Asset feature-based association type intelligent weak password detection and early warning method and system

Abstract

The invention relates to an asset feature-based association type intelligent weak password detection and early warning method and system. The method comprises the following steps of: inputting asset information; generating an asset feature association dictionary; configuring a detection task; automatically or manually executing the weak password detection task; scanning or identifying a port; password collision; a weak password detection report and risk early warning and notification are automatically generated; the efficient, accurate and practical weak password detection and early warning system is formed by efficient asset information management, intelligent password dictionary generation, flexible detection task configuration, diversified detection modes, accurate port scanning and recognition, automatic report generation, real-time risk early warning and notification and the like. The invention aims to improve the network security protection level and ensure asset security.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network information security, and in particular relates to an asset feature-associated intelligent weak password detection and early warning method and system. Background Art

[0002] With the popularization and development of the Internet, network security issues have become increasingly prominent, among which weak password attacks have become one of the common attack methods used by network hackers. Weak passwords refer to those passwords that are simple and easy to guess or infer. They are usually composed of simple numbers, letters or continuous strings, lack sufficient complexity and randomness, and are therefore easy to be cracked and attacked.

[0003] In order to improve the security of business systems and prevent potential risks caused by weak passwords, weak password detection technology has emerged. This technology uses a series of algorithms and rules to automatically analyze and detect passwords set by users to determine whether they meet the password complexity requirements and whether they are easy to guess or crack. Once a weak password is detected, the tool will take corresponding measures, such as prompting the user to change the password or automatically rejecting the setting of the password, thereby protecting the security of user accounts and tools.

[0004] Existing technical solutions form a password dictionary based on a large number of common password samples, then try to traverse the passwords in the password dictionary to connect to the target tool, analyze the response results to identify whether there are weak passwords, and then end the task. However, the effectiveness of such tools depends largely on their built-in password dictionaries. If the passwords in the dictionary are not comprehensive or updated in a timely manner, the tool may not be able to detect certain new or complex weak passwords, and after obtaining the detection results, it cannot be immediately fed back to the personnel related to the weak passwords. Due to timeliness issues, the risks caused by weak passwords will increase.

[0005] The patent application document with publication number CN115412302A discloses a weak password detection method, device, electronic device and storage medium, which detects network information assets based on asset detection indication information; the asset detection indication information includes network protocol, and / or, ACL configuration information and routing configuration information, and / or, NAT configuration information of firewall, and / or, traffic analysis; network information assets include IP address, port, application service; detect whether there is a weak password in the IP address, port, and application service; if so, a weak password warning is issued. By integrating network protocol, ACL configuration information and routing configuration information, NAT configuration information of firewall, and traffic analysis, the detection of network information assets is realized, wherein the configuration information can detect assets for the actual production environment, thereby improving asset coverage, strengthening asset detection depth, and effectively improving asset discovery coverage and discovery capabilities. However, due to the failure to generate a custom dictionary based on asset characteristics, the weak password detection results are inaccurate. For example, when facing certain specific industries or assets with unique business needs, the general dictionary cannot cover the special password rules that may exist, so it is easy to miss the real weak passwords. And it is impossible to define the automatic execution of weak password scanning tasks, which leads to cumbersome and inefficient manual operations. Taking large-scale network assets as an example, if you need to manually start scanning every time, it will not only consume manpower, but also easily miss the best scanning time due to human negligence, increasing the risk of the system being attacked by weak passwords. Summary of the invention

[0006] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide an intelligent weak password detection and early warning method and system based on asset feature association, which dynamically constructs a more accurate and comprehensive asset feature association dictionary through the integration and analysis of business and personnel information, and because of the association with business and personnel information, the system generates risk warning information at the same time when a weak password is found, and immediately notifies the relevant parties and administrators to whom the weak password belongs, discovers and handles potential security risks; the technical effects or advantages of the present invention application are embodied in its efficient asset information management, intelligent password dictionary generation, flexible detection task configuration, diversified detection modes, accurate port scanning identification, automatic report generation, and real-time risk warning and notification, which together constitute an efficient, accurate and practical weak password detection and early warning system, aiming to improve the level of network security protection and ensure asset security.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is:

[0008] An intelligent weak password detection and early warning method based on asset feature association, specifically comprising the following steps:

[0009] Step 1: Enter asset information

[0010] Import asset information by manual entry, which includes manual single entry or batch import. The attributes of asset information include IPv4 address, business, department name, name of the person, contact number, email address and date of birth of the person.

[0011] Step 2: Generate asset feature association dictionary

[0012] Extract features from the asset information entered in step 1 and dynamically generate an asset feature association dictionary;

[0013] Step 3: Configure the detection task

[0014] Based on the asset feature association dictionary generated in step 2, configure the task executor, detection time, detection range, protocol, scanning cycle, and password dictionary used for the inspection;

[0015] Step 4: Choose to automate or manually perform weak password detection tasks

[0016] In the automatic detection mode, the weak password detection task is automatically performed according to the detection time, detection range, protocol, scanning cycle and password dictionary used in step 3;

[0017] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0018] Step 5: Scan or Identify Ports

[0019] According to the automatic detection mode or manual detection mode selected in step 4, the asset information entered in step 1 is identified, and the open ports and protocols are identified through port scanning identification technology;

[0020] Step 6: Password collision

[0021] According to the password dictionary configured in step 3, perform password collision on the ports and protocols identified in step 5 to find out the weak password information.

[0022] Step 7: Automatically generate weak password detection report

[0023] Automatically generate a test report based on the pre-made report template, and generate a weak password test report based on the weak password information found in step 6, including the test report name, tester, test time, test scope, a list of weak passwords found, risk analysis, and rectification suggestions;

[0024] Step 8: Risk warning and notification

[0025] Based on the weak password detection report generated in step 7, risk warning information is automatically generated, and the relevant parties and administrators are notified by email or text message through the "personnel's email address" or "personnel's contact number" entered in the asset information in step 1. The risk warning information includes the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password.

[0026] The specific method of step 1 is:

[0027] The asset management module is used to input asset information, including manual single entry or batch import. The IPV4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth entered in the asset entry module are formatted using regular expressions. For personnel email addresses, the JavaMail API is used to verify the validity of the email address.

[0028] For the batch import function, a CSV file is used as a template, which is filled in by the user and uploaded. The file provided by the user is then parsed and processed by JAVA code, and the file is read and written, parsed, and the asset information entered by the user is extracted and inserted into the database.

[0029] The specific method of step 2 is:

[0030] Use Java's I / O module to load the built-in common password dictionary file, and extract the IPv4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth from the asset information entered in step 1 through the JDBC (Java Database Connectivity) or JPA (Java Persistence API) module; use Java's string processing function to generate a password dictionary; use Java's collection framework to store the generated asset feature association dictionary.

[0031] The specific method of step 3 is:

[0032] The configuration interface is designed through the Java graphical user interface (GUI) library, including the task executor of the detection, the detection time, the detection range, the protocol, the scanning cycle and the password dictionary used.

[0033] The specific method of step 4 is:

[0034] Use Java's timer to implement the periodic execution of the automated detection mode; Java's collection framework is used to store the preset detection range, protocol, and password dictionary configuration information, write a background service to implement the automated service function, and automatically trigger the weak password detection task according to the preset detection time and detection cycle configuration information;

[0035] For the manual detection mode, a button or command interface based on a graphical user interface is provided. The graphical user interface calls the corresponding Java function or method to immediately trigger the weak password detection task; the programmed functions and methods use the same configuration information and detection logic as the automatic detection mode, but are not constrained by the detection time and detection cycle, allowing users to flexibly trigger manual triggering as needed.

[0036] The specific method of step 5 is:

[0037] The port scanning or identification function is that the IPv4 address entered by the user in step 1 is received and verified by the IP management module. The IP management module uses the Java network programming API to scan and detect the ports and services of the IPv4 address. After the scan is completed, the service identification module interacts with the open ports through a specific protocol to identify the open ports and protocols.

[0038] The specific method of step 6 is:

[0039] Design a password collision module to read the password dictionary configured in step 3, and use the configured password dictionary to perform password collision on the ports and protocols identified in step 5 to find out the weak password information.

[0040] The password collision module uses Java's network programming API to try to establish a connection with the service of the target port and authenticate each password in the built-in common password dictionary or the asset feature associated dictionary.

[0041] The specific method of step 7 is:

[0042] First, load the pre-made report template, which includes HTML, PDF or other format documents with fixed format and layout; receive the detected weak password information from the password collision module and fill it into the weak password detection report, and the filled information includes the detection report name, detector, detection time, detection scope, the list of weak passwords found, risk analysis and rectification suggestions;

[0043] Use Java's template engine to simplify the template loading and filling process; the template engine allows users to define the structure and style of the template, and dynamically pass data to the report template through Java code, or use Java's file processing API (such as FileWriter, PrintWriter or PDF libraries such as iText) to directly generate weak password detection reports.

[0044] The specific method of step 8 is:

[0045] When the password collision module finds weak password information, it transmits the IPv4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password to the risk warning and notification module. The risk warning and notification module first analyzes this information and determines the risk level based on the preset risk assessment logic; then, the risk warning and notification module accesses the asset information configured in step 1, including "personnel email" or "personnel contact number";

[0046] The risk warning and notification module uses Java's email sending library or the Java SDK of the SMS sending service to send risk warning notifications according to the configured "personnel's email address" or "personnel's contact number". The risk warning information will include the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password to ensure that security vulnerabilities are dealt with in a timely manner.

[0047] An intelligent weak password detection and early warning system based on asset feature association, comprising:

[0048] Asset management module: used to import asset information by manual entry, including manual single entry or batch import. The attributes of asset information include IPv4 address, business, department name, name of the person, contact number, email address and date of birth of the person.

[0049] Password dictionary management module: used to manage the system's built-in common password dictionary and the asset feature association dictionary dynamically generated based on the asset information in the asset management module;

[0050] Inspection task configuration module: used to dynamically generate asset feature association dictionary based on asset information in the asset management module, configure the task executor, inspection time, inspection range, protocol, scanning cycle and password dictionary used for inspection;

[0051] Detection mode selection module: used to select automatic or manual execution of weak password detection tasks. In the automatic detection mode, the weak password detection task is automatically executed according to the configured detection time, detection range, protocol, scanning cycle and the password dictionary used;

[0052] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0053] Port scanning or identification module: used to identify the asset information entered into the asset management module according to the automatic detection mode or manual detection mode selected in the detection mode selection module, and identify open ports and protocols through port scanning identification technology;

[0054] Password collision module: used to perform password collision on the ports and protocols identified by the port scanning or identification module according to the password dictionary configured by the detection task configuration module, and find out the existing weak password information;

[0055] Report management module: used to automatically generate detection reports based on pre-made report templates, and generate weak password detection reports based on the weak password information found by the password collision module, including the detection report name, tester, detection time, detection scope, a list of weak passwords found, risk analysis, and rectification suggestions;

[0056] Risk warning management module: It is used to automatically generate risk warning information based on the weak password detection report generated by the report management module, and notify the relevant parties and administrators by email or text message through the "email address of the person in charge" or "contact number of the person in charge" in the asset information entered into the asset management module. The risk warning information includes the IPV4 address, port, protocol, account number, password, risk level and recommended repair measures of the weak password.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] 1. Improve dictionary accuracy: The present invention generates a dictionary by associating asset features, making the dictionary more targeted and adaptable, improving the efficiency and accuracy of weak password detection, and reducing the omission rate of security vulnerabilities.

[0059] 2. Flexible and changeable operation modes: The present invention can realize scheduled automatic execution and support manual operation, meet the usage requirements of different users, and improve the flexibility and usability of the system.

[0060] 3. Simplify and optimize the reporting process: The present invention realizes the automatic generation of weak password detection reports through prefabricated report templates, eliminating the tedious steps of manual sorting and analysis, and improving work efficiency and report accuracy.

[0061] 4. Instant risk warning: After discovering a weak password, the present invention can automatically generate risk warning information and notify the relevant parties and administrators of the vulnerability through associated asset information, ensuring that the security vulnerability is handled in a timely manner and reducing security risks.

[0062] In summary, the present invention greatly improves the efficiency and accuracy of weak password detection, reduces the omission rate of security risks, and ensures timely discovery and handling of security risks through innovations such as generating a highly accurate dictionary by associating asset features, flexible and changeable operation modes, an optimized process for automatically generating detection reports, and an immediate risk warning mechanism. These features of the present invention not only enhance the adaptability and flexibility of the system, but also improve work efficiency and user experience, and have significant security and convenience advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a design flow chart of the method of the present invention.

[0064] Figure 2 It is a functional architecture diagram of the system of the present invention. DETAILED DESCRIPTION

[0065] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0066] like Figure 1 As shown, an intelligent weak password detection and early warning method based on asset feature association includes the following steps:

[0067] Step 1: Enter asset information

[0068] Import asset information by manual entry, which includes manual single entry or batch import. The attributes of asset information include IPV4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth. This step mainly provides a reliable basis for subsequent password dictionary generation, task scope configuration, and sending risk warnings.

[0069] The specific method of step 1 is:

[0070] The asset management module is used to input asset information, including manual single entry or batch import. The IPV4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth entered in the asset entry module are formatted using regular expressions. For personnel email addresses, the JavaMail API is used to verify the validity of the email address.

[0071] For the batch import function, a CSV file is used as a template, which is filled in by the user and uploaded. The file provided by the user is then parsed and processed by JAVA code, and the file is read and written, parsed, and the asset information entered by the user is extracted and inserted into the database.

[0072] Step 2: Generate asset feature association dictionary

[0073] In addition to the system's built-in dictionary of commonly used passwords, feature extraction is performed on the asset information entered in step 1 to dynamically generate an asset feature association dictionary, thereby improving the accuracy of weak password detection.

[0074] The specific method of step 2 is:

[0075] Use Java's I / O module to load the built-in common password dictionary file, and extract the IPv4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth from the asset information entered in step 1 through the JDBC (Java Database Connectivity) or JPA (Java Persistence API) module; use Java's string processing functions (such as StringBuilder, String.format, etc.) to generate a password dictionary; use Java's collection framework (such as HashSet or ArrayList) to store the generated asset feature association dictionary to ensure the uniqueness and iterability of the dictionary.

[0076] Step 3: Configure the detection task

[0077] Based on the asset feature association dictionary generated in step 2, the system allows users to configure the task executor, detection time, detection range, protocol, scanning cycle and password dictionary used; this flexibility enables the system to adapt to different security needs and environments.

[0078] The specific method of step 3 is:

[0079] When developing the task configuration function, we fully utilize the powerful features of the Java language to implement this function. Through Java's graphical user interface (GUI) library (such as Swing or JavaFX), we design an intuitive and easy-to-use configuration interface, including the task executor, detection time, detection range, protocol, scanning cycle, and password dictionary used; allowing users to easily define various parameters of the inspection task.

[0080] Java's collection framework (such as HashSet and ArrayList) supports efficient management of configuration data entered by users, while the I / O function of Java files supports the program to easily read and save configuration files. Java's concurrent programming features ensure the correct transmission and efficient processing of configuration parameters during task execution.

[0081] Step 4: Choose to automate or manually perform weak password detection tasks

[0082] Combined with the detection task configured in step 3, the detection mode includes automatic detection mode and manual detection mode;

[0083] In the automatic detection mode, the weak password detection task is automatically performed according to the detection time, detection range, protocol, scanning cycle and password dictionary used in step 3;

[0084] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0085] The specific method of step 4 is:

[0086] When developing automated and manually executed detection tasks, use Java timers (such as java.util.Timer or java.util.concurrent.ScheduledExecutorService) to implement periodic execution of automated detection mode; Java collection frameworks (such as HashSet, Array List, etc.) are used to store the preset detection range, protocol, and password dictionary configuration information, and write a background service to implement automated service functions, and automatically trigger weak password detection tasks according to the preset detection time and detection cycle configuration information;

[0087] For the manual detection mode, a button or command interface based on a graphical user interface (such as through command line parameters or REST API) is provided. The graphical user interface calls the corresponding Java function or method to immediately trigger the weak password detection task; the programmed functions and methods use the same configuration information and detection logic as the automated detection mode, but are not constrained by the detection time and detection cycle, allowing users to flexibly trigger manual triggering as needed.

[0088] Step 5: Scan or Identify Ports

[0089] According to the automatic detection mode or manual detection mode selected in step 4, the asset information entered in step 1 is identified, and the open ports and protocols are identified through port scanning identification technology; this information will serve as the basis for password cracking and help the system identify possible vulnerabilities and risks.

[0090] The specific method of step 5 is:

[0091] The port scanning or identification function receives and verifies the IPv4 address entered by the user in step 1 by the IP management module. The IP management module uses Java's network programming API (such as the Socket class) to scan and detect the ports and services of the IPv4 address. After the scan is completed, the service identification module interacts with the open port through a specific protocol to identify the open port and protocol.

[0092] Step 6: Password collision

[0093] According to the password dictionary configured in step 3, perform password collision on the ports and protocols identified in step 5 to discover the weak password information.

[0094] The specific method of step 6 is:

[0095] Design a password collision module to read the password dictionary configured in step 3, and use the configured password dictionary to perform password collision on the ports and protocols identified in step 5 to find out the weak password information.

[0096] The password collision module uses Java's network programming API (such as the Socket or DatagramSocket class) to try to establish a connection with the service on the target port and authenticate using each password in the built-in common password dictionary or the asset feature associated dictionary.

[0097] Step 7: Automatically generate weak password detection report

[0098] Automatically generate a detection report based on the pre-made report template, and generate a weak password detection report based on the weak password information found in step 6, including the detection report name, detector, detection time, detection scope, a list of weak passwords found, risk analysis, and rectification suggestions; it is convenient for users to quickly understand the security status of assets.

[0099] The specific method of step 7 is:

[0100] The automatic report generation function is responsible for organizing the detected weak password information into easy-to-read reports so that users can quickly understand the security status of assets. The program will design a report generation module that works closely with the previous password collision module to complete the report output.

[0101] First, load the pre-made report template, which includes HTML, PDF or other format documents with fixed format and layout; receive the detected weak password information from the password collision module and fill it into the weak password detection report, and the filled information includes the detection report name, detector, detection time, detection scope, the list of weak passwords found, risk analysis and rectification suggestions;

[0102] Use Java template engines (such as Thymeleaf, FreeMarker, etc.) to simplify the template loading and filling process; the template engine allows users to define the structure and style of the template, and dynamically pass data to the report template through Java code, or use Java file processing APIs (such as FileWriter, PrintWriter, or PDF libraries such as iText) to directly generate weak password detection reports.

[0103] Step 8: Risk warning and notification

[0104] Based on the weak password detection report generated in step 7, risk warning information is automatically generated, and the relevant parties and administrators are notified by email or text message through the "Email address of the person concerned" or "Contact number of the person concerned" entered in the asset information in step 1. The risk warning information includes the IPV4 address, port, protocol, account number, password, risk level and recommended repair measures of the weak password to ensure that security vulnerabilities are dealt with in a timely manner.

[0105] The specific method of step 8 is:

[0106] The program designs the risk warning and notification module to timely inform the relevant parties and administrators of the detected weak password risks. This module cooperates with the previous modules to complete the closed-loop disposal of weak password detection.

[0107] When the password collision module finds weak password information, it transmits the IPv4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password to the risk warning and notification module. The risk warning and notification module first analyzes this information and determines the risk level based on the preset risk assessment logic; then, the risk warning and notification module accesses the asset information configured in step 1, including "personnel email" or "personnel contact number";

[0108] The risk warning and notification module uses Java's email sending library (such as JavaMail API) or the Java SDK of SMS sending service (such as Twilio, Alibaba Cloud SMS service, etc.) to send risk warning notifications according to the configured "personnel email" or "personnel contact number". The risk warning information will include the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password to ensure that security vulnerabilities are handled in a timely manner.

[0109] like Figure 2 As shown, an intelligent weak password detection and early warning system based on asset feature association includes:

[0110] Asset management module: used to import asset information by manual entry, including manual single entry or batch import. The attributes of asset information include IPV4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth. This module is the basis of the password dictionary management module, task management module and risk warning management module, ensuring that other modules can obtain complete asset information to support customized detection tasks and accurate risk warnings.

[0111] Password dictionary management module: used to manage the system's built-in common password dictionary and the asset feature association dictionary dynamically generated based on the asset information in the asset management module, ensuring that weak password checks on assets in subsequent tasks are more targeted.

[0112] Inspection task configuration module: used to dynamically generate asset feature association dictionary based on asset information in the asset management module, configure the task executor, inspection time, inspection range, protocol, scanning cycle and password dictionary used for inspection;

[0113] Detection mode selection module: used to combine the detection tasks configured in the detection task configuration module. The detection modes include automatic detection mode and manual detection mode.

[0114] In the automatic detection mode, the weak password detection task is automatically performed according to the configured detection time, detection range, protocol, scanning cycle and password dictionary used;

[0115] In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios;

[0116] Port scanning or identification module: used to identify the asset information entered into the asset management module according to the automatic detection mode or manual detection mode selected in the detection mode selection module, and identify open ports and protocols through port scanning identification technology;

[0117] Password collision module: used to perform weak password collision on the ports and protocols identified by the port scanning or identification module according to the password dictionary configured by the detection task configuration module, and discover the existing weak password information;

[0118] The detection task configuration module, detection mode selection module, port scanning or identification module and password collision module achieve dynamic detection of weak asset passwords through close collaboration with the asset management module and password dictionary management module, thereby improving detection efficiency and accuracy.

[0119] Report management module: used to automatically generate detection reports based on pre-made report templates, and generate weak password detection reports based on the weak password information found by the password collision module, including the detection report name, detector, detection time, detection scope, a list of weak passwords found, risk analysis, and rectification suggestions; this module can quickly provide analysis results of weak password detection, provide users with comprehensive feedback on the current status of asset security, and help quickly formulate response strategies.

[0120] Risk warning management module: It is used to automatically generate risk warning information based on the weak password detection report generated by the report management module, and notify the relevant parties and administrators by email or text message through the "email address of the person in charge" or "contact number of the person in charge" in the asset information entered into the asset management module. The risk warning information includes the IPV4 address, port, protocol, account number, password, risk level and recommended repair measures of the weak password.

[0121] The present invention is developed using Java language and uses JavaFX to construct an interactive interface, so that users can intuitively and conveniently operate the system, which reduces the user's usage threshold. MySQL relational data is used to store different types of data.

[0122] The key points and intended protection points of the present invention are:

[0123] 1. Generation and application of user characteristic password dictionary based on business and personnel related attributes

[0124] One of the key points of the present invention is to enter and manage IP assets with business and personnel related attributes. The system can generate specific password dictionaries according to different business and personnel related attributes. It can more comprehensively discover security risks and improve the security of target assets.

[0125] 2. Combination of automation and manual inspection

[0126] The present invention combines automated inspection with manual inspection, which not only ensures the efficiency and accuracy of the inspection, but also allows for a more in-depth and detailed inspection when necessary. This flexibility ensures the comprehensiveness and reliability of the system.

[0127] 3. Immediate risk warning

[0128] The present invention not only performs checks such as "asset and port scanning identification" and "personnel and password collision", but also marks the situation of "existence of weak passwords" and generates a "password risk warning". This warning mechanism helps to timely discover and respond to potential security threats.

[0129] 4. Comprehensive inspection report

[0130] The present invention prefabricates a weak password detection report template (which can be freely configured), reduces labor costs, and reduces the possibility of errors in manually collating reports. At the same time, this unified report format also enhances the statistical reporting effect.

[0131] The technical problem to be solved by the present invention is:

[0132] Weak password scanning technology is designed to detect weak passwords used in the network. Weak passwords usually refer to passwords / passwords that are vulnerable to attack or guessing. Such passwords / passwords may be too simple, common, or based on easily accessible information, allowing hackers or malicious users to easily crack accounts or systems. Weak password scanning technology tests the security of the system by trying various possible username and password combinations to discover these potential security vulnerabilities. Weak password scanning technology can help organizations identify and strengthen systems that are vulnerable to password attacks, thereby improving network security.

[0133] In view of the weaknesses in the prior art, the present invention aims to solve the following problems:

[0134] 1. Improve security: Existing weak password detection systems usually rely on general password dictionaries, while ignoring the impact of user personalized information. The present invention generates a customized password dictionary by combining the associated attributes of the IP address (such as department name, personnel information, etc.), thereby more accurately simulating the password combinations that attackers may use, thereby improving the pertinence and effectiveness of detection.

[0135] 2. Enhanced flexibility: The present invention allows users to customize inspection parameters (such as detection range, protocol, detection time and scanning cycle), making weak password scanning more flexible and customizable. The inspection strategy can be adjusted according to the needs of different scenarios to adapt to diverse network environments.

[0136] 3. Improve detection efficiency: The present invention first confirms the survival status and open ports of the target host, and only scans when it is determined that the host is available, thereby reducing invalid scanning operations and improving detection efficiency.

[0137] 4. Real-time feedback mechanism: Once a weak password is found, the present invention not only generates an inspection report, but also instantly notifies the relevant parties and administrators via email or text message, which speeds up the risk response and enhances the timeliness of security management.

[0138] 5. Simplify the operation process: Through automated inspection, the administrator's workload is reduced, while retaining the manual inspection option, providing the possibility for manual intervention in special situations, making the system suitable for both large-scale deployment and individual special case processing.

[0139] 6. Improve user experience: The present invention improves users' awareness and management efficiency of weak password issues through an intuitive interface and automated detection report output, making it easier for users to understand and take measures.

[0140] In the existing technical system, the system has obvious deficiencies in weak password detection and management, which are mainly manifested in the following aspects:

[0141] Insufficient dictionary adaptability:

[0142] The dictionaries used by traditional tools are fixed and universal, lacking adaptability to specific asset characteristics, resulting in inefficient weak password detection and possible omission of key security risks.

[0143] The present invention generates a dictionary by associating with asset features, making the dictionary more targeted and adaptable, improving the efficiency and accuracy of weak password detection, and reducing the omission rate of security vulnerabilities.

[0144] Rigid operating mode:

[0145] Traditional tools mainly rely on manual operations, and have insufficient capabilities to cope with different usage scenarios and low operating efficiency.

[0146] The present invention can realize scheduled automatic execution and support manual operation, meet the use requirements of different users, and improve the flexibility and usability of the system.

[0147] Report generation is cumbersome and inefficient:

[0148] After discovering weak passwords, existing tools require manual tedious data sorting and analysis to generate reports, which increases the workload and may introduce human errors.

[0149] The present invention realizes automatic generation of weak password detection reports by prefabricating report templates, eliminating the tedious steps of manual sorting and analysis, and improving work efficiency and report accuracy.

[0150] Risk response lags:

[0151] After discovering weak passwords, traditional tools lack effective risk warning and immediate notification mechanisms, resulting in security vulnerabilities not being dealt with in a timely manner, increasing potential security risks.

[0152] After discovering a weak password, the present invention can automatically generate risk warning information and notify the relevant parties and administrators of the vulnerability by associating asset information, thereby ensuring that the security vulnerability is handled in a timely manner and reducing security risks.

[0153] Glossary of relevant technical terms

[0154] 1. Weak Password: refers to a password that is easy to guess, crack or brute force. Weak passwords are usually composed of simple letters, numbers or symbols, are short in length, and lack complexity and randomness.

[0155] 2. Dictionary Generation Algorithm: An algorithm used to generate a password dictionary. The dictionary generation algorithm can generate a dictionary containing various possible password combinations according to certain rules and strategies, which is used for password cracking or weak password detection.

[0156] 3. Scanning Time: refers to the time required for weak password detection. The length of the scanning time depends on the performance of the weak password detection system and the complexity of the algorithm.

[0157] 4. False Positive Rate: refers to the proportion of valid passwords that are incorrectly marked as weak passwords in weak password detection. A lower false positive rate indicates a higher accuracy of the weak password detection system.

[0158] 5. User Interface (UI): It is the interface through which users interact with computer programs or devices. The user interface can be implemented through a graphical user interface (GUI) or a command line interface (CLI).

[0159] 6. Interaction Mode: refers to the way users interact with computer programs or devices. Common interaction modes include keyboard input, mouse clicks, touch screen operations, etc.

[0160] 7. Survival detection: A network scanning technology used to determine whether the target host is active. SYN semi-connection is a common method for survival detection, which uses the SYN flag in the TCP protocol to determine whether the target host can establish a TCP connection.

[0161] 8. Social Engineering Password Dictionary: A password dictionary built based on social engineering principles, used to guess possible passwords used by users. Building a social engineering password dictionary usually requires collecting a large amount of information from the target's social networking sites, forums, and other websites, such as name, birthday, home address, etc., and also requires collating, analyzing, and summarizing this information to generate a list of possible passwords.

[0162] 9. Concurrency: refers to the number of tasks that can be executed at the same time, also known as concurrency. In this tool, the current concurrency refers to the number of threads that execute password cracking at the same time, which can be adjusted dynamically according to actual conditions.

[0163] 10. Regular Expression: A regular expression is a text pattern that includes common characters (for example, letters from a to z) and special characters (called "metacharacters") that can be used to describe and match specific patterns of strings.

[0164] 11. Graphical User Interface: Graphical User Interface refers to a computer operation user interface that uses graphics to display. Graphical User Interface is an interface display format for communication between people and computers, allowing users to use input devices such as a mouse to manipulate icons or menu options on the screen to select commands, call files, start programs or perform other daily tasks.

[0165] 12. Command interface: A type of program provided by the operating system to the user. It receives user input commands, interprets and executes them, and returns the execution results to the user.

[0166] 13. Closed-loop disposal: Closed-loop disposal is a closed-loop management process that ensures that problems are fully handled, including identification, analysis, resolution and feedback.

Claims

1. An intelligent weak password detection and early warning method based on asset feature association, characterized in that: The specific steps include: Step 1: Enter asset information Import asset information by manual entry, which includes manual single entry or batch import. The attributes of asset information include IPv4 address, business, department name, name of the person, contact number, email address and date of birth of the person. Step 2: Generate asset feature association dictionary Extract features from the asset information entered in step 1 and dynamically generate an asset feature association dictionary; Step 3: Configure the detection task Based on the asset feature association dictionary generated in step 2, configure the task executor, detection time, detection range, protocol, scanning cycle, and password dictionary used for the inspection; Step 4: Choose to automate or manually perform weak password detection tasks In the automatic detection mode, the weak password detection task is automatically performed according to the detection time, detection range, protocol, scanning cycle and password dictionary used in step 3; In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios; Step 5: Scan or Identify Ports According to the automatic detection mode or manual detection mode selected in step 4, the asset information entered in step 1 is identified, and the open ports and protocols are identified through port scanning identification technology; Step 6: Password collision According to the password dictionary configured in step 3, perform password collision on the ports and protocols identified in step 5 to find out the weak password information. Step 7: Automatically generate weak password detection report Automatically generate a test report based on the pre-made report template, and generate a weak password test report based on the weak password information found in step 6, including the test report name, tester, test time, test scope, a list of weak passwords found, risk analysis, and rectification suggestions; Step 8: Risk warning and notification Based on the weak password detection report generated in step 7, risk warning information is automatically generated, and the relevant parties and administrators are notified by email or text message through the "Email address of the person concerned" or "Contact number of the person concerned" entered in the asset information in step 1. The risk warning information includes the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password.

2. According to claim 1, the method for detecting and warning weak passwords based on asset feature association is characterized in that: The specific method of step 1 is: The asset management module is used to input asset information, including manual single entry or batch import. The IPV4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth entered in the asset entry module are formatted using regular expressions. For personnel email addresses, the JavaMail API is used to verify the validity of the email address. For the batch import function, a CSV file is used as a template, which is filled in by the user and uploaded. The file provided by the user is then parsed and processed by JAVA code, and the file is read and written, parsed, and the asset information entered by the user is extracted and inserted into the database.

3. According to claim 1, the method for detecting and warning weak passwords based on asset feature association is characterized in that: The specific method of step 2 is: Use Java's I / O module to load the built-in common password dictionary file, and extract the IPv4 address, business, department name, personnel name, personnel contact number, personnel email address and personnel date of birth from the asset information entered in step 1 through the JDBC (Java Database Connectivity) or JPA (Java Persistence API) module; use Java's string processing function to generate a password dictionary; use Java's collection framework to store the generated asset feature association dictionary.

4. According to claim 1, the method for detecting and warning weak passwords based on asset feature association is characterized in that: The specific method of step 3 is: The configuration interface is designed through the Java graphical user interface (GUI) library, including the task executor of the detection, the detection time, the detection range, the protocol, the scanning cycle and the password dictionary used.

5. According to claim 1, the method for detecting and warning weak passwords based on asset feature association is characterized in that: The specific method of step 4 is: Use Java's timer to implement the periodic execution of the automated detection mode; Java's collection framework is used to store the preset detection range, protocol, and password dictionary configuration information, write a background service to implement the automated service function, and automatically trigger the weak password detection task according to the preset detection time and detection cycle configuration information; For the manual detection mode, a button or command interface based on a graphical user interface is provided. The graphical user interface calls the corresponding Java function or method to immediately trigger the weak password detection task; the programmed functions and methods use the same configuration information and detection logic as the automatic detection mode, but are not constrained by the detection time and detection cycle, allowing users to flexibly trigger manual triggering as needed.

6. According to claim 1, the method for detecting and warning weak passwords based on asset feature association is characterized in that: The specific method of step 5 is: The port scanning or identification function is received and verified by the IP management module through the IPV4 address entered by the user in step 1. The IP management module uses Java's network programming API to scan and detect the ports and services of the IPV4 address; after the scan is completed, the service identification module interacts with the open ports through a specific protocol to identify the open ports and protocols.

7. According to claim 1, the method for detecting and warning weak passwords based on asset feature association is characterized in that: The specific method of step 6 is: Design a password collision module to read the password dictionary configured in step 3, and use the configured password dictionary to perform password collision on the ports and protocols identified in step 5 to find out the weak password information. The password collision module uses Java's network programming API to try to establish a connection with the service of the target port and authenticate each password in the built-in common password dictionary or the asset feature associated dictionary.

8. The method for detecting and warning weak passwords based on asset feature association according to claim 1 is characterized in that: The specific method of step 7 is: First, load the pre-made report template, which includes HTML, PDF or other format documents with fixed format and layout; receive the detected weak password information from the password collision module and fill it into the weak password detection report, and the filled information includes the detection report name, detector, detection time, detection scope, the list of weak passwords found, risk analysis and rectification suggestions; Use Java's template engine to simplify the template loading and filling process; the template engine allows users to define the structure and style of the template, and dynamically pass data to the report template through Java code, or use Java's file processing API (such as FileWriter, PrintWriter or PDF libraries such as iText) to directly generate weak password detection reports.

9. The method for detecting and warning weak passwords based on asset feature association according to claim 1 is characterized in that: The specific method of step 8 is: When the password collision module finds weak password information, it will pass the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password to the risk warning and notification module. The risk warning and notification module will first analyze this information and determine the risk level based on the preset risk assessment logic; then, the risk warning and notification module will access the asset information configured in step 1, including "personnel email" or "personnel contact number"; The risk warning and notification module uses Java's email sending library or the Java SDK of the SMS sending service to send risk warning notifications according to the configured "personnel's email" or "personnel's contact number". The risk warning information will include the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password to ensure that security vulnerabilities are handled in a timely manner.

10. An intelligent weak password detection and early warning system based on asset feature association, characterized in that: include: Asset management module: used to import asset information by manual entry, including manual single entry or batch import. The attributes of asset information include IPv4 address, business, department name, name of the person, contact number, email address and date of birth of the person. Password dictionary management module: used to manage the system's built-in common password dictionary and the asset feature association dictionary dynamically generated based on the asset information in the asset management module; Inspection task configuration module: used to dynamically generate asset feature association dictionary based on asset information in the asset management module, configure the task executor, inspection time, inspection range, protocol, scanning cycle and password dictionary used for inspection; Detection mode selection module: used to select automatic or manual execution of weak password detection tasks. In the automatic detection mode, the weak password detection task is automatically executed according to the configured detection time, detection range, protocol, scanning cycle and the password dictionary used; In manual detection mode, users can manually trigger detection tasks according to their needs, flexibly responding to different usage scenarios; Port scanning or identification module: used to identify the asset information entered into the asset management module according to the automatic detection mode or manual detection mode selected in the detection mode selection module, and identify open ports and protocols through port scanning identification technology; Password collision module: Based on the password dictionary configured in the detection task configuration module, password collision is performed on the ports and protocols identified by the port scanning or identification module to discover the existing weak password information; Report management module: used to automatically generate detection reports based on pre-made report templates, and generate weak password detection reports based on the weak password information found by the password collision module, including the detection report name, tester, detection time, detection scope, a list of weak passwords found, risk analysis, and rectification suggestions; Risk warning management module: It is used to automatically generate risk warning information based on the weak password detection report generated by the report management module, and notify the relevant parties and administrators by email or SMS through the "Email address of the person in charge" or "Contact number of the person in charge" in the asset information entered into the asset management module. The risk warning information includes the IPV4 address, port, protocol, account, password, risk level and recommended repair measures of the weak password.

Images