Method for identifying weak password in network traffic based on extended security rule engine

Abstract

The invention relates to the field of network communication, in particular to a method for identifying weak passwords in network traffic based on an extended security rule engine. Along with the rapid development of the Internet technology, the network traffic is sharply increased, and the security problem of sensitive information such as user passwords is increasingly prominent. Although a traditional security rule engine, such as Suricata, has strong rule matching and intrusion detection capabilities, the original security rule engine does not directly support a weak password identification function. In view of the problems, the invention provides the method for identifying the weak password in the network traffic based on the extended security rule engine, and aims to realize efficient and accurate identification and real-time alarm of the weak password in various protocol traffic by defining a new rule keyword, integrating a weak password check module and optimizing processing logic. In a rule system of Suricata, a specific rule keyword (such as wekpass) is newly added and used for identifying a rule needing weak password check, and the keyword supports flexible configuration so as to adapt to the characteristics of different protocols.

Description

Technical Field

[0001] The present invention relates to the field of network communication, and in particular to a method for identifying weak passwords in network traffic based on an extended security rule engine. Background Art

[0002] With the rapid development of Internet technology, network traffic has increased dramatically, and the security of sensitive information such as user passwords has become increasingly prominent. As the first line of defense to protect personal privacy, corporate data and even national security, the strength of passwords is directly related to the stability of the entire network security system. However, due to factors such as poor user password setting habits and weak security awareness, weak passwords are prevalent and have become an important entry point for hacker attacks.

[0003] Although the network security devices on the market are excellent in defending against network attacks, they have obvious shortcomings in identifying weak passwords in network traffic. Traditional security rule engines, such as Suricata, have powerful rule matching and intrusion detection capabilities, but they do not directly support weak password identification. In addition, with the diversification of network protocols, the demand for weak password identification has expanded to multiple protocols such as HTTP, SMTP, and FTP, making it difficult for existing security solutions to meet the comprehensive and efficient weak password detection needs.

[0004] In view of the above problems, the present invention proposes a method for identifying weak passwords in network traffic based on an extended security rule engine, aiming to achieve efficient and accurate identification and real-time alarm of weak passwords in various protocol traffic by defining new rule keywords, integrating weak password checking modules and optimizing processing logic. Summary of the invention

[0005] The purpose of the present invention is to provide a method for identifying weak passwords in network traffic based on an extended security rule engine. The method can support multiple network protocols and achieve effective identification and warning of weak passwords. The method specifically includes the following steps: (1) Capture network traffic packets from the network interface; (2) According to the protocol type in the data packet, call the corresponding protocol parser to parse the data packet and extract the application layer data; (3) Match the extracted application layer data with the Suricata rule file that introduces the new rule keyword weak_password, find the rules containing the weak_password keyword, and determine which rules are triggered; (4) For the triggered rule, extract the password field from the application layer data according to the field extraction expression defined therein; (5) Weak passwords are identified in the extracted password fields. When a weak password is identified, an alarm message is generated according to the configuration of the security rule engine.

[0006] Furthermore, it is characterized in that the rule keyword weak_password immediately follows the protocol specification and field extraction expression.

[0007] Furthermore, it is characterized in that the Suricata rule introducing the new rule keyword weak_password must follow the following format: A rule must start with a directive that Suricata supports; The protocol and traffic direction must be clearly specified in the rules; The rule contains content matching and weak_password keywords for extracting password fields; The weak_password keyword should be followed by one or more variables that specify the password fields to extract.

[0008] Furthermore, it is characterized in that the security rule engine can parse the weak_password keyword when loading the rule file and perform the following processing: (1) Perform syntax check on the content in the rule file to ensure the correctness of the rules; (2) Optimize logic based on rules, remove duplicate rules and adjust priorities; (3) Generate a field extraction mapping for each rule to facilitate fast matching in the traffic processing stage.

[0009] Furthermore, it is characterized in that the implementation method of the field extraction includes two modes: regular expression matching and direct reference to protocol specific fields, wherein regular expressions are applicable to non-standard format data, and protocol field references are applicable to known data structures.

[0010] Furthermore, it is characterized in that the weak password checking module verifies and scores the strength of the extracted password fields by integrating a password strength assessment algorithm or based on an external leaked password database.

[0011] Further, it is characterized in that before the password strength assessment, the weak password checking module pre-processes the extracted password fields to ensure the accuracy of the detection.

[0012] Furthermore, it is characterized in that when a weak password is detected, the generated warning information is recorded in JSON format, including the following key information: The unique identifier of the triggering rule; Detected weak password content; Protocol type, source IP address, and destination IP address; The timestamp when the detection event occurred. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a system framework diagram of the method of the present invention based on extending the security rule engine to identify weak passwords in network traffic.

[0014] Figure 2 It is a rule parsing flow chart of the method of the present invention based on extending the security rule engine to identify weak passwords in network traffic.

[0015] Figure 3 It is a flow chart of the method for processing network traffic based on extending the security rule engine to identify weak passwords in network traffic.

[0016] Figure 4 The present invention is a weak password checking flow chart of a method for identifying weak passwords in network traffic based on an extended security rule engine. DETAILED DESCRIPTION

[0017] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0018] 1. Define new rule keywords In the Suricata rule system, a specific rule keyword (such as weak_password) is added to identify the rules that need to perform weak password checks. This keyword supports flexible configuration to adapt to the characteristics of different protocols. The details are as follows: 1. Keyword definition and usage Introducing a new rule keyword weak_password to explicitly identify rule items that need to be checked for weak passwords in Suricata's rule files.

[0019] The weak_password keyword should be placed at the appropriate position in the rule, usually immediately after the protocol specification and field extraction expression. For example, for the HTTP protocol, the rule looks like: alert http $EXTERNAL_NET any ->$HOME_NET any (msg:"HTTP Weak PasswordDetected"; flow:to_server,established; content:"password="; http_uri; pcre:" / password=[^&]+ / P"; weak_password:$1; sid:1234567; rev:1;). Among them, weak_password:$1 means that the first capture group (that is, the password field) matched by the regular expression is passed to the weak password check module.

[0020] The weak_password keyword is usually followed by one or more variables that specify password fields to be extracted from network traffic. These fields can be captured via regular expressions or direct references to specific protocol fields.

[0021] 2. Rule Grammar In order to ensure consistency and readability with Suricata rules, this invention defines a strict rule syntax, requiring that rules containing the weak_password keyword must follow the following format: A rule must start with one of the directives supported by Suricata, such as alert or drop.

[0022] The protocol (such as http, smtp, ftp, telnet, etc.) and traffic direction (such as $EXTERNAL_NET any -> $HOME_NET any) must be clearly specified in the rule.

[0023] The rule should contain content matching (such as content, pcre, etc.) and the weak_password keyword to extract the password field.

[0024] The weak_password keyword should be followed by one or more variables that specify the password fields to extract.

[0025] 3. Add rules Users need to edit Suricata's configuration file (such as suricata.yaml) and rule file (such as *.rules) and add the rule containing the weak_password keyword to the rule set.

[0026] Suricata loads and parses these rule files on startup, identifying and preparing to execute rules containing the weak_password keyword.

[0027] Extending rules engine processing Modify the source code of the security rule engine and add parsing and processing logic for the weak_password keyword. When the rule engine matches a rule containing this keyword, the weak password check process is automatically started. The rule engine extracts the password field from the network traffic according to the protocol and field extraction method specified in the rule. The extraction method may be different for different protocols, but they are all passed to the weak password check module through a unified interface. The details are as follows: Rule parsing Rule reading: The system first reads the rule file containing the weak_password keyword and loads it into memory for subsequent processing.

[0028] Syntax check: Perform strict syntax check on the loaded rules to ensure that each rule complies with the predefined syntax specifications, including protocol type, traffic direction, content matching expression, and correct use of the weak_password keyword.

[0029] Field mapping: parses the field extraction expressions in the rules (such as regular expressions, protocol field references, etc.) and maps them to the actual data structure so that the password field can be accurately extracted during the traffic processing stage.

[0030] Rule optimization: De-duplicate, prioritize, and possibly merge the parsed rules to improve the efficiency and accuracy of subsequent processing.

[0031] Traffic processing Traffic Capture: Capture network traffic packets from a network interface.

[0032] Protocol parsing: According to the protocol type in the data packet (such as HTTP, SMTP, etc.), call the corresponding protocol parser to parse the data packet and extract the application layer data.

[0033] Rule matching: Match the extracted application layer data with the loaded and optimized rules, find the rules containing the weak_password keyword, and determine which rules are triggered.

[0034] Field extraction: For triggered rules, the password field is extracted from the application layer data according to the field extraction expression defined in the rule.

[0035] Integrated weak password check module Develop or select an existing weak password checking library (such as zxcvbn, Have I Been Pwned, etc.) and integrate it into Suricata to implement strength assessment of the extracted password fields. Specifically: Password preprocessing: Perform necessary preprocessing on the extracted password fields, such as removing spaces and converting to a unified format, to ensure the accuracy of password assessment.

[0036] Password strength assessment: Input the preprocessed password into the weak password check module and use the integrated algorithm to identify weak passwords.

[0037] Evaluation result determination: Determine whether the password is a weak password based on the evaluation result.

[0038] Alerting and logging When the weak password check module identifies a weak password, an alarm is generated based on the configuration of the security rule engine. The alarm includes key information such as the specific content of the weak password, the location where it appears (protocol, IP address, etc.), and timestamp. The alarm is reported in JSON format, and the identification results are recorded for subsequent analysis and auditing.

[0039] In addition, the expanded security rule engine can support weak password identification for multiple network protocols (such as HTTP, SMTP, FTP, etc.). By defining rule templates and field extraction methods for different protocols, unified processing of multiple protocol traffic is achieved. In the rule file, users can add weak password checking rules for different protocols according to actual needs to achieve comprehensive monitoring of weak passwords in the entire network environment.

[0040] Example: Figure 1 , system framework diagram, taking SMTP protocol weak password detection as an example to illustrate the technical solution of the present invention.

[0041] Rule definition: alert smtp any any ->any any (msg:"SMTP Weak Password Detected";flow:to_server,established; content:"AUTH LOGIN"; distance:0; content:"|0d 0a|"; within:2; content:"|0d 0a|"; distance:0; pcre:" / [A-Za-z0-9+ / =]{1,}|\r\n[A-Za-z0-9+ / =]{1,} / "; base64_decode:$2; weak_password:$2; sid:1234568; rev:1;) 2. Rule parsing, such as Figure 2 : Read the rule file and load it into memory.

[0042] Check the rule syntax to ensure that it is formatted correctly.

[0043] Map the field extraction expression to prepare to extract the password field.

[0044] Optimize the rules, such as removing spaces, unifying the format (generally SMTP is encoded in base64), etc., to improve processing efficiency.

[0045] 3. Traffic processing, such as Figure 3 : Capture SMTP traffic packets.

[0046] Parse the data packet and extract the data of the SMTP application layer.

[0047] Match the security rules to see whether the weak_password keyword is included to determine whether the weak password check is triggered.

[0048] Extract the password field and pass it to the weak password check module.

[0049] 4. Weak password check, such as Figure 4 : Preprocess the password field, remove spaces, etc.

[0050] We choose to use the zxcvbn library for password strength assessment. You can also choose other libraries or develop your own weak password strength assessment library based on actual conditions.

[0051] Determine whether the password is weak based on the evaluation result.

[0052] 5. Alarm and log records: Generate warning information, including weak password content, occurrence location, timestamp, etc.

[0053] Report alarms in JSON format, record identification results, and perform necessary analysis and audits. The JSON format is as follows: { "timestamp": 1604203628, "link_id": 0, "flow_id": 1276353490495318, "pcap_cnt": 23, "decode_ssl": 0, "src_ip": "192.168.100.4", "src_port": 49411, "dest_ip": "192.79.63.24", "dest_port": 25, "proto": "TCP", "smtp": { "helo": "User-PC", "mail_from": "<nwamalog@binatones.ml> ", "rcpt_to": ["<nwama@binatones.ml> "] }, "event_type": "alert", "alert": { "action": "alert", "gid": 1, "signature_id": 27000001, "rev": 1, "signature": "SMTP Weak Password Detected", "category": "weak_password", "metadata": { "error_code": -10, "account": "", "passwd": "123456" } } } It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0054] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0055] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0056] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for identifying weak passwords in network traffic based on an extended security rule engine, characterized in that The following steps are involved: (1.1) Capture network traffic packets from the network interface; (1.2) According to the protocol type in the data packet, call the corresponding protocol parser to parse the data packet and extract the application layer data; (1.3) Match the extracted application layer data with the Suricata rule file that introduces the new rule keyword weak_password, find the rules containing the weak_password keyword, and determine which rules are triggered; (1.4) For the triggered rule, extract the password field from the application layer data according to the field extraction expression defined therein; (1.5) Weak passwords are identified in the extracted password fields. When a weak password is identified, an alarm message is generated according to the configuration of the security rule engine.

2. The method according to claim 1, characterized in that The rule keyword weak_password immediately follows the protocol specification and field extraction expression.

3. The method according to claim 1, characterized in that The Suricata rule that introduces the new rule keyword weak_password must follow the following format: A rule must start with a directive that Suricata supports; The protocol and traffic direction must be clearly specified in the rules; The rule contains content matching and weak_password keywords for extracting the password field; The weak_password keyword should be followed by one or more variables that specify the password fields to extract.

4. The method according to claim 1 or 2, characterized in that: The security rule engine can parse the weak_password keyword when loading the rule file and perform the following processing: (4.1) Perform syntax check on the content in the rule file to ensure the correctness of the rules; (4.2) Optimize logic based on rules, remove duplicate rules and adjust priorities; (4.3) Generate field extraction mapping for each rule to facilitate fast matching in the traffic processing stage.

5. The method according to claim 4, characterized in that The implementation of the field extraction includes two modes: regular expression matching and direct reference to protocol specific fields. Regular expressions are applicable to non-standard format data, and protocol field references are applicable to known data structures.

6. The method according to any one of claims 1 to 5, characterized in that: The weak password checking module verifies and scores the strength of the extracted password fields by integrating a password strength assessment algorithm or based on an external leaked password database.

7. The method according to claim 6, characterized in that Before password strength assessment, the weak password check module preprocesses the extracted password fields to ensure detection accuracy.

8. The method according to any one of claims 1 to 7, characterized in that When a weak password is detected, the generated warning information is recorded in JSON format, including the following key information: The unique identifier of the triggering rule; Detected weak password content; Protocol type, source IP address, and destination IP address; The timestamp when the detection event occurred.

9. A computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, characterized in that: When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 8.

10. An electronic device, characterized in that: The method comprises one or more processors, one or more memories and one or more programs, wherein the one or more programs are stored in the one or more memories and are configured to be executed by the one or more processors, and the one or more programs include instructions for executing the method as claimed in any one of claims 1 to 8.

Images