Weak password detection method based on multi-modal feature fusion and dynamic behavior analysis

Abstract

The invention provides a weak password detection method based on multi-modal feature fusion and dynamic behavior analysis. According to the method, multi-dimensional feature extraction is innovatively introduced, including password entropy, semantic relevance, user historical behaviors, system login frequency and the like, so that user feature adaptation is improved, and dependency on a static dictionary is reduced; in addition, through real-time interactive feedback, instant pushing of password strength evaluation and safety suggestions can be realized. Therefore, by means of the method, the problems that in an existing weak password detection technology, the static dictionary dependency is high, the user feature adaptation is insufficient, and real-time feedback is lacked can be solved, the weak password detection precision and defense efficiency of colleges and universities are remarkably improved, and an efficient and easy-to-deploy password security solution is provided for the education industry.

Description

TECHNICAL FIELD

[0001] The application relates to a weak password detection method based on multi-modal feature fusion and dynamic behavior analysis, and belongs to the technical field of network security. BACKGROUND

[0002] A weak password generally refers to a password with a simple structure and easy to be guessed or cracked, such as a password with too few digits, too many identical characters, a single character type, or a common character combination.

[0003] Current weak password detection methods are usually based on a weak password dictionary, and static scanning tools are used to detect the password table in the file or database storing the password, or the password text is obtained by copying the application system access traffic and combined with dictionary matching. However, static scanning requires continuous full scanning of a large amount of and constantly changing user account information, which consumes a lot of performance and costs a lot, and has great limitations.

[0004] Specifically, the existing weak password detection technology has the following limitations: Strong static dictionary dependency: highly dependent on predefined weak password dictionaries, difficult to adapt to dynamically changing password types (such as keyboard continuous characters or semantically associated passwords), resulting in low detection coverage. For example, in a university environment, common weak passwords (such as 'Aa123456' or 'lisi20010101' name + birthday) are often difficult to be effectively identified due to dictionary update lag.

[0005] Insufficient user feature adaptation: user behavior patterns such as login frequency, historical behavior, and environmental parameters (such as login time and location) are not fully considered, resulting in a high false positive rate. For example, the login behavior of university students has periodicity (such as frequent login during exam week), but the existing model lacks personalized analysis of such features.

[0006] Real-time feedback is missing: the detection result is only presented as a Boolean value (strong / weak password), and there is a lack of immediate security recommendations or interactive mechanisms, making it difficult for users to dynamically correct passwords, resulting in continuous accumulation of campus network security risks. SUMMARY

[0007] The present application aims to solve the problems of strong static dictionary dependency, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technology, and provides an intelligent weak password detection method and device based on multi-modal feature fusion and dynamic behavior analysis to improve the coverage, accuracy, and real-time performance of weak password detection.

[0008] In a first aspect, the application provides a weak password detection method based on multi-modal feature fusion and dynamic behavior analysis, comprising: Step S1: obtaining a password text input by a user when registering or modifying a password, an environmental parameter at a corresponding time, and user identity information of the user; wherein the environmental parameter includes a login time, a geographical location of a login IP, and a device fingerprint; Step S2: performing multi-modal feature extraction based on the password text, the environmental parameter, and the user identity information; Step S3: performing vector representation on the extracted multi-modal features and a character sequence of the password text respectively, and inputting the vector representation into a pre-trained weak password prediction model based on transfer learning to obtain a password strength score; Step S4: determining a strength level of the password text based on the password strength score, and visually displaying the strength level to the user; wherein if the password text is determined to be a weak password, a modification suggestion is synchronously displayed; The step S2 includes: Step S21: calculating a password entropy value based on the password text, wherein the password entropy value includes a relative length score, a character type score, and a bigram randomness score of adjacent characters, and a calculation formula is as follows:

[0009] In the formula, represents the relative length score, represents the character type score, represents the bigram randomness score of adjacent characters, represents a character length of the password text input by the user, represents a maximum allowed length of the password text, represents a weight of a character, represents a capital letter, represents a lowercase letter, represents a number, represents a symbol, represents a number of the character, represents a character in the password text, represents a frequency of occurrence of adjacent character pairs; Step S22: determining an association degree of the password text and the user identity based on the password text input by the user and the user identity information, and a formula is as follows:

[0010]

[0011]

[0012] In the formula,​​​​ represents the user identity information , a weak password set generated by a regular template set, represents the i-th weak password in the set represents the degree of association between the password text and the user identity, represents the password text input by the user, is an indicator function, used to determine whether the password is pattern, 1 if yes, 0 if no; Step S23: based on the environmental parameters, determine the user behavior pattern, formula is:

[0013] In the formula, represents the login frequency feature, represents the login location anomaly feature, is an indicator function, and the failure rate represents the ratio of the number of login failures to the total number of logins, represents the risk score of the login IP; Step S24: based on the environmental parameters, calculate the environmental risk factor, formula is:

[0014] In the formula, represents the environmental risk factor, represents whether the login IP is a Tor anonymous network node, and the value is 0 or 1, represents the degree of deviation of the login time from the user's historical behavior, and the value is closer to 1, the higher the degree of abnormality, represents the frequency of the user changing the login device, and the value is closer to 1, the higher the frequency, represents the corresponding weight, .

[0015] Based on the above method, optionally, the weak password prediction model based on transfer learning adopts a dual-channel hybrid architecture, and the structure includes: The first channel is used to extract the local feature vector of the input vector based on the CNN network to identify continuous characters and repeated fragments; The second channel is used to extract the global semantic feature vector of the input vector based on the multi-head attention mechanism to detect semantic coherence and cultural relevance; The output layer is used to fuse the local feature vector and the global semantic feature vector, and output the password strength score and the risk label based on the fused vector.

[0016] Based on the above method, optionally, the step S4 further includes:​ Based on the pre-constructed weak password dictionary, the password text is matched to obtain a matching result, and the matching result is used to indicate whether the password text is a weak password.

[0017] Based on the above method, the step S4 specifically comprises: Based on the password strength score and the matching result, the strength level of the password text is determined and visualized to the user.

[0018] Based on the above method, optionally, further comprising: In combination with the scene characteristics of colleges and universities and real-time threat intelligence, a dynamic weak password dictionary generator is used to update the weak password dictionary, and a priority sorting algorithm is used to sort each weak password in the weak password dictionary.

[0019] Based on the above method, the dynamic weak password dictionary generator comprises: A rule engine is used to define password generation rules in the college and university scene; An incremental learning module is used to dynamically update dictionary entries and weights according to historical attack data and user feedback; A distributed computing framework uses MapReduce parallel processing to support million-level dictionary second-level updates.

[0020] Based on the above method, optionally, further comprising: Triggering secondary authentication when detecting brute force cracking attempts.

[0021] The weak password detection method based on multi-modal feature fusion and dynamic behavior analysis provided in the application has the following beneficial effects: The application innovatively introduces multi-dimensional feature extraction, including password entropy, semantic association, user historical behavior, system login frequency, etc., to improve user feature adaptation and reduce dependence on static dictionaries. In addition, through real-time interactive feedback, password strength evaluation and security recommendations can also be pushed in real time. Therefore, through the method of the application, the problems of strong dependence on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technologies can be solved, and the weak password detection accuracy and defense efficiency of colleges and universities are significantly improved, providing an efficient and easy-to-deploy password security solution for the education industry. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application. In addition, these drawings and the written description are not intended to limit the scope of the inventive concept in any way, but to illustrate the inventive concept for those skilled in the art by reference to specific embodiments.

[0023] Figure 1 This is a schematic diagram illustrating the process of a weak password detection method based on multimodal feature fusion and dynamic behavior analysis provided in one embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments of this application. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0025] This invention provides a weak password detection method based on multimodal feature fusion and dynamic behavior analysis, aiming to solve the problems of strong dependence on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technologies. This method can improve the coverage, accuracy, and real-time performance of weak password detection.

[0026] First, it should be noted that the method of this application is particularly suitable for network environments with large user groups and loose password management, such as universities and research institutions. For ease of description, the following embodiments will mainly use the university scenario as an example.

[0027] Reference Figure 1 This invention provides a weak password detection method based on multimodal feature fusion and dynamic behavior analysis. The method mainly includes the following steps: Step S1: Obtain the password text entered by the user when registering or changing the password, the environmental parameters at the corresponding time, and the user's identity information.

[0028] Among them, the environmental parameters refer to the hardware and software device environment when the user enters the password (login), including the login time, the geographical location of the login IP, and the device fingerprint.

[0029] User identity information refers to information related to a user's identity, including but not limited to name, date of birth, etc. In the context of higher education institutions, it may also include student ID, college code, and abbreviation of department, etc. In the context of enterprises, it may also include employee ID, etc.

[0030] Step S2: Extract multimodal features based on the password text, environmental parameters, and user identity information.

[0031] Specifically, the collected information can be represented as: User password text , i.e., the user password character sequence, wherein, denotes the 1st, 2nd, …, nth character.

[0032] User identity information , wherein, denotes the 1st, 2nd, …, mth information, for example, student / employee ID, name, date of birth, college code, department abbreviation, etc.

[0033] Environmental parameters , for example i.e., login time , IP address , device fingerprint .

[0034] Further, the multi-modal feature extraction in step S2 includes: Step S21: Calculate the password entropy value based on the password text. The password entropy value is used to quantify the strength of the password, and the higher the entropy value, the more complex and difficult to crack the password.

[0035] In this embodiment, the password entropy value is a three-dimensional vector, including the relative length score, the character type score, and the bigram randomness score of adjacent characters, i.e., the calculation formula is:

[0036] In the formula, denotes the relative length score, denotes the character type score, denotes the bigram randomness score of adjacent characters (based on the information entropy principle, the larger the value, the stronger the randomness), denotes the character length of the password text input by the user, denotes the maximum allowed length of the password text (set to 20 in the university scenario), denotes the weight of the th character, denotes the uppercase letter, denotes the lowercase letter, denotes the number, denotes the symbol, denotes the number of the th character, denotes the th character in the password text, denotes the frequency of occurrence of adjacent character pairs In some embodiments, That is, the weights of capital letters, small letters, numbers and symbols are 0.35, 0.15, 0.15 and 0.35 respectively.

[0037] The meaning of the above formula is as follows: For the relative length score The greater the value is, the higher the length of the user password is, and the more difficult it is to be cracked.

[0038] For the character type score The greater the value is, the higher the complexity of the user password is, and the more difficult it is to be cracked.

[0039] For the bigram randomness score of adjacent characters The greater the value is, the greater the randomness of adjacent characters in the user password is, and the more difficult it is to be cracked.

[0040] Step S22: Determine the correlation degree of the password text and the user identity based on the user input password text and the user identity information.

[0041] In practice, the greater the correlation with the user identity information is, the greater the possibility of being cracked is, for example, the first letter of the name of a user in pinyin is ls, and the birth date is 20000101, then if the user identity information is known by others, the others may try ls20000101 whether it is the password of the user. Therefore, in this step, by determining the correlation degree of the password text and the user identity, it is helpful to determine whether the user input password is a weak password in the subsequent step.

[0042] The formula of the process of determining the correlation is:

[0043]

[0044]

[0045] In the formula, represents the weak password set generated based on the user identity information by the regular template set, represents the weak password in the set, represents the correlation degree result of the password text and the user identity, , represents the user input password text, is an indicator function, which is used to determine whether the password is the mode, if yes, then 1, otherwise 0.

[0046] The above formula means that, firstly, a set of weak passwords is generated using a set of regular expression templates combined with user identity information. Then, it is determined whether the password entered by the user belongs to the set of weak passwords; if so, it indicates a higher correlation between the password text and the user's identity.

[0047] Regular expression template sets, for example: t1: College + Major + Year, weak password example "jichulc2024" t2: First letter of name + date of birth; weak password example: "ls20000101" t3: Name + Student ID + Punctuation Marks, weak password example: "lisi302JC01!" Step S23: Determine user behavior patterns based on environmental parameters.

[0048] User behavior patterns quantify abnormal user logins. In this embodiment, user behavior patterns... It is a two-dimensional vector, that is .

[0049] The formula is expressed as:

[0050] In the formula, Indicates login frequency characteristics. Indicates abnormal characteristics of the landing site. For characteristic functions, the failure rate represents the ratio of failed login attempts to the total number of login attempts (the higher the failure rate, the greater the risk to the password or account). This indicates the risk score for the login IP address.

[0051] In the above formula, login frequency characteristics Used to indicate whether the user's recent login behavior is normal. The higher the value, the more pronounced the normal behavioral characteristics of "high frequency and low failure rate".

[0052] For example, assuming a user logs in 20 times in 7 days, with a failure rate of 30% (0.3), then: = ; If the failure rate is 50%, then Attenuation to 0.56 reduce).

[0053] In addition, the landing site has unusual characteristics. This is used to characterize the abnormal login situation of the user.

[0054] Indicator function Used to determine whether the city of a user's login IP is in the list of frequently used cities: If in (normal), =0, then =0 (no risk of different places); If not (abnormal), =1, go to the next step of calculation.

[0055] Among them, for the list of commonly used cities, it refers to the "high-frequency and reliable login place set" based on the user's historical login data (for example, the user logs in to "Beijing" for a long time, and the list contains "Beijing").

[0056] The threat intelligence score (ip) refers to the risk rating of the login IP through the threat intelligence library (for example, proxy IP and attack IP marked by the malicious IP library, with a score close to 1; normal campus network IP score close to 0).

[0057] Step S24: Calculate the environmental risk factor based on the environmental parameters.

[0058] In this step, the password risk is evaluated in combination with the abnormality of the user login environment. The calculation formula of the environmental risk factor is represented as:

[0059] In the formula, represents the environmental risk factor, represents whether the login IP is a Tor anonymous network node, with a value of 0 or 1, represents the deviation of the login time from the user's historical behavior, with a value closer to 1 indicating a higher degree of abnormality, represents the frequency of the user changing the login device, with a value closer to 1 indicating a higher frequency, represents the corresponding weight, In some embodiments, The initial values are 0.65, 0.25, and 0.1, respectively, which can be adjusted according to the actual scene.

[0060] In the above formula, the password risk is evaluated in combination with the abnormality of the user login environment, including the security of the login IP, the regularity of the login time, and the frequency of device replacement, to generate a risk value between 0 and 1. The higher the value, the more suspicious the login environment, and the higher the risk of password leakage.

[0061] Through the above steps, multi-modal features can be obtained to facilitate weak password detection in subsequent steps.

[0062] Step S3: The extracted multi-modal features and character sequences of the password text are respectively represented as vectors and input into a pre-trained weak password prediction model based on transfer learning to obtain a password strength score.

[0063] In practice, weak password detection needs to cover diverse scenarios (campus, enterprise, etc.), but weak password annotation data for specific scenarios (such as new university majors or systems) is scarce, making traditional models difficult to train. Therefore, in this embodiment, a weak password prediction model based on transfer learning is used as the weak password detection model. This allows for the transfer of pre-trained knowledge from other scenarios (such as general weak password libraries and historical attack data) to new scenarios. For example, pre-training with general internet weak password data and then adapting it to the campus scenario reduces reliance on campus-specific annotation data. Furthermore, traditional static weak password dictionaries only recognize known patterns and are prone to failure when faced with new weak passwords (such as passwords incorporating new campus terminology). Through transfer learning, common features from different scenarios (such as semantic associations and character patterns) can be learned and transferred to new tasks. For example, from the "name + birthday" pattern, the recognition of campus-specific weak passwords such as "student ID + course code" can be transferred, enhancing the generalization detection of unknown weak passwords.

[0064] Therefore, transfer learning enables weak password prediction models to overcome the bottlenecks of strong data dependence, weak generalization ability, and slow iteration, upgrading from "passively matching known weak passwords" to "actively identifying unknown risks," making them more suitable for the needs of dynamic network security countermeasures. In particular, in the detection of weak passwords in situations where data is scarce and scenarios are diverse, it has become a key technology for improving detection effectiveness.

[0065] The model input consists of a vector representation of the multimodal features obtained in the preceding steps, specifically including: Multimodal feature vectors ; Password character sequence Embedded representation (Dimensions are) , For password length, (for the embedded dimension) In some embodiments, the weak password prediction model based on transfer learning employs a dual-channel hybrid architecture, the structure of which includes: The first channel is used to extract local feature vectors from the input vector based on the CNN network to identify continuous characters and repetitive segments; The second channel is used to extract the global semantic feature vector of the input vector based on the multi-head attention mechanism in order to detect semantic coherence and cultural relevance. The output layer is used to fuse local feature vectors and global semantic feature vectors, and outputs a password strength score and risk label based on the fused vector.

[0066] The model structure can be represented as: First channel (CNN):

[0067] in, denotes the local feature vector extracted by CNN; denotes the embedding representation of the password character sequence, denotes the one-dimensional convolution operation, denotes the convolution kernel length of 3, denotes the generation of 32 feature maps.

[0068] Second channel (Transformer):

[0069] wherein, denotes the global semantic feature vector extracted by the Transformer; denotes the multi-head attention mechanism, which is used to capture the long-distance dependency between password characters (used to identify hidden patterns such as keyboard path, popular word deformation).

[0070] Fusion layer:

[0071] wherein, denotes the fused feature vector, denotes the weight of the local feature vector, and the weight of the global semantic feature vector is .

[0072] Output layer:

[0073] wherein, denotes the password strength score, which is mapped to [0, 1] by the Sigmoid function . and denote the weight matrix and bias term of the output layer, respectively, denotes the input multi-modal feature vector (including password entropy, semantic correlation, environmental risk factors, etc.

[0074] Step S4: Based on the password strength score, determine the strength level of the password text, and visually display it to the user; wherein if the password text is determined to be a weak password, the modification suggestion is displayed simultaneously.

[0075] Specifically, after calculating the password strength score, the strength level of the password text can be determined. For example, strong password, medium password, weak password, etc. In this way, when the user registers / modifies the password, a visual strength indication bar (color classification and progress bar dynamic update) can be provided, which is convenient for the user to view in real time.

[0076] In addition, for weak passwords, targeted improvement suggestions can be made (such as "avoid using 'lisi20010101' type name + birthday"), thereby improving the security of user password setting.

[0077] In addition, in some embodiments, the above method can further include triggering secondary authentication when a brute force attempt is detected. Through secondary authentication, security can be further improved.

[0078] In some other embodiments, step S4 further includes: Based on the pre-constructed weak password dictionary, the password text is matched to obtain a matching result, and the matching result is used to indicate whether the password text is a weak password.

[0079] Specifically, in this step, the password text can also be matched based on the pre-constructed weak password dictionary. When the user input password text is matched from the weak password dictionary, it indicates that the password is a weak password, and the user can be prompted.

[0080] Correspondingly, step S4 specifically includes determining the strength level of the password text based on the password strength score and the matching result, and visually displaying it to the user.

[0081] That is, the strength level of the password text can be comprehensively judged according to the password strength score and the matching result, and displayed to the user.

[0082] Further, in order to improve detection accuracy and efficiency, the above method can further include: In combination with the characteristics of the university scene and real-time threat intelligence, a dynamic weak password dictionary generator is used to update the weak password dictionary, and a priority sorting algorithm is used to sort each weak password in the weak password dictionary.

[0083] In this way, by combining the actual situation and using the dynamic weak password dictionary generator to dynamically update the weak password dictionary, the accuracy and efficiency of matching detection can be improved.

[0084] In the initialization phase, the weak password dictionary includes a certain number (for example, 10k) of weak passwords with high frequency of use in practice and a leaked password library in the university scene. It can be represented as:

[0085] In addition, the dynamic weak password dictionary generator includes: A rule engine is used to define password generation rules in the university scene. It can be represented as:

[0086] Among them, represents a set of password generation rules (such as "initials of name + year", "last 6 digits of student ID", etc.) An incremental learning module is used to dynamically update the dictionary entries and weights according to historical attack data and user feedback. It can be expressed as:

[0087] wherein, represents the weak password dictionary of the day, represents the identity information (student ID, name, college, etc.) of the new user, represents a function of generating a weak password template according to the rules and the new user information .

[0088] A distributed computing framework is used to support the second-level update of ten million-level dictionaries through MapReduce parallel processing.

[0089] The weak password detection method based on multi-modal feature fusion and dynamic behavior analysis provided in the application has the following beneficial effects: The application innovatively introduces multi-dimensional feature extraction, including password entropy, semantic relevance, user historical behavior, system login frequency, etc., to improve user feature adaptation and reduce dependence on static dictionaries. In addition, through real-time interactive feedback, password strength evaluation and security suggestions can also be pushed in real time. Therefore, through the method of the application, the problems of strong dependence on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technologies can be solved, and the accuracy and defense efficiency of weak password detection in colleges and universities are significantly improved, providing an efficient and easy-to-deploy password security solution for the education industry.

[0090] It can be understood that the same or similar parts in the above embodiments can be mutually referred to, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0091] It should be noted that in the description of the application, the terms "first", "second", etc. are only used for descriptive purposes and should not be understood as indicating or implying relative importance. In addition, in the description of the application, unless otherwise specified, "a plurality of" means at least two.

[0092] It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or their combinations, can be used to implement the hardware: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0093] Those skilled in the art can understand that all or part of the steps carried out by the method of the above-mentioned embodiments can be completed by a program instructing the relevant hardware, and the program can be stored in a computer readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0094] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can exist physically independently, or two or more units can be integrated into one module. The above-mentioned integrated module can be realized in the form of hardware or in the form of a software function module. When the integrated module is realized in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium. The above-mentioned storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0095] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily mean the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0096] Although the embodiments of the present application have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments within the scope of the present application.

Claims

1. A weak password detection method based on multimodal feature fusion and dynamic behavior analysis, characterized in that, include: Step S1: Obtain the password text entered by the user when registering or changing the password, the environmental parameters at the corresponding time, and the user's identity information; wherein, the environmental parameters include login time, geographical location of login IP, and device fingerprint; Step S2: Based on the password text, environmental parameters, and user identity information, perform multimodal feature extraction; Step S3: Represent the extracted multimodal features and the character sequence of the password text into vectors, and input them into a pre-trained weak password prediction model based on transfer learning to obtain a password strength score; Step S4: Based on the password strength score, determine the strength level of the password text and display it visually to the user; if the password text is determined to be a weak password, modification suggestions are displayed simultaneously. Step S2 includes: Step S21: Calculate the password entropy value based on the password text. The password entropy value includes a relative length score, a character type score, and a randomness score for adjacent character pairs. The calculation formula is as follows: In the formula, Indicates a relative length score. Indicates character type rating. The randomness score of the binary pair representing adjacent characters. This indicates the length of the password text entered by the user. Indicates the maximum allowed length of the password text. Indicates the first The weight of each character Indicates uppercase letters, Represents lowercase letters, Representing numbers, Symbols Indicates the first The number of characters, The first character in the ciphertext One character, Indicates adjacent character pairs The frequency of occurrence; Step S22: Based on the password text entered by the user and the user's identity information, determine the correlation between the password text and the user's identity, expressed by the formula: In the formula, Indicates based on user identity information A set of weak passwords generated using regular expression template sets. Represents the first element in the set. A weak password. This indicates the correlation between the password text and the user's identity. This represents the password text entered by the user. This is an indicator function used to determine the password. Is it The value is 1 if the pattern is correct, and 0 otherwise. Step S23: Based on the environmental parameters, determine the user behavior pattern, expressed by the formula: In the formula, Indicates login frequency characteristics. Indicates abnormal characteristics of the landing site. Let be the indicator function, and represent the ratio of failed login attempts to total login attempts. This indicates a risk score for the login IP address; Step S24: Based on the environmental parameters, calculate the environmental risk factor, expressed by the formula: In the formula, Indicates environmental risk factors, This indicates whether the login IP is a Tor anonymous network node; the value is 0 or 1. This indicates the degree of deviation between the login time and the user's historical behavior; the closer the value is to 1, the higher the degree of abnormality. This indicates how frequently a user changes their login device; the closer the value is to 1, the higher the frequency. Indicates the corresponding weight. .

2. The method according to claim 1, characterized in that, The weak password prediction model based on transfer learning adopts a dual-channel hybrid architecture, the structure of which includes: The first channel is used to extract local feature vectors from the input vector based on the CNN network to identify continuous characters and repetitive segments; The second channel is used to extract the global semantic feature vector of the input vector based on the multi-head attention mechanism in order to detect semantic coherence and cultural relevance. The output layer is used to fuse the local feature vector and the global semantic feature vector, and output the password strength score and risk label based on the fused vector.

3. The method according to claim 1, characterized in that, The procedure preceding step S4 also includes: Based on a pre-built weak password dictionary, the password text is matched to obtain a matching result, which is used to indicate whether the password text is a weak password.

4. The method according to claim 3, characterized in that, Step S4 specifically includes: Based on the password strength score and the matching results, the strength level of the password text is determined and displayed visually to the user.

5. The method according to claim 3, characterized in that, Also includes: By combining the characteristics of university scenarios with real-time threat intelligence, a dynamic weak password dictionary generator is used to update the weak password dictionary, and a priority sorting algorithm is used to sort the weak passwords in the weak password dictionary.

6. The method according to claim 5, characterized in that, The dynamic weak password dictionary generator includes: A rules engine is used to define password generation rules for university settings. The incremental learning module is used to dynamically update dictionary entries and weights based on historical attack data and user feedback. The distributed computing framework uses MapReduce parallel processing and supports second-level updates of dictionaries with tens of millions of entries.

7. The method according to claim 1, characterized in that, Also includes: Two-factor authentication is triggered when a brute-force attack attempt is detected.

Images