic. Then, the risk warning and notification module accesses the asset information configured in step 1, including the "personnel email address" or "personnel contact number". The risk warning and notification module uses Java's email sending library or SMS sending service's Java SDK to send risk warning notifications based on the configured "person's email address" or "person's contact number". The risk warning information will include the IPv4 address with weak password, port, protocol, account, password, risk level, and suggested remediation measures to ensure that security vulnerabilities are dealt with in a timely manner.

10. A smart weak password detection and early warning system based on asset feature correlation, characterized in that, include: Asset Management Module: Used to import asset information manually. Manual entry methods include single-entry entry or batch import. Asset information attributes include IPv4 address, business, department name, personnel name, personnel contact number, personnel email, and personnel date of birth. Password dictionary management module: Used to manage the system's built-in commonly used password dictionary and the asset feature association dictionary dynamically generated based on asset information in the asset management module; The detection task configuration module is used to configure the task executor, detection time, detection scope, protocol, scanning cycle, and password dictionary used for the dynamically generated asset feature association dictionary based on asset information in the asset management module. Detection mode selection module: Used to select whether to perform weak password detection tasks automatically or manually. In automatic detection mode, weak password detection tasks are automatically performed according to the configured detection time, detection range, protocol, scanning cycle and password dictionary used. In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios; Port scanning or identification module: Used to identify asset information entered by the asset management module based on the automatic or manual detection mode selected in the detection mode selection module, and to identify open ports and protocols through port scanning and identification technology; Password collision module: Based on the password dictionary configured by the detection task configuration module, it performs password collision on the ports and protocols identified by the port scanning or identification module to discover any weak password information. Report Management Module: Used to automatically generate test reports based on pre-made report templates. It generates weak password detection reports based on weak password information found by the password collision module, including the test report name, tester, test time, test scope, list of weak passwords found, risk analysis, and rectification suggestions. Risk Warning Management Module: Based on the weak password detection report generated by the Report Management Module, this module automatically generates risk warning information and notifies relevant parties and administrators via email or SMS through the "personnel email address" or "personnel contact number" in the asset information entered in the Asset Management Module. The risk warning information includes the IPv4 address, port, protocol, account, password, risk level, and suggested remediation measures for the weak password.

Images