Asset password detection method and device

Abstract

The application provides an asset password detection method and device, relates to the technical field of artificial intelligence and information security, and can be applied to the technical field of finance or other technical fields. The asset password detection method comprises the following steps: inputting an initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary; determining a password detection threshold according to the number of users corresponding to the asset and the password detection time; and performing password detection on the service corresponding to the asset by using the target password dictionary according to the password detection threshold to obtain a password detection result. The application can effectively detect passwords with vulnerability to improve the security of information system assets and the overall defense capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence and information security technology, and can be applied to the financial field or other fields, in particular, relates to an asset password detection method and device. BACKGROUND

[0002] With the development of society, the network as a platform for information exchange, acquisition and sharing in the 21st century has become a necessity in life without realizing it. As the main tool for carrying information, how to maintain the security of information system is a problem that every enterprise must face and solve. And how to ensure the password security of information system is an indispensable part.

[0003] Password, also known as password, has become one of the most widely used identity authentication methods due to its simplicity, low cost and easy implementation, and is the first line of defense for various information system security. And most account systems or even smart terminals use password as the only access control mechanism. Once the password is problematic, such as using weak password, no anti-brute force cracking mechanism, etc., it will cause loss of account property theft and personal privacy leakage. With the continuous advancement of informatization, on the one hand, more and more leaked personal sensitive information leads to password leakage; on the other hand, the human brain capacity is limited, and only 5-7 passwords can be memorized, leading users to inevitably use low information entropy (simple and easy to remember) weak password, reuse the same password in multiple information systems, and even write password on paper, which brings serious security threat.

[0004] The main way to detect the security of information system password in the current industry is to combine common passwords into a password dictionary, and use character combinations in the password dictionary to try to verify one by one to verify the security of the information system password. This traditional detection method has high requirements for the data volume and accuracy of the password dictionary, and takes a long time and has low efficiency when detecting, and is very easy to trigger the locking mechanism of the account, which cannot guarantee the security of the information system password to be verified well. SUMMARY

[0005] The main purpose of the embodiment of the present application is to provide an asset password detection method and device to effectively detect passwords with vulnerability to improve the security of information system assets and the overall defense capability.

[0006] In order to achieve the above purpose, the embodiment of the present application provides an asset password detection method, comprising:

[0007] inputting the initial password dictionary into each password dictionary generation model based on the historical password to obtain a target password dictionary;

[0008] Determine a password detection threshold according to the number of users corresponding to the asset and the password detection time;

[0009] Perform password detection on the service corresponding to the asset according to the target password dictionary to obtain a password detection result.

[0010] In one embodiment, the step of creating a password dictionary generation model includes:

[0011] Perform the following iterative processing:

[0012] Randomly mask and directionally mask the historical passwords respectively to obtain an encoder string vector and a decoder string vector;

[0013] Obtain a predicted password according to the encoder string vector, the decoder string vector, and the model weight;

[0014] When the current iteration number reaches a preset threshold, create the password dictionary generation model according to the model weight, otherwise update the model weight according to the predicted password and the actual password, and continue to perform the iterative processing.

[0015] In one embodiment, obtaining a predicted password according to the encoder string vector, the decoder string vector, and the model weight includes:

[0016] Determine predicted password information according to the encoder string vector and the encoding model weight;

[0017] Obtain a predicted password according to the predicted password information, the decoder string vector, and the decoding model weight.

[0018] In one embodiment, obtaining a predicted password according to the predicted password information, the decoder string vector, and the decoding model weight includes:

[0019] Obtain intermediate information according to the predicted password information, the decoder string vector, and the intermediate decoding model weight;

[0020] Obtain a predicted password according to the intermediate information and the output decoding model weight.

[0021] In one embodiment, obtaining a predicted password according to the intermediate information and the output decoding model weight includes:

[0022] Obtain a fully connected layer output result according to the intermediate information and the output decoding model weight;

[0023] Obtain a predicted password according to the fully connected layer output result.

[0024] In one embodiment, it further includes:

[0025] Identify the asset to obtain an asset IP address;

[0026] Determine the service corresponding to the asset according to the asset IP address.

[0027] In one embodiment, the password detection result is obtained by performing password detection on the service corresponding to the asset according to the password detection threshold and the target password dictionary.

[0028] The target password in the target password dictionary is compared with the preset password of the service according to the password detection threshold, and the password detection result is obtained according to the comparison result.

[0029] The embodiment of the present application also provides an asset password detection device, comprising:

[0030] A target password dictionary module is configured to input an initial password dictionary into each password dictionary generation model created based on a historical password to obtain a target password dictionary.

[0031] A password detection threshold module is configured to determine a password detection threshold according to the number of users corresponding to the asset and the password detection time.

[0032] A password detection result module is configured to obtain a password detection result by performing password detection on the service corresponding to the asset according to the password detection threshold and the target password dictionary.

[0033] In one embodiment, the device further comprises:

[0034] A masking module is configured to perform random masking and directional masking on the historical password respectively to obtain an encoder string vector and a decoder string vector.

[0035] A predicted password module is configured to obtain a predicted password according to the encoder string vector, the decoder string vector and the model weight.

[0036] An iteration module is configured to create a password dictionary generation model according to the model weight when the current iteration number reaches a preset threshold, or update the model weight according to the predicted password and the actual password and continue to perform iteration processing.

[0037] In one embodiment, the predicted password module comprises:

[0038] A predicted password information unit is configured to determine predicted password information according to the encoder string vector and the encoding model weight.

[0039] A predicted password unit is configured to obtain a predicted password according to the predicted password information, the decoder string vector and the decoding model weight.

[0040] In one embodiment, the predicted password unit comprises:

[0041] An intermediate information subunit is configured to obtain intermediate information according to the predicted password information, the decoder string vector and the intermediate decoding model weight.

[0042] A predicted password subunit is configured to obtain a predicted password according to the intermediate information and the output decoding model weight.

[0043] In one embodiment, the predicted password subunit is specifically configured to:

[0044] obtain a full connection layer output result according to the intermediate information and the output decoding model weight.

[0045] obtain the predicted password according to the full connection layer output result.

[0046] In one embodiment, the asset password detection method further comprises:

[0047] An asset identification module is configured to identify an asset and obtain an IP address of the asset.

[0048] A service determination module is configured to determine a service corresponding to the asset according to the IP address of the asset.

[0049] In one embodiment, the password detection result module is specifically configured to:

[0050] compare a target password in the target password dictionary with a preset password of the service according to the password detection threshold, and obtain a password detection result according to a comparison result.

[0051] The embodiment of the present application further provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and running on the processor, and the processor implements the steps of the asset password detection method when executing the computer program.

[0052] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the asset password detection method when executed by a processor.

[0053] The embodiment of the present application further provides a computer program product, which comprises computer programs / instructions, and the computer programs / instructions implement the steps of the asset password detection method when executed by a processor.

[0054] The asset password detection method and device of the embodiment of the present application first input an initial password dictionary into each password dictionary generation model based on a historical password to obtain a target password dictionary, then determine a password detection threshold according to a number of users corresponding to the asset and a password detection time, and finally perform password detection on a service corresponding to the asset by using the target password dictionary according to the password detection threshold to obtain a password detection result, so that passwords with vulnerability can be effectively detected to improve the security of information system assets and the overall defense capability. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments description will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative effort.

[0056] Figure 1 is a flowchart of the enterprise transaction data access method in the embodiment of the present application;

[0057] Figure 2 is a flowchart of the enterprise transaction data access method in another embodiment of the present application;

[0058] Figure 3 is a flowchart of the creation of the password dictionary generation model in the embodiment of the present application;

[0059] Figure 4 is a flowchart of S202 in the embodiment of the present application;

[0060] Figure 5 is a flowchart of S302 in the embodiment of the present application;

[0061] Figure 6 is a structural block diagram of the asset password detection device in the embodiment of the present application;

[0062] Figure 7 is a structural block diagram of the asset password detection device in another embodiment of the present application;

[0063] Figure 8 is a structural block diagram of the dictionary generation module in the embodiment of the present application; Figure 7

[0064] is a structural block diagram of the asset processing module in the embodiment of the present application; Figure 9 Figure 7 is a structural block diagram of the password detection module in the embodiment of the present application;

[0065] Figure 10 Figure 7 is a structural block diagram of the computer device in the embodiment of the present application.

[0066] Figure 11 is a structural block diagram of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0067] ​​With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort should fall into the scope of the present application.

[0068] Those skilled in the art can appreciate that the embodiments of the present application can be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure can be embodied as a complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0069] In view of the problems of high requirement for password dictionary in the prior art, long time of password security, low detection efficiency and easy triggering of account lock, the embodiments of the present application provide an asset password detection method and device, which trains and analyzes data by using massive common password combination data and improved MASS artificial intelligence algorithm, automatically generates a password dictionary with high prediction benefit, and performs password security detection on different services to identify passwords with vulnerability in information system assets, thereby facilitating the security department of an enterprise to regularly investigate password security risks in information systems and improving the overall defense capability of the system. The present application will be described in detail below with reference to the accompanying drawings.

[0070] Figure 1 is a flowchart of an enterprise transaction data access method in the embodiments of the present application. Figure 2 is a flowchart of an enterprise transaction data access method in another embodiment of the present application. As shown in Figures 1-2 , the enterprise transaction data access method comprises:

[0071] S101: inputting an initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary.

[0072] The default password can be added to the target dictionary.

[0073] S102: determining a password detection threshold according to the number of users corresponding to the assets and the password detection time.

[0074] Table 1

[0075]

[0076] Table 1 is a password detection threshold table. As shown in Table 1, a

[0077] S103: performing password detection on the services corresponding to the assets by using the target password dictionary according to the password detection threshold to obtain a password detection result.

[0078] Wherein, the assets (enterprise network assets) include network devices, security detection devices, servers, terminal devices and other Internet assets, etc.

[0079] In the implementation, the lock period can be defined, and the password detection in the threshold range is automatically implemented by the detection unit, so that the lock control of the password is not triggered, the normal operation of the business is ensured, and the remaining passwords in the dictionary are sequentially tested after each lock period. If there is no account lock mechanism in the detection process, all contents in the password dictionary are compared.

[0080] In an embodiment, the method further comprises: identifying the assets, splitting the asset IP segment into a single IP to obtain the asset IP address; determining the service and port corresponding to the asset according to the asset IP address, and marking the open service and port.

[0081] In an embodiment, S103 comprises: comparing the target password in the target password dictionary with the preset password of the service according to the password detection threshold, and obtaining the password detection result according to the comparison result. When the comparison result is consistent, the IP, port, service and successful login password of the detection target are marked. The present application aims to further improve the security of the system by improving the password complexity after detecting the consistent login password. Therefore, when the consistent login password is screened out, the system password needs to be improved, the predicted high predictability password can be set as the password dictionary set to avoid the use of the password by the enterprise and improve the complexity of the password. The system displays and reminds the weak password found, and establishes the corresponding rectification task. After the detection personnel notify the corresponding personnel to rectify, the system re-verifies the password after rectification, and the process is closed after the verification is passed.

[0082] Figure 1 The execution subject of the asset password detection method shown can be a computer. Figure 1 As shown in the process, the asset password detection method of the embodiment of the present application first inputs the initial password dictionary into each password dictionary generation model based on the historical password to obtain the target password dictionary, then determines the password detection threshold according to the number of users corresponding to the assets and the password detection time, and finally performs password detection on the services corresponding to the assets by using the target password dictionary according to the password detection threshold to obtain the password detection result, which can effectively detect the passwords with vulnerability to improve the security of the information system assets and the overall defense capability.

[0083] The password is generally divided into two types, one is the system default login password, and the other is the user-defined password dictionary. The self-defined password is mostly composed of several meaningful character combinations. In order to improve the speed and accuracy of password guessing, the application generates a new password dictionary based on the encoder-decoder model idea of the MASS algorithm when predicting the password.

[0084] MASS has an important hyperparameter k (the length of the masked continuous segment), by adjusting the size of k, MASS can include the masked language model training method in BERT and the standard language model pre-training method in GPT, making MASS a general pre-training framework.

[0085] Figure 3 It is the flow chart of creating a password dictionary generation model in the embodiment of the application. As shown in Figure 3 The steps of creating the password dictionary generation model include:

[0086] The following iteration process is performed:

[0087] S201: The historical password is randomly masked and directionally masked respectively to obtain an encoder string vector and a decoder string vector.

[0088] The historical password includes various types of password dictionaries such as common numerical password dictionaries, letter dictionaries, and various character combination dictionaries on the Internet, and S201 batch converts the historical password string into a word vector matrix.

[0089] On the basis of the encoder, decoder and hyperparameter k of the MASS algorithm, in order to make the detection model have higher prediction effect, the structure in the original MASS encoder-decoder is designed as an RNN network to extract vector features in the data; the overall architecture of the detection model is composed of an embedding layer, an encoder, a self-attention layer, a MASS decoder, a fully connected layer and a softmax layer.

[0090] Taking the string "I'm repair" as an example, a [CLS] mark is added at the beginning of the sequence, and a [SEP] mark is added at the end, so that the final total length = seq_length. If the string length is less than the specified length, 0 needs to be supplemented, and if the string length exceeds the specified length, the string needs to be cut off. The result after vectorization is as follows:

[0091] Sentence mark: [CLS] I'm repair [SEP] ;

[0092] Token encoding: [101, 146, 112, 182, 6949, 1158, 15642, 1116, 119, 102, 0, 0];

[0093] Position encoding: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11].

[0094] Token encoding is the vector obtained after each token in the above sequence is converted into encoding; position encoding records the position of each token.

[0095] First, the length of the string and the value of k in the MASS model need to be set. Assuming that the length of the predicted password is 5, the length of the string is set to 12 and k is set to 5 in the present application. The setting of k needs to be consistent with the bit number of the password to be detected in application. After setting the parameter values, the data is input to the embedding layer after vectorization processing. The embedding layer first converts the high-dimensional vector in the pre-processing into a low-dimensional vector through linear transformation in the embedding layer. In this embodiment, the original vector dimension is converted into a 128-dimensional low-dimensional vector, and token encoding and position encoding are generated for the sentences in the original data. In order to make the subsequent training process simple, the two vectors are added and combined, and further, the influence of the dimension between the data is eliminated through standardization to unify the comparability between the data.

[0096] The data processed by the embedding layer is input to the encoder. Assuming that the length of the original data string is 12 and the length of the predicted password is 5, k=5 needs to be set in the MASS encoder to randomly mask 5 characters in the string to obtain the encoder string vector. In the present application, the encoder adopts RNN (bidirectional recurrent neural network) to convert the encoder string vector into a series of hidden states When the length of the string is 12 and k=5, n=7. Specifically, for each time i, the hidden state is spliced from the hidden state output by the forward and reverse recurrent neural network. In theory, the state at time i after training contains all the information of the last password string vector, that is, the state h n of the last word in the last password string vector is regarded as a representation vector containing all the information of the password vector. In the present application, because the password string is usually short, the problem of neural network gradient explosion or disappearance is not significant, so the RNN network with two layers of hidden layers is designed internally to be used for training.

[0097] The decoder is an RNN with the same structure as the encoder. The input data of the decoder is consistent with the input of the encoder, and k=5 is also set, but this time the 5-character string after masking (directional masking) is set as the final predicted password value. The input of the decoder is set to , and the first value of the predicted value is yi (when the string length is 12, k = 5, i = 7). It should be particularly noted that the encoder passes the generated hidden state information to the decoder, and the hidden state d i-1 of the decoder at i-1 time is used to generate the prediction password information c i-1 . The initial value of d d is set to h . i-1 The hidden state weight W i .

[0098] S202: obtaining a predicted password according to the encoder string vector, the decoder string vector and the model weight.

[0099] Figure 4 is the flowchart of S202 in the embodiment of the application. As Figure 4 shown, S202 includes:

[0100] S301: determining the predicted password information according to the encoder string vector and the encoding model weight.

[0101] When the password is predicted, the comprehensive hidden state information d i-1 of the history information generated in the decoder is combined with the hidden state information of all time points in the encoder to dynamically select the information representation c i that is more effective for prediction. Because there is a self-attention mechanism in the encoder passed to the decoder stage, when y i is generated, the hidden state d i-1 of the decoder at i-1 time is known, and the effectiveness weight of the hidden state h j passed by the encoder is first allocated, and is set to :

[0102] ;

[0103] Further, after adding the information of all states of the encoder h j , the weight calculation for the password prediction at i time is:

[0104] ;

[0105] Finally, the predicted password information c i is obtained according to the weight information:

[0106] .

[0107] The encoding model weight includes the hidden state weight W d , the first encoding model weight W and the second encoding model weight U, and c i is the predicted password information at i time. is the jth encoder model factor at the ith moment j is the jth encoder hidden state, n is the length of the string, is the encoder model index, d i-1 is the decoder hidden state at the i-1th moment, W is the first encoding model weight, and U is the second encoding model weight.

[0108] S302: obtaining a predicted password according to the predicted password information, the decoder string vector, and the decoding model weight.

[0109] Figure 5 is the flowchart of S302 in the embodiment of the present application. As shown in Figure 5 , S302 includes:

[0110] S401: obtaining intermediate information according to the predicted password information, the decoder string vector, and the intermediate decoding model weight.

[0111] In specific implementation, the intermediate information is obtained by the following formula:

[0112] ;

[0113] wherein, is the intermediate information at the ith moment, y i-1 is the i-1th (i-1th moment) decoder string vector, U o is the first intermediate decoding model weight, and the default initial value is 0.3; V o is the second intermediate decoding model weight, and the default initial value is 0.3; H o is the third intermediate decoding model weight, and the default initial value is 0.4.

[0114] S402: obtaining a predicted password according to the intermediate information and the output decoding model weight.

[0115] In an embodiment, S402 includes: obtaining a full connection layer output result according to the intermediate information and the output decoding model weight; and obtaining a predicted password according to the full connection layer output result.

[0116] In specific implementation, the intermediate information is input to the full connection layer and the softmax layer classifier after being processed by an activation function.

[0117] The predicted word y i is derived from the character dictionary in the original data set, and then the full connection layer is the same as the number of character types in the character dictionary, which is used to calculate the output corresponding to each candidate word:

[0118] ;

[0119] wherein o is the output result of the full connection layer, W o is the output decoding model weight, t i is the output result of the full connection layer after being processed by the activation function .

[0120] The o is input to a Softmax classifier, and the probability of the kth word in the dictionary is calculated by the following formula: y i The word with the maximum probability in the dictionary is finally selected as the current word to obtain the predicted password:

[0121] .

[0122] In simple terms, the role of the decoder is to further combine the feature information of the input data learned in the encoder, character position feature information, and other information results with the input data in the decoder to predict the probability of the last five characters corresponding to the masked password in the decoder. The sample set of the character comes from all the characters appearing in the training set.

[0123] As described above, the full connection neural network and the softmax layer are jointly responsible for comprehensively calculating the state information calculated in the decoder and converting it into a probability value of the predicted word. In the present application, the prediction of the word is calculated one by one in the order, and the prediction of the next time depends on the prediction value of the last time, because the present patent needs to finally predict the password of all digits.

[0124] S203: Determine whether the current iteration number reaches the preset threshold.

[0125] S204: When the current iteration number reaches the preset threshold, create a password dictionary generation model according to the model weight.

[0126] S205: When the current iteration number does not reach the preset threshold, update the model weight according to the predicted password and the actual password.

[0127] In specific implementation, 80% of the historical passwords are divided into a training set and 20% are divided into a test set, and the MASS model is iteratively trained to obtain a password dictionary generation model. The fitting accuracy of the predicted password output by the final password dictionary generation model reaches more than 95% of the test set.

[0128] Since the training model pursues the accuracy of the training prediction output, and the prediction output result hopes to output multiple prediction values corresponding to the data according to the corresponding probability value, when training, the first 10 prediction words with probability calculated by softmax are output as the final candidate of the password dictionary. When k-bit data needs to be predicted, the last k bits of the data to be predicted are filled with 0, which is meaningless, and the last k bits of data are masked and predicted when the input of the decoder is used.

[0129] The specific flow of the embodiment of the present application is as follows:

[0130] 1. The historical passwords are respectively randomly masked and directionally masked to obtain an encoder string vector and a decoder string vector.

[0131] 2. The predicted password information is determined according to the encoder string vector and the encoding model weight.

[0132] 3. The intermediate information is obtained according to the predicted password information, the decoder string vector and the intermediate decoding model weight.

[0133] 4. The full connection layer output result is obtained according to the intermediate information and the output decoding model weight, and the predicted password is obtained according to the full connection layer output result.

[0134] 5. When the current iteration number reaches a preset threshold, a password dictionary generation model is created according to the model weight, otherwise the model weight is updated according to the predicted password and the actual password, and the step 1 is returned.

[0135] 6. The initial password dictionary is input into each password dictionary generation model based on the historical password to obtain a target password dictionary.

[0136] 7. The password detection threshold is determined according to the number of users corresponding to the asset and the password detection time.

[0137] 8. The asset is identified to obtain the asset IP address, and the service corresponding to the asset is determined according to the asset IP address.

[0138] 9. The target password in the target password dictionary is compared with the preset password of the service according to the password detection threshold, and the password detection result is obtained according to the comparison result.

[0139] In summary, the present application analyzes common password combinations, uses a MASS artificial intelligence model to intelligently simulate users to generate a password dictionary with high prediction efficiency, and combines automatic detection to effectively identify assets with security risks in enterprise network assets under the premise of ensuring normal operation of the system, and outputs the system and password with security risks according to the detection result, and finally establishes a rectification mechanism to close-loop manage the system and password with security risks, ensuring that the problems are rectified in a timely manner, and further improving the security of the system.

[0140] In summary, the asset password detection method provided by the embodiment of the present application has the following beneficial effects:

[0141] 1. By analyzing a large number of common passwords, a new dictionary is generated by using artificial intelligence, which improves the hit rate of system password security detection and improves the work efficiency of password security detection.

[0142] 2. The password detection function modularization improves the flexibility of the tool, facilitating more function customization.

[0143] 3. In the detection process, the password detection mode can be flexibly adjusted according to the account locking mechanism of different services, the password detection of the corresponding service is completed under the premise of guaranteeing the normal operation of the system, thereby effectively solving the problem that the account is easily locked in the password detection process, thereby affecting the normal business.

[0144] Based on the same inventive concept, the embodiments of the present application also provide an asset password detection device. Since the principle of the device for solving the problem is similar to the asset password detection method, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described again.

[0145] Figure 6 is a structural block diagram of the asset password detection device in the embodiments of the present application. Figure 7 is a structural block diagram of the asset password detection device in another embodiment of the present application. Figure 8 is Figure 7 a structural block diagram of the dictionary generation module. Figure 9 is Figure 7 a structural block diagram of the asset processing module. Figure 10 is Figure 7 a structural block diagram of the password detection module. As shown in Figures 6-10 , the asset password detection device comprises:

[0146] a target password dictionary module, configured to input an initial password dictionary into each password dictionary generation model based on a history password to obtain a target password dictionary;

[0147] a password detection threshold module, configured to determine a password detection threshold according to a number of users corresponding to the asset and a password detection time;

[0148] a password detection result module, configured to perform password detection on a service corresponding to the asset by using the target password dictionary according to the password detection threshold to obtain a password detection result.

[0149] In one embodiment, the device further comprises:

[0150] a masking module, configured to respectively perform random masking and directional masking on the history password to obtain an encoder string vector and a decoder string vector;

[0151] a predicted password module, configured to obtain a predicted password according to the encoder string vector, the decoder string vector and a model weight;

[0152] The iteration module is configured to create a password dictionary generation model according to the model weight when the current iteration number reaches a preset threshold, or update the model weight according to the predicted password and the actual password, and continue to perform the iteration processing.

[0153] In one embodiment, the predicted password module comprises:

[0154] A predicted password information unit is configured to determine predicted password information according to the encoder string vector and the encoding model weight.

[0155] A predicted password unit is configured to obtain a predicted password according to the predicted password information, the decoder string vector and the decoding model weight.

[0156] In one embodiment, the predicted password unit comprises:

[0157] An intermediate information subunit is configured to obtain intermediate information according to the predicted password information, the decoder string vector and the intermediate decoding model weight.

[0158] A predicted password subunit is configured to obtain a predicted password according to the intermediate information and the output decoding model weight.

[0159] In one embodiment, the predicted password subunit is specifically configured to:

[0160] Obtain a full connection layer output result according to the intermediate information and the output decoding model weight.

[0161] Obtain a predicted password according to the full connection layer output result.

[0162] In one embodiment, the method further comprises:

[0163] An asset identification module is configured to identify an asset and obtain an asset IP address.

[0164] A service determination module is configured to determine a service corresponding to the asset according to the asset IP address.

[0165] In one embodiment, the password detection result module is specifically configured to:

[0166] Compare a target password in a target password dictionary with a preset password of the service according to a password detection threshold, and obtain a password detection result according to a comparison result.

[0167] As Figures 7-10As shown in the actual application, the asset password detection device includes a dictionary generation module, an asset processing module, a password detection module, and a result output module. The dictionary generation module is responsible for generating a password dictionary for detecting passwords, providing preparation for subsequent password detection. The asset processing module is responsible for processing the scope of the system to be detected, including identifying asset scope and marking asset service type, etc. The password detection module is responsible for detecting whether the target system has weak password problems. The result output module is responsible for returning the weak password detection result, and the detection result is output and displayed in the form of asset IP, service type, and successful password. Through the construction of the above modules, the detection method and system for system weak passwords are realized.

[0168] As shown in the actual application, the asset password detection device includes a dictionary generation module, an asset processing module, a password detection module, and a result output module. The dictionary generation module is responsible for generating a password dictionary for detecting passwords, providing preparation for subsequent password detection. The asset processing module is responsible for processing the scope of the system to be detected, including identifying asset scope and marking asset service type, etc. The password detection module is responsible for detecting whether the target system has weak password problems. The result output module is responsible for returning the weak password detection result, and the detection result is output and displayed in the form of asset IP, service type, and successful password. Through the construction of the above modules, the detection method and system for system weak passwords are realized. Figure 8

[0169] The input summary unit is used to collect common password dictionaries in the Internet, such as numerical password dictionaries, alphabetical dictionaries, and various character combination dictionaries, as training data for the intelligent model unit.

[0170] The intelligent model unit includes a masking module, a predicted password module, and an iteration module, which are used to vectorize the dictionaries in the input summary unit, input the data into the improved MASS model for several iterations of training until the model training detection accuracy reaches 95% or more, and then the trained model is passed to the dictionary intelligent detection output unit.

[0171] The dictionary intelligent output unit includes a target password dictionary module, which is used to input various types of password dictionaries containing target asset system information into the trained model of the intelligent model unit for prediction. The output of the model is a high-predictive-rate password dictionary. The dictionary generated by merging the above password dictionary with the default password is the final password dictionary with good detection efficiency, which is used to detect the security of the target system.

[0172] As shown in the actual application, the asset password detection device includes a dictionary generation module, an asset processing module, a password detection module, and a result output module. The dictionary generation module is responsible for generating a password dictionary for detecting passwords, providing preparation for subsequent password detection. The asset processing module is responsible for processing the scope of the system to be detected, including identifying asset scope and marking asset service type, etc. The password detection module is responsible for detecting whether the target system has weak password problems. The result output module is responsible for returning the weak password detection result, and the detection result is output and displayed in the form of asset IP, service type, and successful password. Through the construction of the above modules, the detection method and system for system weak passwords are realized. Figure 9

[0173] The asset IP carding unit is used to card the input enterprise network asset IP, and split the asset IP segment into a single IP.

[0174] The asset service carding unit includes an asset identification module and a service determination module, which are used to identify asset services, detect the service type of the IP from the asset IP carding unit, identify the port, and mark the open services and ports.​​

[0175] The asset data output unit is configured to output the open services and ports marked by the asset service teasing unit, and finally output to the password detection module for user password vulnerability detection.

[0176] As shown in Figure 10 , the password detection module is mainly used for user password vulnerability detection, and includes a detection unit and a comparison unit.

[0177] The detection unit includes a password detection threshold module, which is configured to select a data packet format of a corresponding service according to different service types and conduct detection in combination with a password dictionary. A user can customize a threshold and a lock period of a password lock mechanism of different service systems, and the detection unit will automatically perform password detection within the threshold range and perform cover test on the remaining passwords in the dictionary one by one after each lock period.

[0178] The comparison unit includes a password detection result module, which is configured to compare whether the data packet returned by the detection unit is consistent with a data packet of successful login, and if consistent, mark the IP, port, service and password of successful login of the detection target.

[0179] In summary, the asset password detection device according to the embodiment of the present application first inputs an initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary, then determines a password detection threshold according to a number of users corresponding to the asset and a password detection time, and finally performs password detection on the services corresponding to the asset according to the password detection threshold by using the target password dictionary to obtain a password detection result, which can effectively detect passwords with vulnerability to improve the security and overall defense capability of information system assets.

[0180] The embodiment of the present application further provides a specific implementation of a computer device capable of implementing all steps of the asset password detection method in the above embodiment. Figure 11 is a structural block diagram of the computer device in the embodiment of the present application, and Figure 11 , the computer device specifically includes the following contents:

[0181] A processor 1101 and a memory 1102.

[0182] The processor 1101 is configured to call a computer program in the memory 1102, and the processor implements all steps of the asset password detection method in the above embodiment when executing the computer program, for example, the processor implements the following steps when executing the computer program:

[0183] inputting an initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary;

[0184] determine a password detection threshold according to the number of users corresponding to the asset and the password detection time;

[0185] perform password detection on the service corresponding to the asset according to the target password dictionary and the password detection threshold to obtain a password detection result.

[0186] In summary, the computer device of the embodiment of the present application first inputs the initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary, then determines a password detection threshold according to the number of users corresponding to the asset and the password detection time, and finally performs password detection on the service corresponding to the asset according to the target password dictionary and the password detection threshold to obtain a password detection result, which can effectively detect passwords with vulnerability to improve the security of information system assets and the overall defense capability.

[0187] The embodiment of the present application also provides a computer readable storage medium capable of implementing all steps of the asset password detection method in the above embodiment, and the computer readable storage medium stores a computer program, which, when executed by a processor, implements all steps of the asset password detection method in the above embodiment, for example, the processor implements the following steps when executing the computer program:

[0188] input the initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary;

[0189] determine a password detection threshold according to the number of users corresponding to the asset and the password detection time;

[0190] perform password detection on the service corresponding to the asset according to the target password dictionary and the password detection threshold to obtain a password detection result.

[0191] In summary, the computer readable storage medium of the embodiment of the present application first inputs the initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary, then determines a password detection threshold according to the number of users corresponding to the asset and the password detection time, and finally performs password detection on the service corresponding to the asset according to the target password dictionary and the password detection threshold to obtain a password detection result, which can effectively detect passwords with vulnerability to improve the security of information system assets and the overall defense capability.

[0192] The embodiment of the present application also provides a computer program product capable of implementing all steps of the asset password detection method in the above embodiment, and the computer program product comprises a computer program / instruction, which, when executed by a processor, implements all steps of the asset password detection method in the above embodiment, for example, the processor implements the following steps when executing the computer program:

[0193] Input the initial password dictionary into each password dictionary generation model based on the historical passwords to obtain a target password dictionary;

[0194] Determine a password detection threshold according to the number of users corresponding to the asset and the password detection time;

[0195] Perform password detection on the service corresponding to the asset according to the password detection threshold to obtain a password detection result.

[0196] In summary, the computer program product of the embodiment of the present application first inputs the initial password dictionary into each password dictionary generation model based on the historical passwords to obtain a target password dictionary, then determines a password detection threshold according to the number of users corresponding to the asset and the password detection time, and finally performs password detection on the service corresponding to the asset according to the password detection threshold to obtain a password detection result, which can effectively detect passwords with vulnerability to improve the security of information system assets and the overall defense capability.

[0197] The above-described specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present application, and it should be understood that the above-described specific embodiments are only for the specific embodiments of the present application and are not used to limit the protection scope of the present application, and any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0198] Those skilled in the art can also understand that the various illustrative logical blocks, units and steps listed in the embodiments of the present application can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the above various illustrative components, units and steps have been generally described their functions. Whether the functions are implemented by hardware or software depends on the specific application and design requirements of the overall system. Those skilled in the art can use various methods to implement the functions for each specific application, but such implementation should not be understood as beyond the scope of protection of the embodiments of the present application.

[0199] The various illustrative logical blocks, modules, or units described in connection with the embodiments disclosed herein can be implemented or performed with a general purpose processor, a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor can be a microprocessor, but in the alternative, the general purpose processor can be any conventional processor, controller, microcontroller, or state machine. A processor can also be implemented as a combination of computing devices, e.g., a combination of a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other such configuration.

[0200] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium can be coupled to the processor, such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor. The processor and the storage medium can reside in an ASIC, which can reside in a user terminal. In the alternative, the processor and the storage medium can also reside in different components of a user terminal.

[0201] In one or more exemplary designs, the functions described can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Storage media can be any available media that can be accessed by a computer. By way of example, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or other wire-based, fiber-based, or wireless technologies, then the coaxial cable, fiber optic cable, twisted pair, DSL, or other wire-based, fiber-based, or wireless technologies are included in the definition of computer-readable medium. Disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, DVD, floppy disk, and Blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

Claims

1. An asset password detection method, characterized in that, The method comprises the following steps: inputting an initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary; determining a password detection threshold according to the number of users corresponding to the asset and the password detection time; performing password detection on the service corresponding to the asset according to the password detection threshold and the target password dictionary to obtain a password detection result; The step of creating the password dictionary generation model comprises: performing the following iterative processing: randomly masking and directionally masking the historical passwords respectively to obtain an encoder string vector and a decoder string vector respectively; obtaining a predicted password according to the encoder string vector, the decoder string vector and model weights; when the current iteration number reaches a preset threshold, creating the password dictionary generation model according to the model weights, otherwise updating the model weights according to the predicted password and the actual password and continuing to perform the iterative processing; obtaining the predicted password according to the encoder string vector, the decoder string vector and the model weights comprises: determining predicted password information according to the encoder string vector and the encoding model weights; obtaining the predicted password according to the predicted password information, the decoder string vector and the decoding model weights.

2. The asset password detection method of claim 1, wherein, obtaining the predicted password according to the predicted password information, the decoder string vector and the decoding model weights comprises: obtaining intermediate information according to the predicted password information, the decoder string vector and the intermediate decoding model weights; obtaining the predicted password according to the intermediate information and the output decoding model weights.

3. The asset password detection method of claim 2, wherein, obtaining the predicted password according to the intermediate information and the output decoding model weights comprises: obtaining a full connection layer output result according to the intermediate information and the output decoding model weights; obtaining the predicted password according to the full connection layer output result.

4. The asset password detection method of claim 1, wherein, The method further comprises: identifying the asset to obtain an asset IP address; determining the service corresponding to the asset according to the asset IP address.

5. The asset password detection method of claim 4, wherein, performing password detection on the service corresponding to the asset according to the password detection threshold and the target password dictionary to obtain a password detection result comprises: comparing a target password in the target password dictionary with a preset password of the service according to the password detection threshold, and obtaining a password detection result according to the comparison result.

6. An asset password detection apparatus, characterized by comprising: The method comprises the following steps: a target password dictionary module configured to input an initial password dictionary into each password dictionary generation model based on historical passwords to obtain a target password dictionary; a password detection threshold module configured to determine a password detection threshold according to the number of users corresponding to the asset and the password detection time; a password detection result module configured to perform password detection on the service corresponding to the asset according to the password detection threshold and the target password dictionary to obtain a password detection result; a masking module configured to randomly mask and directionally mask the historical passwords respectively to obtain an encoder string vector and a decoder string vector respectively; a predicted password module configured to obtain a predicted password according to the encoder string vector, the decoder string vector and model weights; The iteration module is configured to create a password dictionary generation model according to the model weight when the current iteration number reaches a preset threshold, or update the model weight according to the predicted password and the actual password, and continue the iteration process. The predicted password module comprises: A predicted password information unit configured to determine predicted password information according to the encoder string vector and the encoding model weight; A predicted password unit configured to obtain a predicted password according to the predicted password information, the decoder string vector and the decoding model weight.

7. A computer device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor executes the computer program to implement the steps of the asset password detection method in any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the asset password detection method in any one of claims 1 to 5.

9. A computer program product comprising computer programs / instructions, which, when executed by a processor, implement the steps of the asset password detection method in any one of claims 1 to 5.

Images