Network host weak password identification and enhancement method, device, equipment and medium

Abstract

The invention discloses a network host weak password identification and enhancement method and device, equipment and a medium. The method is characterized by comprising the following steps: determining an abnormal login parameter according to an analysis result of network flow of a network host, and if the abnormal login parameter is greater than a preset login threshold value, obtaining a login password in the abnormal login parameter; acquiring a password identification salt value corresponding to the login password, and performing hash calculation on the login password and the password identification salt value corresponding to the login password to determine a first hash value; performing weak password detection according to the first hash value and the network host, and determining a target weak password; and enhancing the target weak password, and determining a target strong password. According to the method, the weak password is dynamically strengthened and repaired to generate the dynamically changing strong password, so that the password management is performed in a targeted manner, and the management efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network password technology, and in particular to a method, device, equipment and medium for identifying and enhancing weak passwords of network hosts. Background Art

[0002] A weak network password is a password that is easily guessed or cracked when requesting a network host. A weak network password will increase network security risks. With the construction of new power systems, a large number of new energy stations and third-party market players will be connected to the network hosts of new power systems, which will generate a large number of weak passwords, resulting in excessive network risks in new power systems. The network security protection of new power systems is vulnerable to network attacks. Although the new power system can conduct security monitoring of connected new energy stations and third-party market players, the number of network access requests is huge, and security detection is difficult to distinguish between malicious access and normal access. Although existing technologies can detect weak network passwords, it is difficult to manage weak network passwords and reduce the number of weak network passwords. Summary of the invention

[0003] The present invention provides a method, device, equipment and medium for identifying and enhancing weak passwords of network hosts, so as to solve the technical problem that weak passwords of networks cannot be effectively managed in the prior art.

[0004] According to one aspect of the present invention, a method for identifying and enhancing weak passwords of network hosts is provided, comprising:

[0005] Determine the abnormal login parameter according to the analysis result of the network traffic of the network host, and if the abnormal login parameter is greater than a preset login threshold, obtain the login password in the abnormal login parameter;

[0006] Obtaining a password identification salt value corresponding to the login password, performing a hash calculation on the login password and the password identification salt value corresponding to the login password to determine a first hash value;

[0007] Perform weak password detection according to the first hash value and the network host to determine a target weak password;

[0008] The target weak password is enhanced to determine a target strong password.

[0009] According to another aspect of the present invention, a network host weak password identification and enhancement device is provided, comprising:

[0010] A traffic analysis module, used to determine abnormal login parameters according to the analysis results of the network traffic of the network host, and if the abnormal login parameters are greater than a preset login threshold, obtain the login password in the abnormal login parameters;

[0011] A password processing module, configured to obtain a password identification salt value corresponding to the login password, perform a hash calculation on the login password and the password identification salt value corresponding to the login password, and determine a first hash value;

[0012] A password detection module, configured to perform weak password detection according to the first hash value and the network host, and determine a target weak password;

[0013] The password enhancement module is used to enhance the target weak password and determine a target strong password.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network host weak password identification and enhancement method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network host weak password identification and enhancement method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention determines the abnormal login parameter according to the analysis result of the network traffic of the network host. If the abnormal login parameter is greater than the preset login threshold, the login password in the abnormal login parameter is obtained, and the abnormal login parameter can be identified in the network traffic of the requesting network host, and then the network weak password is extracted, which effectively improves the pertinence of the management of the network weak password and improves the efficiency of identification and enhancement; the password identification salt value corresponding to the login password is obtained, and the login password and the password identification salt value corresponding to the login password are hashed to determine the first hash value, and the hash calculation can be used to Improve the randomness of network weak passwords and effectively improve the effects of management and enhancement; perform weak password detection based on the first hash value and the network host to determine the target weak password. Through weak password detection, it is possible to effectively identify network weak passwords that pose security risks, enhance the target weak passwords, determine the target strong passwords, and enhance the network weak passwords that pose risks. The instructions for network weak passwords solve the technical problem that the prior art cannot effectively manage network weak passwords. By dynamically strengthening and repairing weak passwords and generating dynamically changing strong passwords, targeted password management is achieved to improve management efficiency.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a method for identifying and enhancing weak passwords of a network host is provided for an embodiment of the present invention;

[0023] Figure 2 A flowchart of another method for identifying and enhancing weak passwords of network hosts provided by an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of the structure of a network host weak password identification and enhancement device provided by an embodiment of the present invention;

[0025] Figure 4 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1 A flowchart of a method for identifying and enhancing weak passwords of a network host is provided for an embodiment of the present invention. This embodiment is applicable to a situation where a network host in a power system receives too many password requests. The method can be performed by a device for identifying and enhancing weak passwords of a network host. The device can be implemented in the form of hardware and / or software. The device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] S110. Determine abnormal login parameters according to the analysis results of the network traffic of the network host. If the abnormal login parameters are greater than a preset login threshold, obtain the login password in the abnormal login parameters.

[0030] Among them, the network host can be a network component set up in the power system, and the network host can manage the network operation of the power system. In the embodiment of the present invention, the functions of the network host may include information management, network traffic monitoring, security management, etc.

[0031] Among them, network traffic can be the amount of data transmitted on the Internet. It should be noted that network traffic is the total traffic transmitted over the network within a certain period of time. In an embodiment of the present invention, network traffic can be the amount of data corresponding to a login request generated when a login password is used to request access to a network host in a power system.

[0032] The login password may be password information for requesting to log in to a network host; the login password is usually the password information of the login account, which is composed of numbers, letters or special characters, and enables the network host to verify the identity information of the login account. It should be noted that in the login password, password information that is easy to guess or crack is called a network weak password. The network weak password is often composed of simple and common information. If the network weak password of the network host is cracked, it will bring serious threats to the network security of the power system, and it is necessary to identify the network weak password in the login password.

[0033] The parsing result of the network traffic may be the result of analyzing and searching the network traffic. Optionally, in the embodiment of the present invention, the network traffic corresponding to the login service of the network host is obtained, the network traffic is analyzed, and the data packets accessed through the login password request in the login service are searched, and the data packets accessed through the login password request are determined as the parsing result of the network traffic.

[0034] The abnormal login parameter may be abnormal information of failure to log in to a network host through a login password for multiple consecutive times within a certain time range; the abnormal login information includes the login account and login password, as well as the geographical location information, frequency and time interval of the consecutive login failures of the login account at the same IP address. Optionally, after obtaining the parsing result of the network traffic, the data packet of the failed login message in the data packet of the access request is analyzed and searched, and the abnormal login parameter is determined based on the data packet of the failed login message.

[0035] It should be noted that the abnormal login information above includes multiple login accounts and login passwords, as well as the geographical location information, frequency and time interval of the login account's continuous login failures at the same IP address. Since the parsing results of the network traffic record information in the form of a data table, the data information of all requests to log in to the network host is recorded, and each record of the relevant information of the request to log in to the network host is the login account, login password, IP address, timestamp of the request to log in and the result of the request to log in. Then, the abnormal login information obtained based on the parsing results of the network traffic is in the form of the same data table, and each data recorded in the abnormal login information is the login account, login password, IP address, timestamp of the request to log in, failed login message and geographical location information. Among them, the IP (Internet Protocol Address) address is used to identify the unique digital label of the network device, and the geographical location information is the geographical location to which the IP address belongs; the result of the request to log in can be a successful login message and a failed login message; exemplary, the failed login message can be "Failed", "Access Denied", "Authentication failed", etc.; the successful login message can be "Loginsuccessful", "Authentication successful", etc.; the timestamp of the request to log in can be the time information when the network host receives the request to log in.

[0036] The preset login threshold may be a value preset for judging abnormal login passwords. It should be noted that the preset login threshold may be set to the frequency and time interval of multiple failed logins. For example, the preset login threshold may be set to login once every 5 seconds, or 12 failed logins within one minute.

[0037] Specifically, the network traffic of the network host is obtained and analyzed to obtain the analysis results of the network traffic, and the abnormal login parameters are determined based on the analysis results of the network traffic. The abnormal login parameters are numerically compared with the preset login threshold. If there is an abnormal login parameter whose corresponding frequency and time interval of the login password are greater than the preset login threshold, then this login password is obtained.

[0038] Determine the abnormal login parameters based on the analysis results of the network traffic of the network host. If the abnormal login parameters are greater than the preset login threshold, obtain the login password in the abnormal login parameters.

[0039] Optionally, in another optional embodiment of the present invention, determining abnormal login parameters according to the parsing result of the network traffic of the network host includes:

[0040] The network host traffic is captured and parsed according to a preset filter to determine the parsing result of the network traffic; the login failure data is determined by searching for login failure keywords in the parsing result of the network traffic; and the abnormal login parameters are determined according to the network protocol address in the login failure data.

[0041] The preset filter may be a tool pre-set to capture network traffic. For example, the preset filter may be a Wireshark tool.

[0042] Among them, the login failure data may be a login request that fails to log in to the network host through a login password. It should be noted that when requesting to log in to the network platform, login verification is performed through the login account and login password. If the login verification fails, the login service of the network host will return login failure prompt data to the login device. Optionally, in the parsing results of the network traffic, the login failure data includes multiple login accounts and login passwords. By matching the results of the requested login with keywords in turn in the parsing results of the network traffic, the data of the keywords of the failed login are matched to obtain the login failure data. Exemplary keywords of failed login may be "Failed", "Access Denied", "Authentication failed", etc.

[0043] Specifically, the network host traffic is captured through a pre-set preset filter, the obtained network traffic is analyzed, and the analysis results are arranged in the form of a data table in the format corresponding to the login account, login password, IP address, timestamp of the requested login and the result of the requested login, to obtain the analysis results of the network traffic, the analysis results of the network traffic are searched for login failure keywords, and the abnormal login parameters are determined according to the network protocol address in the login failure data.

[0044] Optionally, in another optional embodiment of the present invention, determining the abnormal login parameter according to the network protocol address in the login failure data includes:

[0045] Perform a network protocol address query based on the network protocol address in the login failure data to determine the geographical location information corresponding to the network protocol address; perform an abnormal query on the login failure data based on the geographical location information corresponding to the network protocol address to determine the abnormal login parameters.

[0046] Optionally, the network protocol address is the source IP address of the login request. The geographic location query is performed through the source IP address allocation and registration mechanism, and the geographic location information corresponding to the network protocol address can be queried, and the geographic location information of each source IP address is updated to the login failure data. It should be noted that in the login failure data, since a login account may use other devices to try to log in when logging in, in order to ensure the effectiveness of anomaly detection, anomaly query is selected in the login failure data based on the same geographic location information, and the login failure data of multiple login attempts by a login account with the same geographic location information are used as abnormal login parameters.

[0047] S120: Obtain a password identification salt value corresponding to the login password, perform a hash calculation on the login password and the password identification salt value corresponding to the login password, and determine a first hash value.

[0048] The password identification salt value is a random value used for password identification. It should be noted that the password identification salt value is a set of randomly generated strings. In the embodiment of the present invention, the number of login passwords is at least one, and the number of login passwords corresponding to a login account is also at least one. A password identification salt value is randomly generated for each login password. Exemplarily, the password identification salt value is randomly generated, and the password identification salt value is generated by random uppercase and lowercase letters, numbers, and characters.

[0049] The first hash value is obtained by hashing the login password and the password identification salt value corresponding to the login password, and the first hash value can be used to identify weak passwords for the login password. It should be noted that each login password has a corresponding first hash value.

[0050] Optionally, for a login password, a password identification salt value corresponding to the login password is randomly generated, the password identification salt value and the login password are combined, and the combined password identification salt value and the login password are hashed by a hash function to obtain a first hash value corresponding to the login password. For multiple login passwords corresponding to the login account, the first hash values ​​corresponding to each login password are calculated in sequence. Exemplarily, the hash function may be bcrypt, scrypt, or Argon2, etc.

[0051] Specifically, a password identification salt value corresponding to the login password is obtained, and a hash calculation is performed on the login password and the password identification salt value corresponding to the login password to determine a first hash value corresponding to the login password.

[0052] S130. Perform weak password detection according to the first hash value and the network host to determine a target weak password.

[0053] The target weak password may be a login password that is easily cracked. It should be noted that, in the embodiment of the present invention, the login account is verified according to the first hash value corresponding to the login password associated with the login account, and when the first hash value of a login password is successfully verified, the correct login password corresponding to the login account is determined as the target weak password.

[0054] Specifically, a plurality of first hash values ​​associated with a login account are used in a network host to perform weak password detection based on a login service of the network host to determine a target weak password.

[0055] S140: Enhance the target weak password to determine a target strong password.

[0056] The target strong password can be a strong password obtained by enhancing and updating the target weak password. Optionally, when enhancing the target weak password, the length of the password can be increased based on the target weak password, and some characters in the target weak password can be replaced with characters with the same meaning and more complex to obtain the target strong password. A regular automatic replacement mechanism can also be set for the target strong password to further improve the security of the target strong password.

[0057] Specifically, after detecting and obtaining the target weak password, the target weak password is enhanced in turn to determine the target strong password.

[0058] Optionally, in another optional embodiment of the present invention, the step of enhancing the target weak password to determine the target strong password includes:

[0059] When a target weak password is detected as attempting to log in to the network host, the target weak password is changed to determine the target strong password.

[0060] Specifically, after detecting the target weak password, when detecting the target weak password trying to log in to the network host, the login request generated allows the target weak password to log in to the network host, but the target weak password is changed to determine the target strong password. By changing the target weak password after the target weak password logs in to the network host, the new target strong password can be pushed to the user through the network host without affecting the user's login to the network host.

[0061] The technical solution of the embodiment of the present invention determines the abnormal login parameter according to the analysis result of the network traffic of the network host. If the abnormal login parameter is greater than the preset login threshold, the login password in the abnormal login parameter is obtained, and the abnormal login parameter can be identified in the network traffic of the requesting network host, and then the network weak password is extracted, which effectively improves the pertinence of the management of the network weak password and improves the efficiency of identification and enhancement; the password identification salt value corresponding to the login password is obtained, and the login password and the password identification salt value corresponding to the login password are hashed to determine the first hash value, and the hash calculation can be used to Improve the randomness of network weak passwords and effectively improve the effects of management and enhancement; perform weak password detection based on the first hash value and the network host to determine the target weak password. Through weak password detection, it is possible to effectively identify network weak passwords that pose security risks, enhance the target weak passwords, determine the target strong passwords, and enhance the network weak passwords that pose risks. The instructions for network weak passwords solve the technical problem that the prior art cannot effectively manage network weak passwords. By dynamically strengthening and repairing weak passwords and generating dynamically changing strong passwords, targeted password management is achieved to improve management efficiency.

[0062] Figure 2 This is a flowchart of another method for identifying and enhancing weak passwords of network hosts provided by an embodiment of the present invention. The relationship between this embodiment and the above-mentioned embodiments details the specific methods for detecting and enhancing weak passwords. Figure 2 As shown, the method includes:

[0063] S210. Determine abnormal login parameters according to the analysis results of the network traffic of the network host. If the abnormal login parameters are greater than a preset login threshold, obtain the login password in the abnormal login parameters.

[0064] S220: Obtain a password identification salt value corresponding to the login password, perform a hash calculation on the login password and the password identification salt value corresponding to the login password, and determine a first hash value.

[0065] S230. Construct a hash list corresponding to the first hash value based on the first hash value; perform password detection on the network host according to the hash list to determine the target weak password.

[0066] The hash list may be a data list recording the login account, the login password corresponding to the login account, and the first hash value. It should be noted that the hash list records data in a data list, recording the login account, the login password corresponding to the login account, and the first hash value in each abnormal login parameter.

[0067] Optionally, in an embodiment of the present invention, the login account and the first hash value corresponding to the login account are recorded based on a hash list, and the first hash value corresponding to the login account is used to verify the password of the network host for each login account one by one. If there is a first hash value verification that succeeds, the correct login password of the login account corresponding to the first hash value is determined as the target weak password.

[0068] S240. When a target weak password is detected as attempting to log in to the network host, a password change salt value is obtained, and random characters are cropped on the target weak password according to a preset cropping character length to obtain password cropping characters.

[0069] The password change salt value can be a random value used to enhance the target weak password. It should be noted that each target weak password corresponds to a password change salt value, and the password change salt value is generated based on the salt value time function value. By randomly selecting plaintext A and hashing plaintext A through a hash function, H(A) is obtained, and T is set as the time period, H t (A) is the hash processing of plaintext A by the hash function at time t. The specific calculation formula is as follows:

[0070]

[0071] The preset clipping character length may be a data value pre-set for clipping the target weak password. The preset clipping character length may be set to at least one, and preset clipping character lengths of different sizes may be set for character lengths corresponding to different target weak passwords. Before clipping the target weak password, a preset clipping character length needs to be selected. Furthermore, the standard for selecting the preset clipping character length is that the preset clipping character length is less than the character length of the target weak password.

[0072] Specifically, when a login request of a target weak password to log in to a network host is detected, the password change salt value is first obtained, and a suitable preset cropping character length is selected based on the character length corresponding to the target weak password. Random characters are collected from the target weak password using the preset cropping character length to obtain password cropping characters with a character length equal to the preset cropping character length.

[0073] S250: Change the target weak password according to the password clipping characters to determine a changed password.

[0074] The changed password may be a password obtained by replacing characters based on the target weak password. It should be noted that the changed password is obtained by replacing some characters in the target weak password based on the password clipping characters.

[0075] Specifically, the target weak password is changed according to the password clipping characters to determine the changed password.

[0076] Optionally, in another optional embodiment of the present invention, the step of changing the target weak password according to the password clipping characters to determine the changed password includes:

[0077] Performing hash calculation on the password trimmed characters to determine a second hash value corresponding to the password trimmed characters; performing integer conversion on the third hash value to determine the characters to be replaced and the character length of the characters to be replaced; performing password changes on the target weak password according to the characters to be replaced and the character length of the characters to be replaced to determine the changed password.

[0078] The second hash value may be a hash value obtained by performing a hash calculation based on the password clipping characters. The second hash value may be used to replace characters in the target weak password, thereby enhancing the target weak password. It should be noted that each target weak password has a corresponding second hash value. Optionally, the target clipping characters are hashed using a hash function to obtain a second hash value corresponding to the password clipping characters.

[0079] The preset clipping hash length may be a data value preset for performing hash value clipping.

[0080] Optionally, after obtaining the second hash value, the second hash value is clipped by a preset clipping hash length, and during the clipping process, the character length of the second hash value is randomly selected to be the preset clipping hash length for clipping, thereby obtaining a third hash value. The third hash value is clipped based on the second hash value.

[0081] Optionally, the third hash value is formatted by a hash function, the third hash value is converted into hexadecimal data, the hexadecimal data is converted into decimal, the character to be replaced is obtained, and the character length of the character to be replaced is identified. The character to be replaced can be used to replace characters of the target weak password.

[0082] Optionally, after obtaining the characters to be replaced, the characters to be replaced are used to replace the characters of the corresponding character length in the target weak password, thereby obtaining a changed password. A specific replacement method may be to identify the character length of the target weak password, randomly select characters of the character length of the characters to be replaced in the target weak password as the characters to be replaced, and replace the replaced characters with the characters to be replaced. During the replacement, each character to be replaced is replaced in turn according to the arrangement of the characters to be replaced.

[0083] For example, if the character length of the target weak password is 80 bits, and the character length of the characters to be replaced is 64 bits, then any character in bits 0-15 of the target weak password can be selected as the starting character for replacement, and the starting character and the characters within 63 bits of the starting character can be replaced sequentially, thereby replacing the 64 bits of the characters to be replaced into the target weak password to obtain a changed password.

[0084] S260: Determine the target strong password according to the password change salt and the changed password.

[0085] Specifically, the target change salt value and the change password are randomly combined to obtain the target strong password, wherein the random combination method may be to combine the target change salt value after the change password, or to combine the target change salt value before the change password.

[0086] The technical solution of the embodiment of the present invention determines the abnormal login parameter according to the analysis result of the network traffic of the network host. If the abnormal login parameter is greater than the preset login threshold, the login password in the abnormal login parameter is obtained, and the abnormal login parameter can be identified in the network traffic of the requesting network host, and then the network weak password is extracted, which effectively improves the pertinence of the management of the network weak password and improves the efficiency of identification and enhancement; the password identification salt value corresponding to the login password is obtained, and the login password and the password identification salt value corresponding to the login password are hashed to determine the first hash value, and the hash calculation can be used to Improve the randomness of network weak passwords and effectively improve the effects of management and enhancement; perform weak password detection based on the first hash value and the network host to determine the target weak password. Through weak password detection, it is possible to effectively identify network weak passwords that pose security risks, enhance the target weak passwords, determine the target strong passwords, and enhance the network weak passwords that pose risks. The instructions for network weak passwords solve the technical problem that the prior art cannot effectively manage network weak passwords. By dynamically strengthening and repairing weak passwords and generating dynamically changing strong passwords, targeted password management is achieved to improve management efficiency.

[0087] Figure 3 A schematic diagram of the structure of a network host weak password identification and enhancement device provided by an embodiment of the present invention. Figure 3 As shown, the device includes: a traffic parsing module 310, a password processing module 320, a password detection module 330 and a password enhancement module 340; wherein,

[0088] The traffic analysis module 310 is used to determine the abnormal login parameter according to the analysis result of the network traffic of the network host, and if the abnormal login parameter is greater than a preset login threshold, obtain the login password in the abnormal login parameter;

[0089] The password processing module 320 is used to obtain a password identification salt value corresponding to the login password, perform a hash calculation on the login password and the password identification salt value corresponding to the login password, and determine a first hash value;

[0090] A password detection module 330, configured to perform weak password detection according to the first hash value and the network host to determine a target weak password;

[0091] The password enhancement module 340 is used to enhance the target weak password and determine a target strong password.

[0092] The technical solution of the embodiment of the present invention determines the abnormal login parameter according to the analysis result of the network traffic of the network host. If the abnormal login parameter is greater than the preset login threshold, the login password in the abnormal login parameter is obtained, and the abnormal login parameter can be identified in the network traffic of the requesting network host, and then the network weak password is extracted, which effectively improves the pertinence of the management of the network weak password and improves the efficiency of identification and enhancement; the password identification salt value corresponding to the login password is obtained, and the login password and the password identification salt value corresponding to the login password are hashed to determine the first hash value, and the hash calculation can be used to Improve the randomness of network weak passwords and effectively improve the effects of management and enhancement; perform weak password detection based on the first hash value and the network host to determine the target weak password. Through weak password detection, it is possible to effectively identify network weak passwords that pose security risks, enhance the target weak passwords, determine the target strong passwords, and enhance the network weak passwords that pose risks. The instructions for network weak passwords solve the technical problem that the prior art cannot effectively manage network weak passwords. By dynamically strengthening and repairing weak passwords and generating dynamically changing strong passwords, targeted password management is achieved to improve management efficiency.

[0093] Optionally, the password enhancement module is specifically used to:

[0094] When a target weak password is detected as attempting to log in to the network host, the target weak password is changed to determine the target strong password.

[0095] Optionally, the password enhancement module is further used to:

[0096] Obtain a password change salt value, and perform random character cropping on the target weak password according to a preset cropping character length to obtain password cropping characters;

[0097] Performing a password change on the target weak password according to the password clipping characters to determine a changed password;

[0098] The target strong password is determined according to the password change salt and the changed password.

[0099] Optionally, the password enhancement module is further used to:

[0100] Performing hash calculation on the password-cropped characters to determine a second hash value corresponding to the password-cropped characters;

[0101] Performing random hash value cropping on the second Hash value according to a preset cropped Hash length to obtain a third Hash value;

[0102] Convert the third Hash value into an integer to determine the character to be replaced and the character length of the character to be replaced;

[0103] The target weak password is changed according to the characters to be replaced and the character lengths of the characters to be replaced to determine a changed password.

[0104] Optionally, the password processing module is specifically used for:

[0105] Constructing a hash list corresponding to the first hash value based on the first hash value;

[0106] Password detection is performed on the network host according to the hash list to determine the target weak password.

[0107] Optionally, the traffic analysis module is specifically used for:

[0108] Capturing and parsing traffic of the network host according to a preset filter to determine the parsing result of the network traffic;

[0109] Determine the login failure data by searching for a keyword of login failure in the analysis result of the network traffic;

[0110] The abnormal login parameter is determined according to the network protocol address in the login failure data.

[0111] Optionally, the traffic analysis module is further used to:

[0112] Performing a network protocol address query according to the network protocol address in the login failure data to determine the geographical location information corresponding to the network protocol address;

[0113] An abnormal query is performed on the login failure data according to the geographical location information corresponding to the network protocol address to determine the abnormal login parameters.

[0114] The network host weak password identification and enhancement device provided in the embodiment of the present invention can execute the network host weak password identification and enhancement method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0115] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their modes are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0116] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0117] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer grid such as the Internet and / or various telecommunication grids.

[0118] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the network host weak password identification and enhancement method.

[0119] In some embodiments, the network host weak password identification and enhancement method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network host weak password identification and enhancement method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the network host weak password identification and enhancement method in any other appropriate manner (e.g., by means of firmware).

[0120] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the modes / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0122] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0123] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0124] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a grid browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication grid). Examples of communication grids include: a local area network (LAN), a wide area network (WAN), a blockchain grid, and the Internet.

[0125] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication grid. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0126] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0127] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of the network host weak password identification and enhancement method provided in any embodiment of the present invention are implemented. The method includes:

[0128] Determine the abnormal login parameter according to the analysis result of the network traffic of the network host, and if the abnormal login parameter is greater than a preset login threshold, obtain the login password in the abnormal login parameter;

[0129] Obtaining a password identification salt value corresponding to the login password, performing a hash calculation on the login password and the password identification salt value corresponding to the login password to determine a first hash value;

[0130] Perform weak password detection according to the first hash value and the network host to determine a target weak password;

[0131] The target weak password is enhanced to determine a target strong password.

[0132] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0133] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0134] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0135] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of grid, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0136] It should be understood by those skilled in the art that the above modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a grid composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0137] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0138] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying and enhancing weak passwords of network hosts, characterized in that: include: Determine the abnormal login parameter according to the analysis result of the network traffic of the network host, and if the abnormal login parameter is greater than a preset login threshold, obtain the login password in the abnormal login parameter; Obtaining a password identification salt value corresponding to the login password, performing a hash calculation on the login password and the password identification salt value corresponding to the login password to determine a first hash value; Perform weak password detection according to the first hash value and the network host to determine a target weak password; The target weak password is enhanced to determine a target strong password.

2. The method according to claim 1, characterized in that The step of enhancing the target weak password to determine a target strong password includes: When a target weak password is detected as attempting to log in to the network host, the target weak password is changed to determine the target strong password.

3. The method according to claim 1, characterized in that The step of enhancing the target weak password to determine a target strong password includes: Obtain a password change salt value, and perform random character cropping on the target weak password according to a preset cropping character length to obtain password cropping characters; Performing a password change on the target weak password according to the password clipping characters to determine a changed password; The target strong password is determined according to the password change salt and the changed password.

4. The method according to claim 3, characterized in that The step of changing the target weak password according to the password clipping characters to determine the changed password includes: Performing hash calculation on the password-cropped characters to determine a second hash value corresponding to the password-cropped characters; Performing random hash value cropping on the second Hash value according to a preset cropped Hash length to obtain a third Hash value; Convert the third Hash value into an integer to determine the character to be replaced and the character length of the character to be replaced; The target weak password is changed according to the characters to be replaced and the character lengths of the characters to be replaced to determine a changed password.

5. The method according to claim 1, characterized in that The number of the first hash value is at least one; and the weak password detection is performed according to the first hash value and the network host to determine the target weak password, including: Constructing a hash list corresponding to the first hash value based on the first hash value; Password detection is performed on the network host according to the hash list to determine the target weak password.

6. The method according to claim 1, characterized in that The determining of abnormal login parameters according to the parsing result of the network traffic of the network host includes: Capturing and parsing traffic of the network host according to a preset filter to determine the parsing result of the network traffic; Determine login failure data by searching for login failure keywords in the analysis results of the network traffic; The abnormal login parameter is determined according to the network protocol address in the login failure data.

7. The method according to claim 6, characterized in that The determining the abnormal login parameter according to the network protocol address in the login failure data includes: Performing a network protocol address query according to the network protocol address in the login failure data to determine the geographical location information corresponding to the network protocol address; An abnormal query is performed on the login failure data according to the geographical location information corresponding to the network protocol address to determine the abnormal login parameters.

8. A network host weak password identification and enhancement device, characterized in that: include: A traffic analysis module, used to determine abnormal login parameters according to the analysis results of the network traffic of the network host, and if the abnormal login parameters are greater than a preset login threshold, obtain the login password in the abnormal login parameters; A password processing module, configured to obtain a password identification salt value corresponding to the login password, perform a hash calculation on the login password and the password identification salt value corresponding to the login password, and determine a first hash value; A password detection module, configured to perform weak password detection according to the first hash value and the network host, and determine a target weak password; The password enhancement module is used to enhance the target weak password and determine a target strong password.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network host weak password identification and enhancement method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network host weak password identification and enhancement method described in any one of claims 1-7 when executed.

Images