Weak password protection method, device, equipment, medium and product

Abstract

The invention provides a weak password protection method and device, equipment, a medium and a product. The method comprises the following steps: acquiring first network transmission information; extracting at least one object name and at least one corresponding object value from the first network transmission information; according to the semantic information represented by the at least one object name, a first target object name is determined, and the semantic information of the first target object name represents a password; based on a weak password recognition rule, recognizing a first object value corresponding to the first target object name, and determining a recognition result; and executing a corresponding weak password protection operation according to an identification result. In the method, the first object value representing the password value in the network transmission information is accurately extracted through object extraction and semantic recognition, and weak password recognition and weak password protection operation are performed on this basis, so that the accuracy of weak password recognition is effectively improved, false alarms are reduced, and the effect of weak password protection is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a weak password protection method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of network technology, network traffic analysis (NTA) systems have emerged. Network traffic analysis systems are used to detect and analyze network traffic and identify abnormal behaviors and potential threats in the network.

[0003] The network traffic analysis system can perform multi-faceted analysis on network traffic. For example, the network traffic analysis system can identify weak passwords that appear in network traffic. Generally, the network traffic analysis system can identify weak passwords based on preset identification rules or identification patterns.

[0004] However, since network traffic is usually more complex, the false alarm rate of the above method is high, the accuracy of weak password identification is not strong, and the protection effect of weak passwords is poor. Summary of the invention

[0005] The present application provides a weak password protection method. The method can effectively improve the accuracy of weak password recognition and the weak password protection effect. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides a weak password protection method, the method comprising:

[0007] Acquiring first network transmission information;

[0008] Extracting at least one object name and at least one corresponding object value from the first network transmission information;

[0009] Determine a first target object name according to the semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password;

[0010] Based on the weak password identification rule, identifying the first object value corresponding to the first target object name, and determining an identification result;

[0011] According to the identification result, a corresponding weak password protection operation is performed.

[0012] In a second aspect, the present application provides a weak password protection device, the device comprising:

[0013] An acquisition module, used to acquire first network transmission information;

[0014] An extraction module, configured to extract at least one object name and at least one corresponding object value from the first network transmission information;

[0015] A determination module, configured to determine a first target object name according to semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password;

[0016] an identification module, configured to identify the first object value corresponding to the first target object name based on a weak password identification rule, and determine an identification result;

[0017] An execution module is used to execute corresponding weak password protection operations according to the identification result.

[0018] In a third aspect, the present application provides an electronic device, comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory so that the electronic device performs the weak password protection method in the first aspect or any implementation of the first aspect.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, wherein the instructions instruct an electronic device to execute the weak password protection method described in the first aspect or any one of the implementations of the first aspect.

[0020] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the weak password protection method described in the first aspect or any one of the implementations of the first aspect.

[0021] Based on the implementations provided in the above aspects, the present application can also be further combined to provide more implementations.

[0022] It can be seen from the above technical solutions that this application has the following advantages:

[0023] The present application provides a weak password protection method, which first obtains first network transmission information, extracts at least one object name and at least one corresponding object value from the first network transmission information, then determines a first target object name based on semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password, identifies a first object value corresponding to the first target object name based on a weak password recognition rule, determines a recognition result, and performs a corresponding weak password protection operation based on the recognition result.

[0024] In this method, complex network transmission information is split into simple and clear object names and object values ​​through object extraction, and then the first target object name representing the password is determined through semantic recognition. In this way, the first object value representing the password value in the network transmission information is accurately extracted, and weak password identification and weak password protection operations are performed on this basis, which effectively improves the accuracy of weak password identification, reduces false alarms, and improves the effect of weak password protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0026] Figure 1 A flowchart of a weak password protection method provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of the architecture of a network traffic analysis system provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the structure of a weak password protection device provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0031] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0032] With the rapid development of network technology, network security issues have become increasingly prominent. Network traffic analysis (NTA) systems have emerged and are widely used in many fields.

[0033] The network traffic analysis system combines rule-based detection technology with machine learning, feature analysis and other technologies to analyze network traffic or network logs, detect potential threats in the network, and generate alarm information for detected potential threats.

[0034] In some examples, the network traffic analysis system can identify weak passwords that appear in network traffic. The above process can be called weak password identification. Among them, weak passwords usually refer to simple, easy to remember, and lack of complexity. Weak passwords are usually easy to guess and crack. The existence of weak passwords poses a great threat to network security.

[0035] In the related art, the network traffic analysis system usually identifies weak passwords based on preset identification rules or identification patterns. For example, the network traffic analysis system can match the network transmission information with the identification rules or identification patterns, and determine the matched passwords as weak passwords. Usually, the identification rules or identification patterns can include consecutive letters, consecutive numbers, and no special characters. For another example, the network traffic analysis system can pre-configure a fixed password dictionary and determine the passwords that hit the password field in the network transmission information as weak passwords.

[0036] However, since network traffic is usually more complex, network transmission information usually contains a large amount of different types of information. Different types of information can have different transmission formats and data packet structures. The false alarm rate of the above method is high, the accuracy of weak password identification is not strong, and there are certain limitations.

[0037] In view of this, the present application provides a weak password protection method, which first obtains first network transmission information, extracts at least one object name and at least one corresponding object value from the first network transmission information, and then determines a first target object name based on semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password, and based on a weak password recognition rule, identifies the first object value corresponding to the first target object name, determines a recognition result, and performs a corresponding weak password protection operation based on the recognition result.

[0038] In this method, complex network transmission information is split into simple and clear object names and object values ​​through object extraction, and then the first target object name representing the password is determined through semantic recognition. In this way, the first object value representing the password value in the network transmission information is accurately extracted, and weak password identification and weak password protection operations are performed on this basis, which effectively improves the accuracy of weak password identification, reduces false alarms, and improves the effect of weak password protection.

[0039] To facilitate understanding of the technical solution provided by the embodiments of the present application, it will be described below with reference to the accompanying drawings.

[0040] See also Figure 1 The flowchart of a weak password protection method provided by an embodiment of the present application is shown, and the method can be applied to a network traffic analysis system. The method specifically includes:

[0041] S101: Acquire first network transmission information.

[0042] In the embodiment of the present application, the first network transmission information can be understood as information related to network traffic transmitted in the Internet or local area network, and the first network transmission information can include different types of network transmission data packets. Specifically, the first network transmission information can include load information extracted from the application layer, such as login information, file information, hypertext transfer protocol (HTTP) request information, etc.

[0043] Typically, the first network transmission information is transmitted in the network in the form of American Standard Code for Information Interchange (ASCII) coding, wherein ASCII coding is an English-based character coding standard that uses 7-bit binary numbers to represent characters and can represent 128 different characters.

[0044] Considering that ASCII encoding can only represent the most basic character encoding and cannot cover characters other than English, it has certain limitations. In addition, considering that the first network transmission information may contain uniform resource locator (URL) encoding, the network traffic analysis system can pre-process the first network transmission information and convert the first network transmission information into a form similar to natural language, so as to subsequently perform object extraction and semantic recognition on the first network transmission information.

[0045] In a specific implementation, the first network transmission information is converted into an 8-bit (8-bit unicode transformation format, UTF-8) encoding form, and / or the URL encoding included in the first network transmission information is decoded.

[0046] Compared with ASCII encoding, UTF-8 encoding has a wider encoding range and can represent more than 1 million different characters and cover characters in many different languages. In addition, UTF-8 encoding is compatible with ASCII encoding. ASCII-encoded characters can also be displayed normally in UTF-8 encoding, which has better compatibility.

[0047] In some embodiments, the above transcoding process and decoding process can be performed successively. For example, the first network transmission information is first converted into a UTF-8 encoding form, and then after the transcoding process is completed, the URL encoding included in the transcoded first network transmission information is decoded. In this way, by first transcoding and then decoding, the first network transmission information similar to natural language and easy to understand is obtained.

[0048] Typically, the network traffic analysis system can receive the first network transmission information reported by the traffic probe. In other words, the first network transmission information can be collected by the traffic probe. The traffic probe can be understood as a network device or component used to detect and analyze network traffic. The traffic probe is usually deployed in key nodes of the network and can detect data flow in the network in real time. Typically, the traffic probe can be a network device or component outside the network traffic analysis system.

[0049] In some possible implementations, the traffic probe can collect network traffic, obtain first network transmission information, and directly send the first network transmission information to the network traffic analysis system so that the network traffic analysis system can pre-process the first network transmission information and perform subsequent weak password identification and weak password protection operations.

[0050] In other possible implementations, considering that network traffic is usually large, the network traffic analysis system is inefficient and time-consuming in processing large-scale first network transmission information. The traffic probe can also perform preliminary screening of the collected network transmission information, and then send the screened network transmission information to the network traffic analysis system, thereby reducing the amount and scale of network transmission information, so that the network traffic analysis system can perform efficient and rapid weak password identification.

[0051] In a specific implementation, the traffic probe can collect network traffic, obtain initial network transmission information, and determine the first network transmission information that matches the regular expression and has response information from the initial network transmission information.

[0052] The initial network transmission information can be understood as network transmission information collected by a traffic probe and not processed in any way. In an embodiment of the present application, the regular expression indicates at least one feature related to a weak password.

[0053] That is to say, through regular expression matching, network transmission information that meets the characteristics of weak passwords is filtered out from the initial network transmission information, and network transmission information that is not related to weak passwords is filtered out. For example, the regular expression can be "(pass|pwd)(=|%3d)[0-9]{6}".

[0054] After filtering out the network transmission information irrelevant to the weak password, further filtering out the network transmission information irrelevant to the password input and password transmission process by determining whether there is response information.

[0055] It is understandable that password input and password transmission are usually accompanied by the operation of sending a login request message. After receiving the login request message, the application layer will generate corresponding response information, such as response information indicating that the password is correct or response information indicating that the password is wrong. Therefore, if there is no response information for the network transmission information, it indicates that the network transmission information is not related to the password input and password transmission. For example, the network transmission information may be a digital input instead of a password input.

[0056] By performing regular expression matching and response information judgment on the initial network transmission information collected by the traffic probe, the initial network transmission information is preliminarily screened, and the network transmission information in the initial network transmission information that may be related to weak passwords is reported to the network traffic analysis system as the first network transmission information, thereby reducing the processing pressure of the network traffic analysis system.

[0057] S102: Extract at least one object name and at least one corresponding object value from the first network transmission information.

[0058] The process of inputting a password usually includes two steps: "inputting a user name" and "inputting a password", and the user needs to input the user name and password respectively. In other words, the process of inputting a password usually generates "user name - user name value" and "password - password value".

[0059] Taking into account the characteristics of the password input process, in order to more accurately determine the content related to the password from the first network transmission information, in an embodiment of the present application, object extraction can be performed on the first network transmission information, and information with a corresponding relationship of "object name-object value" can be extracted from the first network transmission information for further judgment.

[0060] The object name can be understood as a text used to represent the meaning of an object. For example, the object name can be "system version", "user name", "protocol name", etc. The object value can be understood as the specific value of the object name corresponding to the object name. For example, when the object name is "system version", the object value corresponding to the object name can be "1.0", when the object name is "user name", the object value corresponding to the object name can be "admin", and when the object name is "protocol name", the object value corresponding to the object name can be "TCP".

[0061] In some possible implementations, the correspondence relationship of "object name - object value" may exist in the form of a key-value pair. In specific implementations, at least one key-value pair is determined from the first network transmission information according to the set segmentation character and / or segmentation rule, and then the at least one key-value pair is split to obtain at least one object name and at least one corresponding object value.

[0062] Among them, the key in the key-value pair represents the object name, and the value in the key-value pair represents the object value. The separation character can be understood as the character used to separate different key-value pairs. For example, the separation character can be "&". The separation rule can be understood as the rule used to separate different key-value pairs. For example, the separation rule can be "separate N consecutive characters into one key-value pair". The separation character and / or separation rule can be set based on actual business, and the embodiments of the present application are not limited to this.

[0063] It should be noted that in the embodiment of the present application, the object value may be empty, that is, the object value corresponding to the object name may be an empty value. For example, when the user does not enter an object value for the object name, or the object value corresponding to the object name is not collected, the object value corresponding to the object name may be an empty value.

[0064] After segmenting the first network transmission information at the granularity of key-value pairs and extracting the key-value pairs representing the object name and the object value, the key-value pairs are further split to separate the key from the value to obtain a one-to-one corresponding key-value list. In this way, the object name and the object value are decoupled, and the interference of the object name on the judgment is reduced when the weak password is subsequently judged.

[0065] S103: Determine a first target object name according to semantic information represented by at least one object name.

[0066] The semantic information of the first target object name represents the password. In other words, the first target object name representing "password" is determined from at least one object name. For example, the first target object name can be an object name whose semantic information represents the password, such as "password", "password", "pwd", etc.

[0067] In the embodiment of the present application, a first target object name representing the password is identified by performing semantic recognition on at least one object name. In some possible implementations, since the object name is similar to a natural language, the process of identifying the target object name can be understood as a natural language classification task, and therefore, the determination of the target object name can be implemented in combination with a natural language classification model.

[0068] In a specific implementation, at least one object name is input into a natural language classification model, a classification result returned by the natural language classification model is received, and a first target object name is determined according to the classification result. The natural language classification model can be used to classify at least one object name based on semantic information represented by the object name.

[0069] Specifically, the classification result may be "belongs to the first target object name" and "does not belong to the first target object name". In some possible implementations, the classification result may be further refined into "belongs to the first target object name", "belongs to the second target object name" and "does not belong to the target object name".

[0070] The semantic information of the second target object name represents the account name. For example, the second target object name may be an object name whose semantic information represents the account name, such as "user name", "account number", "user", etc. In this way, the object name related to the account name is identified at the same time, so as to associate the account name with the password.

[0071] In some embodiments, in a natural language classification model, the word to vector (word2vec) technology is used to convert words into vectors, and then the continuous bag of words (CBOW) technology is used to determine the vector representation of the phrase based on the vector representation of each word in the phrase.

[0072] Taking into account the abbreviations or incompleteness that may exist in the object name, for example, abbreviating "password" to "pwd", in an embodiment of the present application, subword embedding technology can also be introduced to represent abbreviations or incomplete words as the average vector of each character, so that the natural language classification model can learn the internal structure information of non-standard words and improve the natural language classification model's ability to understand non-standard words.

[0073] In this way, the initial natural language classification model is trained using common object names that represent passwords (and common object names that represent account names) as training data, and a natural language classification model with a precision-recall rate that meets the requirements and a certain generalization ability to recognize new object names is obtained. In actual model reasoning, the first target object name is quickly and accurately identified from at least one object name, ensuring the recognition accuracy while improving the recognition throughput, and being able to cope with large-scale recognition scenarios.

[0074] In the embodiment of the present application, the steps of password extraction and weak password identification are decoupled. Before actually identifying the weak password, the password is first extracted from the first network transmission information. With the help of natural language recognition and semantic understanding, the password itself is gradually disassembled from the first network transmission information to achieve the separation of the password and the network transmission information. In this way, in the weak password identification step, only the password itself needs to be identified, and other information such as the structure and format of the network transmission information is not required, thereby improving the accuracy of weak password identification.

[0075] S104: Based on the weak password identification rule, identify the first object value corresponding to the first target object name and determine an identification result.

[0076] By extracting the first target object name whose semantic information represents the password from the complex first network transmission information, weak password identification can be performed on the first object value (i.e., the password value) corresponding to the first target object name, thereby achieving accurate identification without being affected by other interferences such as data format and component compatibility.

[0077] The weak password identification rule can be understood as a rule for identifying whether the first object value is a weak password. In an embodiment of the present application, the weak password identification rule may include multiple different types of identification rules. In other words, multi-dimensional weak password identification may be performed for the first object value.

[0078] In specific implementation, it can be determined whether the first object value corresponding to the first target object name belongs to at least one of the following: a password that is a known weak password after decoding, a password that matches the encoded value of a known weak password, a password existing in a network password library, or a password that meets the weak password specifications. If so, it is determined that the first object value corresponding to the first target object name is a weak password.

[0079] The following is a specific description of different types of identification rules. In some embodiments, the password can be a coded password, such as a base64 coded password or a hash coded password. The coded password can only ensure that the plain text password will not appear during the network transmission process, but some passwords generated after weak coding still have risks. For coded passwords, it can be determined whether it is a weak password by matching after decoding or matching with a rainbow table. For example, for base64 coded passwords, the weak password identification rule can be to first perform base64 decoding on the first object value, and then determine whether the decoded password belongs to a weak password (such as matching with the password in the common password book). For another example, for hash coded passwords, the weak password identification rule can be to match the first object value with the hash rainbow table to determine whether it belongs to a weak password.

[0080] In other embodiments, the weak password identification rule may be to match the first object value with the network password library to determine whether it is a weak password. The network password library may include passwords that exist in the network and appear frequently. In addition, the network password library may also include special passwords that are variants of frequently appearing passwords through algorithms to increase the coverage of the network password library. In this way, by matching the first object value with the network password library, the passwords that have been exposed in the network are determined to be weak passwords.

[0081] In other embodiments, the weak password identification rule may be to match the first object value with the weak password identification specification to determine whether it is a weak password. Among them, the weak password identification specification can be understood as a specification commonly used in the industry to determine whether it is a weak password based on the character type and / or number of characters in the first object value. For example, the weak password identification specification may be less than 8 characters, or may not contain at least three of uppercase characters, lowercase characters, numbers, and special characters, and a password that meets the weak password identification specification is determined as a weak password.

[0082] In this way, multiple dimensions and multiple types of weak password identification are performed on the first object value to improve the accuracy and completeness of weak password identification.

[0083] Generally, weak passwords can also have specificity. For example, for a certain company, passwords related to the company name, specific abbreviations, specific expressions, etc. are also weak passwords. In traditional weak password identification, it is difficult to identify weak passwords with the above specificity. In the embodiment of the present application, users are supported to configure weak password identification specifications by themselves through the network traffic analysis platform.

[0084] In an embodiment of the present application, the network traffic analysis platform can provide a configuration page, and the user can perform relevant configurations for weak password identification in the configuration page. Specifically, the user's configuration operation for weak password identification is received, and then, according to the identification requirements indicated by the configuration operation, weak password identification rules are generated. In other words, in an embodiment of the present application, the user can personalize the weak password identification rules.

[0085] In some embodiments, the configuration operation may be an operation of configuring a personalized password book. That is, the user may directly customize the password book based on the weak password identification requirements. The password book customized by the user may include passwords related to the company name, specific abbreviations, specific expressions, etc. For example, the user may upload the customized password book in the configuration page provided by the network traffic analysis platform to complete the configuration operation.

[0086] In other embodiments, considering that it is difficult for users to directly customize the password book, the configuration operation can also be an operation of configuring identification requirements. For example, the user can enter natural language representing the configuration requirements in the configuration page provided by the network traffic analysis platform, and the network traffic analysis platform can automatically generate weak password identification rules through natural language recognition, code generation, etc.

[0087] By providing the function of personalized customization of weak password identification rules, the usability and convenience are improved, personalized weak password identification is implemented for different users, and the accuracy of weak password identification is further improved.

[0088] The following is an introduction to the weak password identification method provided above with a specific example. The first network transmission information in ASCII encoding is “26555549443d264454505655534552532e434f4d50414e595f49443d33333035264454505655534552532e555345525f434f44453d435731343930264454505655534552532e50415353574f52 443d21213836383638265359535f56455253494f4e3d332e35,"After transcoding and decoding, the first network transmission information is "&UUID=&DTPVUSERS.COMPANY_ID=3305&DTPVUSERS.USER_CODE=CW1490&DTPVUSERS.PASSWORD=! ! 86868&SYS_VERSION=3.5".

[0089] By using the split character "&", multiple key-value pairs "UUID=", "DTPVUSERS.COMPANY_ID="3305", "DTPVUSERS.USER_CODE="CW1490", "DTPVUSERS.PAS SWORD="! ! 86868" and "SYS_VERSION="3.5" are determined from the first network transmission information, and then the key and value are split and the key is semantically identified to determine the type of each key: "UUID—non-target object name", "DTPVUSERS.COMPANY_ID—non-target object name", "DTPVUSERS.USER_CODE—second target object name", "DTPVUSERS.PASSWORD—first target object name" and "SYS_VERSION—non-target object name". Among them, the semantic information of DTPVUSERS.PASSWORD represents the password, and the semantic information of DTPVUSERS.USER_CODE represents the account name.

[0090] Next, weak password identification is performed on the first object value corresponding to DTPVUSERS.PASSWORD (ie!!86868), and it is determined that the first object value hits the weak password identification rule and is a weak password, and the identification result is determined.

[0091] Furthermore, the recognition result may be stored in the form of a structure, wherein the structure may include: a field indicating the name of the first target object, a field indicating the value of the first object, and a field indicating whether the value of the first object is a weak password.

[0092] In some embodiments, the target object name may also include a second target object name representing an account name. In this case, the structure may also include at least one of the following: a field indicating the second target object name, a field indicating the second object value corresponding to the second target object name, and a field indicating the first object value represented in a masked form. The structure includes a field indicating the first object value represented in a masked form in consideration of the need to mask the password in the subsequent presentation process to avoid leakage.

[0093] In some possible implementations, the structure can look like this:

[0094]

[0095] In this way, the data related to the first object value are integrated together in the form of a structure, so that the organization of each data is clear and orderly, and the waste of storage resources is reduced, which facilitates data transmission.

[0096] S105: Execute corresponding weak password protection operations according to the identification result.

[0097] After completing the weak password identification, an alarm can be further combined with the identification result so as to deal with the weak password in a timely manner. Specifically, according to the identification result, an alarm message is generated and presented. The alarm message includes information related to the first object value belonging to the weak password.

[0098] That is to say, in the embodiment of the present application, it is possible to determine whether to present an alarm message or discard the alarm message in combination with the weak password hit situation. If the first object value is a weak password, an alarm message is presented to the user to inform the user of the information related to the first object value.

[0099] Information, such as the value of the user name, the value of the password, the type of weak password, etc. If the first object value does not belong to a weak password, for example, it does not belong to a password or it belongs to a password but not a weak password, then there is no need to present an alarm message to the user. In this way, the user will only receive an alarm for hitting a weak password in the network transmission analysis platform, which is convenient for the user to efficiently handle the alarm.

[0100] In this method, complex network transmission information is split into simple and clear object names and object values ​​through object extraction, and then the first target object name representing the password is determined through semantic recognition. In this way, the first object value representing the password value in the network transmission information is accurately extracted, and weak password identification and weak password protection operations are performed on this basis, which effectively improves the accuracy of weak password identification, reduces false alarms, and improves the effect of weak password protection.

[0101] The weak password protection method provided above can be executed by a weak password identification device, and the weak password protection device can be used in a network traffic analysis platform in the form of a module.

[0102] See also Figure 2 The schematic diagram of the architecture of a network traffic analysis platform 22 is shown, in which the traffic probe 21 collects network traffic, extracts initial network transmission information from the application layer, and calls the feature matching engine 211 and the session analysis device 212 for preprocessing. For example, the feature matching engine 211 is called to perform regular expression matching, and the session analysis device 212 is called to determine whether there is response information. From the initial network transmission information, the first network transmission information related to the input password and the transmission password is determined, and reported to the network traffic analysis platform 22.

[0103] Among them, the feature matching engine 211 and the conversation analysis device 212 can be built-in modules of the network traffic analysis platform 22, or can be external modules, and the embodiments of the present application do not limit this.

[0104] Furthermore, after receiving the first network transmission information, the network traffic analysis platform 22 calls the weak password protection device 221, the weak password protection device 221 obtains the first network transmission information, transcodes and decodes the first network transmission information, and extracts at least one object name and at least one object value from the first network transmission information, determines the first target object name according to the semantic information represented by the at least one object name, identifies the first object value corresponding to the first target object name based on the weak password recognition rule, and determines the recognition result.

[0105] Next, the weak password identification device 221 can store the identification result in the form of a structure, and return the identification result stored in the form of a structure to the network traffic analysis platform 22. The network traffic analysis platform 22 determines whether to generate an alarm message based on the identification result and presents the alarm message to the user.

[0106] By providing the weak password identification method in the form of a module, the weak password identification process in the network traffic analysis is decoupled from the other processes. In this way, the weak password identification method provided in the embodiment of the present application can be applicable to different architectures, enrich the usage scenarios, and improve the accuracy and recall rate of the network traffic analysis platform in weak password measurement.

[0107] Combination of the above Figure 1 and Figure 2 The weak password protection method provided in the embodiment of the present application is introduced in detail. The following will introduce the apparatus and device provided in the embodiment of the present application in conjunction with the accompanying drawings.

[0108] See also Figure 3 The schematic diagram of the structure of the weak password protection device shown in FIG. 30 includes:

[0109] The acquisition module 301 is used to acquire first network transmission information;

[0110] An extraction module 302, configured to extract at least one object name and at least one corresponding object value from the first network transmission information;

[0111] A determination module 303, configured to determine a first target object name according to the semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password;

[0112] An identification module 304, configured to identify the first object value corresponding to the first target object name based on a weak password identification rule, and determine an identification result;

[0113] The execution module 305 is used to execute the corresponding weak password protection operation according to the identification result.

[0114] In some possible implementations, the identification module 304 is specifically configured to:

[0115] Determine whether the first object value corresponding to the first target object name is at least one of the following: a password that is a known weak password after decoding, a password that matches the encoded value of a known weak password, a password that exists in a network password library, or a password that meets weak password specifications;

[0116] If so, it is determined that the first object value corresponding to the first target object name is a weak password.

[0117] In some possible implementations, the apparatus 30 further includes a configuration module, wherein the configuration module is configured to:

[0118] Receive configuration operations from users for weak password identification;

[0119] The weak password identification rule is generated according to the identification requirement indicated by the configuration operation.

[0120] In some possible implementations, the extraction module 302 is specifically configured to:

[0121] Determine at least one key-value pair from the first network transmission information according to the set segmentation character and / or segmentation rule; wherein the key in the key-value pair represents the object name, and the value in the key-value pair represents the object value;

[0122] The at least one key-value pair is split to obtain at least one object name and at least one corresponding object value.

[0123] In some possible implementations, the determining module 303 is specifically configured to:

[0124] Inputting the at least one object name into a natural language classification model, and receiving a classification result returned by the natural language classification model, wherein the natural language classification model is used to classify the at least one object name based on semantic information represented by the object name;

[0125] According to the classification result, a first target object name is determined.

[0126] In some possible implementations, the recognition result is stored in the form of a structure, which includes: a field indicating the name of the first target object, a field indicating the first object value, and a field indicating whether the first object value is a weak password.

[0127] In some possible implementations, the determining module 303 is further configured to:

[0128] Determine a second target object name according to the semantic information represented by the at least one object name, wherein the semantic information of the second target object name represents an account name;

[0129] The structure also includes at least one of the following: a field indicating a second target object name, a field indicating a second object value corresponding to the second target object name, and a field indicating that the first object value is represented in a mask form.

[0130] In some possible implementations, the first network transmission information is determined in the following manner:

[0131] Collect network traffic and obtain initial network transmission information;

[0132] From the initial network transmission information, first network transmission information that matches a regular expression and has response information is determined; wherein the regular expression indicates at least one feature related to a weak password.

[0133] In some possible implementations, the first network transmission information is represented in ASCII encoding, and the device 30 further includes a preprocessing module, which is used to:

[0134] The first network transmission information is converted into a UTF-8 encoding format, and / or the URL encoding included in the first network transmission information is decoded.

[0135] In some possible implementations, the execution module 305 is specifically used to:

[0136] Generate warning information according to the identification result; wherein the warning information includes information related to the first object value belonging to the weak password;

[0137] The warning information is presented.

[0138] The weak password protection device 30 according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the weak password protection device 30 are respectively to implement Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0139] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 The function of the weak password protection device 30 in the illustrated embodiment.

[0140] Figure 4 A schematic diagram of the structure of an electronic device 400 is provided. Figure 4 As shown, the electronic device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate with each other via the bus 401.

[0141] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0142] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0143] The communication interface 403 is used for communicating with the outside. For example, the communication interface 403 can be used for communicating with a terminal.

[0144] The memory 404 may include a volatile memory, such as a random access memory (RAM). The memory 404 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0145] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the aforementioned weak password protection method.

[0146] Specifically, in implementing Figure 3 In the case of the embodiment shown, and Figure 3 When each module or unit of the weak password protection device 30 described in the embodiment is implemented by software, the execution Figure 3 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned weak password protection method.

[0147] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the weak password protection method applied to the weak password protection device 30.

[0148] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0149] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0150] When the computer program product is executed by a computer, the computer executes any of the aforementioned weak password protection methods. The computer program product may be a software installation package, and when any of the aforementioned weak password protection methods is needed, the computer program product may be downloaded and executed on a computer.

[0151] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0152] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0153] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0154] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0155] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0156] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0157] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0158] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0159] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A weak password protection method, characterized in that: The method comprises: Acquiring first network transmission information; Extracting at least one object name and at least one corresponding object value from the first network transmission information; Determine a first target object name according to the semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password; Based on the weak password identification rule, identifying the first object value corresponding to the first target object name, and determining an identification result; According to the identification result, a corresponding weak password protection operation is performed.

2. The method according to claim 1, characterized in that The step of identifying the first object value corresponding to the first target object name based on the weak password identification rule and determining the identification result includes: Determine whether the first object value corresponding to the first target object name is at least one of the following: a password that is a known weak password after decoding, a password that matches the encoded value of a known weak password, a password that exists in a network password library, or a password that meets weak password specifications; If so, it is determined that the first object value corresponding to the first target object name is a weak password.

3. The method according to claim 1, characterized in that The method further comprises: Receive configuration operations from users for weak password identification; The weak password identification rule is generated according to the identification requirement indicated by the configuration operation.

4. The method according to claim 1, characterized in that: The extracting at least one object name and at least one corresponding object value from the first network transmission information includes: Determine at least one key-value pair from the first network transmission information according to the set segmentation character and / or segmentation rule; wherein the key in the key-value pair represents the object name, and the value in the key-value pair represents the object value; The at least one key-value pair is split to obtain at least one object name and at least one corresponding object value.

5. The method according to claim 1, characterized in that The determining the first target object name according to the semantic information represented by the at least one object name includes: Inputting the at least one object name into a natural language classification model, and receiving a classification result returned by the natural language classification model, wherein the natural language classification model is used to classify the at least one object name based on semantic information represented by the object name; According to the classification result, a first target object name is determined.

6. The method according to claim 1, characterized in that The recognition result is stored in the form of a structure, which includes: a field indicating the name of the first target object, a field indicating the first object value, and a field indicating whether the first object value belongs to a weak password.

7. The method according to claim 6, characterized in that The method further comprises: Determine a second target object name according to the semantic information represented by the at least one object name, wherein the semantic information of the second target object name represents an account name; The structure also includes at least one of the following: a field indicating a second target object name, a field indicating a second object value corresponding to the second target object name, and a field indicating that the first object value is represented in a mask form.

8. The method according to claim 1, characterized in that The first network transmission information is determined in the following manner: Collect network traffic and obtain initial network transmission information; From the initial network transmission information, first network transmission information that matches a regular expression and has response information is determined; wherein the regular expression indicates at least one feature related to a weak password.

9. The method according to claim 1, characterized in that: The first network transmission information is represented in ASCII encoding form. After obtaining the first network transmission information, the method further includes: The first network transmission information is converted into a UTF-8 encoding format, and / or the URL encoding included in the first network transmission information is decoded.

10. The method according to any one of claims 1 to 9, characterized in that: The performing of corresponding weak password protection operations according to the identification result includes: Generate warning information according to the identification result; wherein the warning information includes information related to the first object value belonging to the weak password; The warning information is presented.

11. A weak password protection device, characterized in that: The device comprises: An acquisition module, used to acquire first network transmission information; An extraction module, used to extract at least one object name and at least one corresponding object value from the first network transmission information; A determination module, configured to determine a first target object name according to semantic information represented by the at least one object name, wherein the semantic information of the first target object name represents a password; an identification module, configured to identify the first object value corresponding to the first target object name based on a weak password identification rule, and determine an identification result; An execution module is used to execute corresponding weak password protection operations according to the identification result.

12. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 10.

Images