Method, device and equipment for identifying and enhancing weak password of network host and medium

Abstract

A network host weak password identification and enhancement method, device, equipment and medium are disclosed. Its features include: determining an abnormal login parameter according to the analysis result of the network traffic of the network host, if the abnormal login parameter is greater than a preset login threshold, obtaining the login password in the abnormal login parameter; obtaining the password identification salt value corresponding to the login password, performing hash calculation on the login password and the password identification salt value corresponding to the login password to determine a first hash value; performing weak password detection on the network host according to the first hash value to determine a target weak password; and enhancing the target weak password to determine a target strong password. By dynamically strengthening and repairing the weak password, a dynamically changing strong password is generated, and targeted password management is achieved to improve the management efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network password, and in particular to a network host weak password identification and enhancement method, device, equipment and medium. BACKGROUND

[0002] The network weak password is a password in a network host that is easy to be guessed or cracked. The network weak password increases the network security risk. With the construction of new power systems, a large number of new energy stations and third-party market subjects access the network hosts of the new power systems, which will generate a large number of weak passwords, resulting in excessively high network risk of the new power systems. The network security protection of the new power systems is vulnerable to network attacks. Although the new power systems can perform security monitoring on the accessed new energy stations and third-party market subjects, the number of network access requests is huge, and it is difficult for security detection to distinguish between malicious access and normal access. Although the existing technology can detect network weak passwords, it is difficult to govern network weak passwords and reduce the number of network weak passwords. SUMMARY

[0003] The present application provides a network host weak password identification and enhancement method, device, equipment and medium to solve the technical problem that network weak passwords cannot be effectively governed in the prior art.

[0004] According to an aspect of the present application, a network host weak password identification and enhancement method is provided, comprising:

[0005] determining an abnormal login parameter according to an analysis result of network traffic of a network host, and if the abnormal login parameter is greater than a preset login threshold, obtaining a login password in the abnormal login parameter;

[0006] obtaining a password identification salt value corresponding to the login password, performing hash calculation on the login password and the password identification salt value corresponding to the login password, and determining a first hash value;

[0007] performing weak password detection on the network host according to the first hash value, and determining a target weak password;

[0008] enhancing the target weak password to determine a target strong password.

[0009] According to another aspect of the present application, a network host weak password identification and enhancement device is provided, comprising:

[0010] a traffic analysis module configured to determine an abnormal login parameter according to an analysis result of network traffic of a network host, and if the abnormal login parameter is greater than a preset login threshold, obtain a login password in the abnormal login parameter;

[0011] The password processing module is configured to obtain a password identification salt value corresponding to the login password, perform a hash calculation on the login password and the password identification salt value corresponding to the login password, and determine a first hash value;

[0012] The password detection module is configured to perform weak password detection on the first hash value and the network host, and determine a target weak password.

[0013] The password enhancement module is configured to enhance the target weak password, and determine a target strong password.

[0014] According to another aspect of the present application, an electronic device is provided, which comprises:

[0015] at least one processor; and

[0016] a memory connected to the at least one processor in communication; wherein

[0017] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network host weak password identification and enhancement method according to any one of the embodiments of the present application.

[0018] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to perform the network host weak password identification and enhancement method according to any one of the embodiments of the present application when executed by the processor.

[0019] The technical scheme of the embodiment of the present application determines the abnormal login parameter according to the analysis result of the network traffic of the network host, if the abnormal login parameter is greater than a preset login threshold, the login password in the abnormal login parameter is acquired, the abnormal login parameter can be identified in the network traffic of the network host, and then the network weak password is extracted, the pertinence of the network weak password governance is effectively improved, and the identification and enhancement efficiency is improved; the password identification salt value corresponding to the login password is acquired, the login password and the password identification salt value corresponding to the login password are subjected to hash calculation, a first hash value is determined, the hash calculation can improve the randomness of the network weak password, and the governance and enhancement effect is effectively improved; the target weak password is determined according to the first hash value and the network host for weak password detection, the network weak password with security risks can be effectively identified through the weak password detection, the target weak password is enhanced, the target strong password is determined, the network weak password with risks can be enhanced, the technical problem that the network weak password cannot be effectively governed in the prior art is solved, the network weak password is dynamically strengthened and repaired, the dynamically changed strong password is generated, the password governance with pertinence is achieved, and the governance efficiency is improved.

[0020] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A flowchart of a network host weak password identification and enhancement method is provided for the embodiments of the present application.

[0023] Figure 2 A flowchart of another network host weak password identification and enhancement method is provided for the embodiments of the present application.

[0024] Figure 3 A structural schematic diagram of a network host weak password identification and enhancement device is provided for the embodiments of the present application.

[0025] Figure 4 A structural schematic diagram of an electronic device 10 that can be used to implement the embodiments of the present application is shown. DETAILED DESCRIPTION

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] Figure 1 This invention provides a flowchart of a method for identifying and strengthening weak passwords for network hosts. This embodiment is applicable to situations where a network host in a power system receives too many password requests. The method can be executed by a device for identifying and strengthening weak passwords for network hosts. This device can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] S110. Determine abnormal login parameters based on the network traffic parsing results of the network host. If the abnormal login parameters are greater than the preset login threshold, obtain the login password from the abnormal login parameters.

[0030] In this invention, the network host can be a network component set up in the power system. The network host can manage the network operation of the power system. In this embodiment of the invention, the functions of the network host can include information management, network traffic monitoring, security management, etc.

[0031] Network traffic can be the amount of data transmitted over the Internet. It should be noted that network traffic is the total amount of data transmitted over the network within a certain period of time. In this embodiment of the invention, network traffic can be the amount of data generated when a login request is made in the power system to access a network host through a login password.

[0032] The login password can be the password information used to request login to a network host. The login password is usually the password information for the login account, consisting of numbers, letters, or special characters, enabling the network host to verify the identity information of the login account. It should be noted that passwords that are easily guessed or cracked are called weak passwords. Weak passwords often consist of simple and common information. Cracking a weak password on a network host can pose a serious threat to the network security of the power system, thus necessitating the identification of weak passwords in login passwords.

[0033] The network traffic parsing result can be the result of analyzing and searching the network traffic. Optionally, in this embodiment of the invention, the network traffic corresponding to the login service of the network host is obtained, the network traffic is analyzed, and data packets that request access through the login password in the login service are searched. The data packets that request access through the login password are determined as the network traffic parsing result.

[0034] The abnormal login parameters can be exception information indicating multiple consecutive failed login attempts to access a network host within a certain time range using a login password. This abnormal login information includes the login account and password, as well as the geographical location, frequency, and time interval of consecutive failed login attempts for that account at the same IP address. Optionally, after obtaining the network traffic parsing results, the data packets containing failed login messages in the requested access packets are analyzed and searched for, and the abnormal login parameters are determined based on these failed login message data packets.

[0035] Regarding the aforementioned abnormal login information, it should be noted that the abnormal login parameters include multiple login accounts and passwords, as well as the geographical location information, frequency, and time interval of consecutive failed login attempts for the same account from the same IP address. Since the network traffic parsing results record information in the form of a data table, recording data information for all network hosts requesting login, each record includes the login account, login password, IP address, timestamp of the login request, and login result. Therefore, the abnormal login information obtained based on the network traffic parsing results is also in the same data table format. Each piece of data recorded in the abnormal login information includes the login account, login password, IP address, timestamp of the login request, failed login message, and geographical location information. The IP address (Internet Protocol Address) is used to uniquely identify network devices, and the geographical location information is the geographical location to which the IP address belongs. The login result can be a successful login message or a failed login message; for example, a failed login message can be "Failed," "Access Denied," or "Authentication failed," while a successful login message can be "Logins successful" or "Authentication successful." The timestamp of the login request can be the time information when the network host receives the login request.

[0036] The preset login threshold can be a pre-set value used to identify abnormal login passwords. It should be noted that the preset login threshold can be set as the frequency and time interval between multiple failed login attempts. For example, the preset login threshold can be set to attempt login once every 5 seconds, resulting in 12 failed login attempts within one minute.

[0037] Specifically, the network traffic of the network host is acquired and parsed to obtain the parsing results. Based on the parsing results, abnormal login parameters are determined. The abnormal login parameters are compared with the preset login threshold. If the frequency and time interval of the login password in an abnormal login parameter are greater than the preset login threshold, the login password is obtained.

[0038] Based on the network traffic analysis results of the network host, abnormal login parameters are determined. If the abnormal login parameters are greater than a preset login threshold, the login password from the abnormal login parameters is retrieved.

[0039] Optionally, in another optional embodiment of the present invention, determining the abnormal login parameters based on the network traffic parsing results of the network host includes:

[0040] The network host traffic is captured and parsed according to a preset filter to determine the parsing result of the network traffic; login failure data is determined by searching for login failure keywords in the parsing result of the network traffic; and the abnormal login parameters are determined according to the network protocol address in the login failure data.

[0041] The preset filter can be a tool that is pre-configured for capturing network traffic. For example, the preset filter can be the Wireshark tool.

[0042] The login failure data can be login requests that failed to log in to the network host using a login password. It should be noted that when requesting to log in to the network platform, login verification is performed using a login account and login password. If login verification fails, the network host's login service will return login failure message data to the login device. Optionally, the login failure data in the network traffic parsing results may include multiple login accounts and login passwords. This is achieved by sequentially performing keyword matching on the login request results in the network traffic parsing results, and matching data containing keywords indicating login failure. For example, login failure keywords could be "Failed," "Access Denied," or "Authentication failed."

[0043] Specifically, network host traffic is captured through a pre-set filter, the obtained network traffic is parsed, and the parsing results are arranged in the form of a data table according to the format of login account, login password, IP address, timestamp of login request, and the corresponding login result. The parsing results of the network traffic are then used to search for login failure keywords, and the abnormal login parameters are determined based on the network protocol address in the login failure data.

[0044] Optionally, in another optional embodiment of the present invention, determining the abnormal login parameters based on the network protocol address in the login failure data includes:

[0045] Based on the network protocol address in the login failure data, perform a network protocol address query to determine the geographical location information corresponding to the network protocol address; based on the geographical location information corresponding to the network protocol address, perform an anomaly query on the login failure data to determine the abnormal login parameters.

[0046] Optionally, the network protocol address is the source IP address of the login request. A geolocation query is performed using the source IP address allocation and registration mechanism to retrieve the geolocation information corresponding to the network protocol address, and this geolocation information for each source IP address is updated in the login failure data. It should be noted that, in the login failure data, since a login account may attempt to log in using other devices, to ensure the effectiveness of anomaly detection, anomaly queries are performed based on the same geolocation information. Login failure data showing multiple login attempts by the same account at the same geolocation information are then used as abnormal login parameters.

[0047] S120. Obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value.

[0048] The password recognition salt is a random value used for password recognition. It should be noted that the password recognition salt is a randomly generated set of strings. In this embodiment of the invention, there is at least one login password, and at least one login password corresponds to one login account. A password recognition salt is randomly generated for each login password. For example, the password recognition salt is randomly generated using random uppercase and lowercase letters, numbers, and characters.

[0049] The first hash value is calculated based on the login password and its corresponding password identification salt value. This first hash value can be used to identify weak login passwords. It should be noted that each login password has a corresponding first hash value.

[0050] Optionally, for a login password, a password recognition salt value is randomly generated. This password recognition salt value and the login password are combined, and a hash function is used to calculate a first hash value corresponding to the login password. For multiple login passwords corresponding to a login account, the first hash value corresponding to each login password is calculated sequentially. For example, the hash function can be bcrypt, scrypt, or Argon2, etc.

[0051] Specifically, obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value corresponding to the login password.

[0052] S130. Based on the first hash value and the network host, perform weak password detection to determine the target weak password.

[0053] The target weak password can be a login password that is easily cracked. It should be noted that, in this embodiment of the invention, the login account is verified based on the first hash value corresponding to the login password associated with the login account. When the verification is successful using the first hash value of a login password, the correct login password corresponding to this login account is determined as the target weak password.

[0054] Specifically, by using multiple first hash values ​​associated with the login account in the network host, weak password detection is performed based on the login service of the network host to determine the target weak password.

[0055] S140. Strengthen the target weak password to determine the target strong password.

[0056] The target strong password can be obtained by enhancing and updating a target weak password. Optionally, when enhancing a target weak password, the password length can be increased, and some characters in the target weak password can be replaced with characters of the same meaning but more complex, to obtain the target strong password. A mechanism for periodically and automatically changing the target strong password can also be set to further improve its security.

[0057] Specifically, after detecting a weak password, the weak password is strengthened sequentially to determine a strong password.

[0058] Optionally, in another optional embodiment of the present invention, the step of strengthening the target weak password and determining the target strong password includes:

[0059] If a login request is detected attempting to log in to the network host using a weak password, the weak password is changed to determine the strong password.

[0060] Specifically, upon detecting a weak password, when an attempt is made to log in to the network host using that weak password, the resulting login request allows the user to log in using the weak password, but the weak password is changed to establish a strong password. By changing the weak password after the user logs in using it, the network host can push a new strong password to the user without affecting their ability to log in.

[0061] The technical solution of this invention determines abnormal login parameters based on the parsing results of network traffic of a network host. If the abnormal login parameters are greater than a preset login threshold, the login password in the abnormal login parameters is obtained. Abnormal login parameters can be identified in the network traffic requesting the network host, thereby extracting weak network passwords, effectively improving the targeting of weak network password management and increasing the efficiency of identification and enhancement. The solution also obtains the password recognition salt value corresponding to the login password, performs hash calculation on the login password and the corresponding password recognition salt value, determines a first hash value, and through hash calculation... Improving the randomness of weak network passwords effectively enhances governance and reinforcement. Weak password detection is performed based on the first hash value and the network host to determine target weak passwords. This detection effectively identifies network weak passwords with security risks and strengthens them to determine target strong passwords. This strengthens risky network weak passwords and solves the technical problem of ineffective governance of weak network passwords in existing technologies. By dynamically strengthening and repairing weak passwords, dynamically changing strong passwords are generated, achieving targeted password governance and improving governance efficiency.

[0062] Figure 2 This is a flowchart illustrating another method for identifying and strengthening weak passwords on a network host, provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiments is detailed in explaining the specific methods for weak password detection and strengthening. Figure 2 As shown, the method includes:

[0063] S210. Determine abnormal login parameters based on the network traffic parsing results of the network host. If the abnormal login parameters are greater than a preset login threshold, obtain the login password from the abnormal login parameters.

[0064] S220. Obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value.

[0065] S230. Construct a hash list corresponding to the first hash value based on the first hash value; perform password detection on the network host according to the hash list to determine the target weak password.

[0066] The hash list can be a data list that records the login account, the corresponding login password, and the first hash value. It should be noted that the hash list records data as a list, recording the login account, the corresponding login password, and the first hash value for each abnormal login parameter.

[0067] Optionally, in this embodiment of the invention, based on the hash list recording login accounts and the first hash value corresponding to the login accounts, the network host is verified for password correctness by using the first hash value corresponding to each login account in turn. If a first hash value is successfully verified, the correct login password of the login account corresponding to the first hash value is determined as the target weak password.

[0068] S240. Upon detecting a login request from a target weak password attempting to log in to the network host, obtain the password change salt value, and randomly trim the target weak password according to a preset trimmed character length to obtain the trimmed password characters.

[0069] The password change salt value can be a random value used to enhance a target weak password. It should be noted that each target weak password corresponds to a unique password change salt value, which is generated based on a salt time function. This salt value is obtained by randomly selecting plaintext A, hashing it using a hash function, and setting T as the time period. t (A) represents the hashing of plaintext A using a hash function at time t. The specific calculation formula is shown below:

[0070]

[0071] The preset trimmed character length can be a pre-set data value used to trim target weak passwords. At least one preset trimmed character length can be set, with different preset trimmed character lengths set for different target weak passwords. Before trimming the target weak password, a preset trimmed character length needs to be selected. Furthermore, the criterion for selecting the preset trimmed character length is: the preset trimmed character length is less than the character length of the target weak password.

[0072] Specifically, when a login request attempting to log in to a network host with a weak password is detected, the password change salt value is first obtained, and an appropriate preset trimmed character length is selected based on the character length corresponding to the weak password. Random characters are collected from the weak password using the preset trimmed character length to obtain a password trimmed character with a character length equal to the preset trimmed character length.

[0073] S250. Change the target weak password according to the password trimming characters and determine the changed password.

[0074] The changed password can be obtained by replacing characters in the target weak password. It should be noted that the changed password is obtained by replacing some characters in the target weak password by trimming the password.

[0075] Specifically, based on the password trimming characters, the target weak password is changed to determine the changed password.

[0076] Optionally, in another optional embodiment of the present invention, the step of changing the target weak password based on the password trimming characters and determining the changed password includes:

[0077] The password trimming characters are hashed to determine the second hash value corresponding to the password trimming characters; the third hash value is converted to an integer to determine the character to be replaced and the character length of the character to be replaced; the target weak password is changed according to the character to be replaced and the character length of the character to be replaced to determine the changed password.

[0078] The second hash value can be obtained by hashing the password trimmed characters. This second hash value can be used to replace characters in the target weak password, thereby strengthening the weak password. It should be noted that each target weak password has a corresponding second hash value. Optionally, the target trimmed characters can be hashed using a hash function to obtain the second hash value corresponding to the password trimmed characters.

[0079] The preset trimmed hash length can be a pre-set data value used for hash value trimming.

[0080] Optionally, after obtaining the second hash value, the characters in the second hash value are truncated using a preset truncated hash length. During the truncating process, a character length of the preset truncated hash length is randomly selected from the second hash value for truncating, thereby obtaining the third hash value. The third hash value is obtained by truncating the second hash value.

[0081] Optionally, the third hash value is formatted using a hash function, converted into hexadecimal data, and then converted to decimal to obtain the character to be replaced. The length of the character to be replaced is also identified. This character to be replaced can be used to replace characters in a target weak password.

[0082] Optionally, after obtaining the character to be replaced, the character to be replaced is used to replace a character of the corresponding length in the target weak password, thereby obtaining the changed password. Specifically, the replacement method can be to identify the character length of the target weak password, randomly select a character of the same length as the character to be replaced from the target weak password, and then replace the character to be replaced using the character to be replaced. During replacement, each character to be replaced is replaced sequentially according to the arrangement of the characters to be replaced.

[0083] For example, if the target weak password has a character length of 80 characters and the character to be replaced has a character length of 64 characters, then any character from the 0th to 15th position of the target weak password can be selected as the starting character for replacement. The starting character and the characters 63 characters after the starting character are replaced sequentially, thereby replacing the 64 characters of the character to be replaced into the target weak password and obtaining the changed password.

[0084] S260. Determine the target strong password based on the password change salt value and the changed password.

[0085] Specifically, the target change salt value and the change password are randomly combined to obtain the target strong password. The random combination method can be to combine the target change salt value after the change password or combine the target change salt value before the change password.

[0086] The technical solution of this invention determines abnormal login parameters based on the parsing results of network traffic of a network host. If the abnormal login parameters are greater than a preset login threshold, the login password in the abnormal login parameters is obtained. Abnormal login parameters can be identified in the network traffic requesting the network host, thereby extracting weak network passwords, effectively improving the targeting of weak network password management and increasing the efficiency of identification and enhancement. The solution also obtains the password recognition salt value corresponding to the login password, performs hash calculation on the login password and the corresponding password recognition salt value, determines a first hash value, and through hash calculation... Improving the randomness of weak network passwords effectively enhances governance and reinforcement. Weak password detection is performed based on the first hash value and the network host to determine target weak passwords. This detection effectively identifies network weak passwords with security risks and strengthens them to determine target strong passwords. This strengthens risky network weak passwords and solves the technical problem of ineffective governance of weak network passwords in existing technologies. By dynamically strengthening and repairing weak passwords, dynamically changing strong passwords are generated, achieving targeted password governance and improving governance efficiency.

[0087] Figure 3 This is a schematic diagram of a network host weak password identification and enhancement device provided in an embodiment of the present invention. Figure 3 As shown, the device includes: a traffic parsing module 310, a password processing module 320, a password detection module 330, and a password enhancement module 340; wherein,

[0088] The traffic parsing module 310 is used to determine abnormal login parameters based on the parsing results of the network traffic of the network host. If the abnormal login parameters are greater than a preset login threshold, the login password in the abnormal login parameters is obtained.

[0089] Password processing module 320 is used to obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value;

[0090] Password detection module 330 is used to perform weak password detection based on the first hash value and the network host to determine the target weak password;

[0091] The password enhancement module 340 is used to enhance the target weak password and determine the target strong password.

[0092] The technical solution of this invention determines abnormal login parameters based on the parsing results of network traffic of a network host. If the abnormal login parameters are greater than a preset login threshold, the login password in the abnormal login parameters is obtained. Abnormal login parameters can be identified in the network traffic requesting the network host, thereby extracting weak network passwords, effectively improving the targeting of weak network password management and increasing the efficiency of identification and enhancement. The solution also obtains the password recognition salt value corresponding to the login password, performs hash calculation on the login password and the corresponding password recognition salt value, determines a first hash value, and through hash calculation... Improving the randomness of weak network passwords effectively enhances governance and reinforcement. Weak password detection is performed based on the first hash value and the network host to determine target weak passwords. This detection effectively identifies network weak passwords with security risks and strengthens them to determine target strong passwords. This strengthens risky network weak passwords and solves the technical problem of ineffective governance of weak network passwords in existing technologies. By dynamically strengthening and repairing weak passwords, dynamically changing strong passwords are generated, achieving targeted password governance and improving governance efficiency.

[0093] Optionally, the password enhancement module is specifically used for:

[0094] If a login request is detected attempting to log in to the network host using a weak password, the weak password is changed to determine the strong password.

[0095] Optionally, the password enhancement module is further used for:

[0096] Obtain the password change salt value, and perform random character trimming on the target weak password according to the preset trimmed character length to obtain the password trimmed characters;

[0097] Based on the password trimming characters, the target weak password is changed to determine the changed password;

[0098] The target strong password is determined based on the password change salt value and the changed password.

[0099] Optionally, the password enhancement module is further used for:

[0100] Perform a hash calculation on the password trimmed characters to determine the second hash value corresponding to the password trimmed characters;

[0101] The second hash value is randomly truncated according to the preset truncated hash length to obtain the third hash value;

[0102] The third hash value is converted to an integer to determine the character to be replaced and its length.

[0103] The target weak password is changed based on the character to be replaced and the length of the character to be replaced, and the changed password is determined.

[0104] Optionally, the password processing module is specifically used for:

[0105] Construct a hash list corresponding to the first hash value based on the first hash value;

[0106] The network host is subjected to password detection based on the hash list to determine the target weak password.

[0107] Optionally, the traffic parsing module is specifically used for:

[0108] The network host traffic is captured and parsed according to a preset filter to determine the parsing result of the network traffic;

[0109] By searching for keywords indicating login failures in the parsing results of the network traffic, login failure data can be identified.

[0110] The abnormal login parameters are determined based on the network protocol address in the login failure data.

[0111] Optionally, the traffic parsing module is further used for:

[0112] Based on the network protocol address in the login failure data, perform a network protocol address query to determine the geographical location information corresponding to the network protocol address;

[0113] Based on the geographical location information corresponding to the network protocol address, perform anomaly query on the login failure data to determine the abnormal login parameters.

[0114] The network host weak password identification and enhancement device provided in the embodiments of the present invention can execute the network host weak password identification and enhancement method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0115] Figure 4A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their patterns are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0116] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0117] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of monitors, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer grids such as the Internet and / or various telecommunications grids.

[0118] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as network host weak password identification and enhancement methods.

[0119] In some embodiments, the network host weak password identification and enhancement method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network host weak password identification and enhancement method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network host weak password identification and enhancement method by any other suitable means (e.g., by means of firmware).

[0120] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the patterns / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0122] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0124] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or grid browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication grid). Examples of communication grids include local area networks (LANs), wide area networks (WANs), blockchain grids, and the Internet.

[0125] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact through a communication mesh. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0126] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0127] This embodiment provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program implements the steps of the network host weak password identification and enhancement method provided in any embodiment of the present invention. The method includes:

[0128] The abnormal login parameters are determined based on the network traffic parsing results of the network host. If the abnormal login parameters are greater than the preset login threshold, the login password in the abnormal login parameters is obtained.

[0129] Obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value;

[0130] Weak password detection is performed based on the first hash value and the network host to determine the target weak password;

[0131] Strengthen the target weak password to determine the target strong password.

[0132] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0133] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0134] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0135] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of mesh, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0136] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a grid of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0137] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0138] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for identifying and strengthening weak passwords on network hosts, characterized in that, include: The abnormal login parameters are determined based on the network traffic parsing results of the network host. If the abnormal login parameters are greater than the preset login threshold, the login password in the abnormal login parameters is obtained. Obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value; Weak password detection is performed based on the first hash value and the network host to determine the target weak password; Strengthen the target weak password to determine the target strong password; The step of strengthening the target weak password and determining the target strong password includes: Obtain the password change salt value, and perform random character trimming on the target weak password according to the preset trimmed character length to obtain the password trimmed characters; Based on the password trimming characters, the target weak password is changed to determine the changed password; The target strong password is determined based on the password change salt value and the changed password; The step of changing the target weak password based on the password trimming characters and determining the changed password includes: Perform a hash calculation on the password trimmed characters to determine the second hash value corresponding to the password trimmed characters; The second hash value is randomly truncated according to the preset truncated hash length to obtain the third hash value; The third hash value is converted to an integer to determine the character to be replaced and its length. The target weak password is changed based on the character to be replaced and the length of the character to be replaced, and the changed password is determined.

2. The method according to claim 1, characterized in that, The step of strengthening the target weak password and determining the target strong password includes: If a login request is detected attempting to log in to the network host using a weak password, the weak password is changed to determine the strong password.

3. The method according to claim 1, characterized in that, The number of the first hash values ​​is at least one; the step of performing weak password detection based on the first hash values ​​and the network host to determine the target weak password includes: Construct a hash list corresponding to the first hash value based on the first hash value; The network host is subjected to password detection based on the hash list to determine the target weak password.

4. The method according to claim 1, characterized in that, The step of determining abnormal login parameters based on the network traffic parsing results of network hosts includes: The network host traffic is captured and parsed according to a preset filter to determine the parsing result of the network traffic; By searching for keywords indicating login failures in the parsing results of the network traffic, login failure data can be identified. The abnormal login parameters are determined based on the network protocol address in the login failure data.

5. The method according to claim 4, characterized in that, Determining the abnormal login parameters based on the network protocol address in the login failure data includes: Based on the network protocol address in the login failure data, perform a network protocol address query to determine the geographical location information corresponding to the network protocol address; Based on the geographical location information corresponding to the network protocol address, perform anomaly query on the login failure data to determine the abnormal login parameters.

6. A device for identifying and strengthening weak passwords on network hosts, characterized in that, include: The traffic parsing module is used to determine abnormal login parameters based on the parsing results of the network traffic of the network host. If the abnormal login parameters are greater than a preset login threshold, the login password in the abnormal login parameters is obtained. The password processing module is used to obtain the password recognition salt value corresponding to the login password, perform hash calculation on the login password and the password recognition salt value corresponding to the login password, and determine the first hash value; The password detection module is used to perform weak password detection based on the first hash value and the network host to determine the target weak password; The password enhancement module is used to enhance the target weak password and determine the target strong password; The password enhancement module is also specifically used for: Obtain the password change salt value, and perform random character trimming on the target weak password according to the preset trimmed character length to obtain the password trimmed characters; Based on the password trimming characters, the target weak password is changed to determine the changed password; The target strong password is determined based on the password change salt value and the changed password; The password enhancement module is also specifically used for: Perform a hash calculation on the password trimmed characters to determine the second hash value corresponding to the password trimmed characters; The second hash value is randomly truncated according to the preset truncated hash length to obtain the third hash value; The third hash value is converted to an integer to determine the character to be replaced and its length. The target weak password is changed based on the character to be replaced and the length of the character to be replaced, and the changed password is determined.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network host weak password identification and enhancement method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network host weak password identification and enhancement method according to any one of claims 1-5.

Images