Weak password detection method based on multi-modal feature fusion and dynamic behavior analysis

Abstract

The application provides a weak password detection method based on multi-modal feature fusion and dynamic behavior analysis. The method innovatively introduces multi-dimensional feature extraction, including password entropy, semantic correlation, user historical behavior, system login frequency, etc., to improve user feature adaptation and reduce dependence on static dictionaries. In addition, through real-time interactive feedback, password strength assessment and security recommendations can be pushed in real time. Therefore, the method of the application can solve the problems of strong dependence on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection techniques, significantly improving the accuracy and defense efficiency of weak password detection in colleges and universities, and providing an efficient and easy-to-deploy password security solution for the education industry.

Description

TECHNICAL FIELD

[0001] The application relates to a weak password detection method based on multi-modal feature fusion and dynamic behavior analysis, and belongs to the technical field of network security. BACKGROUND

[0002] A weak password generally refers to a password with a simple structure and easy to be guessed or cracked, such as a password with too few digits, too many identical characters, a single character type, or a common character combination.

[0003] Current weak password detection methods are usually based on a weak password dictionary, and static scanning tools are used to detect the password table in the password-stored file or database, or the password text is obtained by copying the application system access traffic and combined with dictionary matching. However, static scanning requires continuous full scanning of a large amount of and constantly changing user account information, which consumes a lot of performance and costs a lot, and has great limitations.

[0004] Specifically, the existing weak password detection technology has the following limitations:

[0005] Strong dependence on static dictionary: highly dependent on predefined weak password dictionary, difficult to adapt to dynamically changing password types (such as keyboard continuous characters or semantic association passwords), resulting in low detection coverage. For example, in a university environment, common weak passwords (such as 'Aa123456' or 'lisi20010101' name + birthday) are often difficult to be effectively identified due to dictionary update lag.

[0006] Insufficient user feature adaptation: user behavior patterns such as login frequency, historical behavior, and environmental parameters (such as login time and location) are not fully considered, resulting in a high false positive rate. For example, the login behavior of university students has periodicity (such as frequent login during exam week), but the existing model lacks personalized analysis of such features.

[0007] Real-time feedback is missing: the detection result is only presented as a Boolean value (strong / weak password), and there is a lack of immediate security recommendations or interactive mechanisms, making it difficult for users to dynamically correct passwords, resulting in continuous accumulation of campus network security risks. SUMMARY

[0008] The present application aims to solve the problems of strong dependence on static dictionary, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technology, and provides an intelligent weak password detection method and device based on multi-modal feature fusion and dynamic behavior analysis to improve the coverage, accuracy, and real-time performance of weak password detection.

[0009] In a first aspect, the application provides a weak password detection method based on multi-modal feature fusion and dynamic behavior analysis, comprising:

[0010] Step S1: obtaining a password text input by a user when registering or modifying a password, an environmental parameter at a corresponding time, and user identity information of the user; wherein the environmental parameter includes a login time, a geographical location of a login IP, and a device fingerprint;

[0011] Step S2: performing multi-modal feature extraction based on the password text, the environmental parameter, and the user identity information;

[0012] Step S3: performing vector representation on the extracted multi-modal features and a character sequence of the password text respectively, and inputting the vector representation into a pre-trained weak password prediction model based on transfer learning to obtain a password strength score;

[0013] Step S4: determining a strength level of the password text based on the password strength score, and visually displaying the strength level to the user; wherein if the password text is determined to be a weak password, a modification suggestion is synchronously displayed;

[0014] The step S2 includes:

[0015] Step S21: calculating a password entropy value based on the password text, wherein the password entropy value includes a relative length score, a character type score, and a bigram randomness score of adjacent characters, and a calculation formula is as follows:

[0016]

[0017] In the formula, represents the relative length score, represents the character type score, represents the bigram randomness score of adjacent characters, represents a character length of the password text input by the user, represents a maximum allowed length of the password text, represents a weight of a th character, represents a capital letter, represents a lowercase letter, represents a number, represents a symbol, represents a number of th characters, represents a th character in the password text, represents a frequency of occurrence of adjacent character pairs ;

[0018] Step S22: determining an association degree between the password text and the user identity based on the password text input by the user and the user identity information, and a formula is as follows:

[0019]

[0020]

[0021]

[0022] wherein, represents the association degree between the password text and the user identity based on the user identity information , the weak password set generated by the regular template set, represents the i-th weak password in the set , the association degree between the password text and the user identity, represents the password text input by the user, is an indicator function, used to determine whether the password is of the pattern, and is 1 if yes, otherwise 0;

[0023] Step S23: determining the user behavior pattern based on the environment parameters, and the formula is:

[0024]

[0025] wherein, represents the login frequency feature, represents the login location anomaly feature, is an indicator function, and the failure rate represents the ratio of the number of login failures to the total number of logins, represents the risk score of the login IP;

[0026] Step S24: calculating the environment risk factor based on the environment parameters, and the formula is:

[0027]

[0028] wherein, represents the environment risk factor, represents whether the login IP is a Tor anonymous network node, and the value is 0 or 1, represents the degree of deviation of the login time from the user historical behavior, and the value closer to 1 indicates a higher degree of anomaly, represents the frequency of the user changing the login device, and the value closer to 1 indicates a higher frequency, represents the corresponding weight, .

[0029] Based on the above method, optionally, the weak password prediction model based on transfer learning adopts a dual-channel hybrid architecture, and the structure includes:

[0030] The first channel is used to extract the local feature vector of the input vector based on the CNN network to identify continuous characters and repeated fragments.​​

[0031] a second channel configured to extract a global semantic feature vector of the input vector based on a multi-head attention mechanism to detect semantic coherence and cultural relevance;

[0032] an output layer configured to fuse the local feature vector and the global semantic feature vector and output a password strength score and a risk label based on the fused vector.

[0033] Based on the above method, optionally, the step S4 further comprises:

[0034] Based on the pre-constructed weak password dictionary, the password text is matched to obtain a matching result, and the matching result is used to indicate whether the password text is a weak password.

[0035] Based on the above method, optionally, the step S4 specifically comprises:

[0036] Based on the password strength score and the matching result, the strength level of the password text is determined and visualized to the user.

[0037] Based on the above method, optionally, further comprising:

[0038] In combination with the scene characteristics of colleges and universities and real-time threat intelligence, a dynamic weak password dictionary generator is used to update the weak password dictionary, and a priority sorting algorithm is used to sort each weak password in the weak password dictionary.

[0039] Based on the above method, optionally, the dynamic weak password dictionary generator comprises:

[0040] a rule engine configured to define password generation rules in the college and university scene;

[0041] an incremental learning module configured to dynamically update dictionary entries and weights according to historical attack data and user feedback;

[0042] a distributed computing framework using MapReduce parallel processing to support million-level dictionary second-level updates.

[0043] Based on the above method, optionally, further comprising:

[0044] triggering secondary authentication when a brute force cracking attempt is detected.

[0045] The weak password detection method based on multi-modal feature fusion and dynamic behavior analysis provided in the application has the following beneficial effects:

[0046] This application innovatively introduces multi-dimensional feature extraction, including password entropy, semantic relevance, user historical behavior, and system login frequency, to improve user feature adaptation and reduce reliance on static dictionaries. Furthermore, through real-time interactive feedback, it enables instant push notifications of password strength assessments and security recommendations. Therefore, the method in this application addresses the problems of strong reliance on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technologies, significantly improving the accuracy and efficiency of weak password detection and defense in higher education institutions, and providing the education sector with an efficient and easily deployable password security solution. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. Furthermore, these drawings and textual descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this application to those skilled in the art by reference to specific embodiments.

[0048] Figure 1 This is a schematic diagram illustrating the process of a weak password detection method based on multimodal feature fusion and dynamic behavior analysis provided in one embodiment of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments of this application. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0050] This invention provides a weak password detection method based on multimodal feature fusion and dynamic behavior analysis, aiming to solve the problems of strong dependence on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technologies. This method can improve the coverage, accuracy, and real-time performance of weak password detection.

[0051] First, it should be noted that the method of this application is particularly suitable for network environments with large user groups and loose password management, such as universities and research institutions. For ease of description, the following embodiments will mainly use the university scenario as an example.

[0052] Reference Figure 1 This invention provides a weak password detection method based on multimodal feature fusion and dynamic behavior analysis. The method mainly includes the following steps:

[0053] Step S1: Obtain the password text entered by the user when registering or changing the password, the environmental parameters at the corresponding time, and the user's identity information.

[0054] Among them, the environmental parameters refer to the hardware and software device environment when the user enters the password (login), including the login time, the geographical location of the login IP, and the device fingerprint.

[0055] User identity information refers to information related to a user's identity, including but not limited to name, date of birth, etc. In the context of higher education institutions, it may also include student ID, college code, and abbreviation of department, etc. In the context of enterprises, it may also include employee ID, etc.

[0056] Step S2: Extract multimodal features based on the password text, environmental parameters, and user identity information.

[0057] Specifically, the collected information can be represented as:

[0058] User password text , That is, the sequence of characters in the user password, where, This represents the 1st, 2nd, ..., nth character.

[0059] User identity information , ,in, This represents the 1st, 2nd, ..., mth piece of information, such as student ID / employee ID, name, date of birth, college code, department abbreviation, etc.

[0060] Environmental parameters ,For example Login time IP address Device fingerprint .

[0061] Furthermore, the multimodal feature extraction in step S2 includes:

[0062] Step S21: Calculate the password entropy value based on the password text. The password entropy value is used to quantify the strength of the password; the higher the entropy value, the more complex and difficult the password is to crack.

[0063] In this embodiment, the cryptographic entropy value It is a three-dimensional vector. It includes a relative length score, a character type score, and a randomness score for adjacent characters in a binary pair; that is, the calculation formula is:

[0064]

[0065] In the formula, Indicates a relative length score. Indicates character type rating. The randomness score of the binary pair representing adjacent characters (based on the principle of information entropy, the larger the value, the stronger the randomness). This indicates the length of the password text entered by the user. This indicates the maximum allowed length of the password text (set to 20 in a university setting). Indicates the first The weight of each character Indicates uppercase letters, Represents lowercase letters, Representing numbers, Symbols Indicates the first The number of characters, The first character in the ciphertext One character, Indicates adjacent character pairs The frequency of occurrence. In some embodiments, That is, the weights for uppercase letters, lowercase letters, numbers, and symbols are 0.35, 0.15, 0.15, and 0.35, respectively.

[0066] The meaning of the above formula is as follows:

[0067] For relative length scoring The larger the value, the longer the user's password, and the less likely it is to be cracked.

[0068] For character type scoring The larger the value, the more complex the user's password, and the less likely it is to be cracked.

[0069] Randomness scoring for pairs of adjacent characters The larger the value, the greater the randomness of adjacent characters in the user's password, and the less likely it is to be cracked.

[0070] Step S22: Based on the password text entered by the user and the user's identity information, determine the degree of correlation between the password text and the user's identity.

[0071] In practice, the more closely a password is related to a user's identity information, the greater the likelihood of it being cracked. For example, if a user's name begins with the initials "ls" and their birth date is "20000101," then if this user's identity information is known to someone else, they might try to see if "ls20000101" is the user's password. Therefore, in this step, determining the correlation between the password text and the user's identity helps in subsequent steps to determine whether the password entered by the user is weak.

[0072] The formula for determining correlation is expressed as:

[0073]

[0074]

[0075]

[0076] In the formula, Indicates based on user identity information A set of weak passwords generated using regular expression template sets. Represents the first element in the set. A weak password. This indicates the correlation between the password text and the user's identity. , This represents the password text entered by the user. This is an indicator function used to determine the password. Is it The pattern is 1 if it is true, and 0 otherwise.

[0077] The above formula means that, firstly, a set of weak passwords is generated using a set of regular expression templates combined with user identity information. Then, it is determined whether the password entered by the user belongs to the set of weak passwords. If it does, it indicates that the password text is more closely related to the user's identity.

[0078] Regular expression template sets, for example:

[0079] t1: College + Major + Year, weak password example "jichulc2024"

[0080] t2: First letter of name + date of birth; weak password example: "ls20000101"

[0081] t3: Name + Student ID + Punctuation Marks, weak password example: "lisi302JC01!"

[0082] Step S23: Determine user behavior patterns based on environmental parameters.

[0083] User behavior patterns quantify abnormal user logins. In this embodiment, user behavior patterns... It is a two-dimensional vector, that is .

[0084] The formula is expressed as:

[0085]

[0086] In the formula, Indicates login frequency characteristics. Indicates abnormal characteristics of the landing site. For characteristic functions, the failure rate represents the ratio of failed login attempts to the total number of login attempts (the higher the failure rate, the greater the risk to the password or account). This indicates the risk score for the login IP address.

[0087] In the above formula, login frequency characteristics Used to indicate whether the user's recent login behavior is normal. The higher the value, the more pronounced the normal behavioral characteristics of "high frequency and low failure rate".

[0088] For example, assuming a user logs in 20 times in 7 days, with a failure rate of 30% (0.3), then:

[0089] = ;

[0090] If the failure rate is 50%, then Attenuation to 0.56 reduce).

[0091] In addition, the landing site has unusual characteristics. This is used to characterize the abnormal login situation of the user.

[0092] Indicator function Used to determine whether the city of a user's login IP is in the list of frequently used cities:

[0093] If it is (normal) =0, then =0 (no risk of being relocated);

[0094] If not (abnormal) =1, proceed to the next calculation.

[0095] The list of frequently used cities refers to a "set of high-frequency and trusted login locations" built based on users' historical login data (for example, if a user logs in from "Beijing" for a long time, the list will include "Beijing").

[0096] Threat intelligence score (IP) refers to the risk rating of a login IP based on a threat intelligence database (for example, proxy IPs and attack IPs marked by the malicious IP database have a score close to 1; normal campus network IPs have a score close to 0).

[0097] Step S24: Calculate the environmental risk factor based on environmental parameters.

[0098] In this step, password risk is assessed based on the degree of anomaly in the user's login environment. The formula for calculating the environment risk factor is as follows:

[0099]

[0100] In the formula, Indicates environmental risk factors, This indicates whether the login IP is a Tor anonymous network node; the value is 0 or 1. This indicates the degree of deviation between the login time and the user's historical behavior; the closer the value is to 1, the higher the degree of abnormality. This indicates how frequently a user changes their login device; the closer the value is to 1, the higher the frequency. Indicates the corresponding weight. In some embodiments, The initial values ​​are 0.65, 0.25, and 0.1, respectively, and can be adjusted according to the actual scenario.

[0101] The formula above assesses password risk by considering the degree of anomaly in the user's login environment, including the security of the login IP, the regularity of login time, and the frequency of device changes, generating a risk value between 0 and 1. A higher value indicates a more suspicious login environment and a higher risk of password leakage.

[0102] Through the above steps, multimodal features can be obtained, which facilitates weak password detection in subsequent steps.

[0103] Step S3: Represent the extracted multimodal features and the character sequence of the ciphertext as vectors, and input them into a pre-trained weak cipher prediction model based on transfer learning to obtain a cipher strength score.

[0104] In practice, weak password detection needs to cover diverse scenarios (campus, enterprise, etc.), but weak password annotation data for specific scenarios (such as new university majors or systems) is scarce, making traditional models difficult to train. Therefore, in this embodiment, a weak password prediction model based on transfer learning is used as the weak password detection model. This allows for the transfer of pre-trained knowledge from other scenarios (such as general weak password libraries and historical attack data) to new scenarios. For example, pre-training with general internet weak password data and then adapting it to the campus scenario reduces reliance on campus-specific annotation data. Furthermore, traditional static weak password dictionaries only recognize known patterns and are prone to failure when faced with new weak passwords (such as passwords incorporating new campus terminology). Through transfer learning, common features from different scenarios (such as semantic associations and character patterns) can be learned and transferred to new tasks. For example, from the "name + birthday" pattern, the recognition of campus-specific weak passwords such as "student ID + course code" can be transferred, enhancing the generalization detection of unknown weak passwords.

[0105] Therefore, transfer learning enables weak password prediction models to overcome the bottlenecks of strong data dependence, weak generalization ability, and slow iteration, upgrading from "passively matching known weak passwords" to "actively identifying unknown risks," making them more suitable for the needs of dynamic network security countermeasures. In particular, in the detection of weak passwords in situations where data is scarce and scenarios are diverse, it has become a key technology for improving detection effectiveness.

[0106] The model input consists of a vector representation of the multimodal features obtained in the preceding steps, specifically including:

[0107] Multimodal feature vectors ;

[0108] Password character sequence Embedded representation (Dimensions are) , For password length, (for the embedded dimension)

[0109] In some embodiments, the weak password prediction model based on transfer learning employs a dual-channel hybrid architecture, the structure of which includes:

[0110] The first channel is used to extract local feature vectors from the input vector based on the CNN network to identify continuous characters and repetitive segments;

[0111] The second channel is used to extract the global semantic feature vector of the input vector based on the multi-head attention mechanism in order to detect semantic coherence and cultural relevance.

[0112] The output layer is used to fuse local feature vectors and global semantic feature vectors, and outputs a password strength score and risk label based on the fused vector.

[0113] The model structure can be represented as:

[0114] First channel (CNN):

[0115]

[0116] in, This represents the local feature vector extracted by the CNN; An embedded representation of a sequence of password characters. This represents a one-dimensional convolution operation. This indicates that the kernel length is 3. This indicates that 32 feature maps are generated.

[0117] Second channel (Transformer):

[0118]

[0119] in, This represents the global semantic feature vector extracted by the Transformer; This refers to a multi-head attention mechanism used to capture long-distance dependencies between password characters (used to identify hidden patterns, such as keyboard paths and popular word variations).

[0120] Fusion layer:

[0121]

[0122] in, This represents the fused feature vector. The weights of the local feature vectors are represented by , and the weights of the global semantic feature vectors are . .

[0123] Output layer:

[0124]

[0125] in, The password strength score is represented by the Sigmoid function. Mapped to [0,1]; and These represent the weight matrix and bias term of the output layer, respectively. This represents the input multimodal feature vector (containing features such as cryptographic entropy, semantic relevance, and environmental risk factors).

[0126] Step S4: Based on the password strength score, determine the strength level of the password text and display it visually to the user; if the password text is determined to be a weak password, modification suggestions will be displayed simultaneously.

[0127] Specifically, after calculating the password strength score, the strength level of the password text can be determined. For example, strong password, medium password, weak password, etc. Thus, a visual strength indicator bar (color-coded and dynamically updated with a progress bar) can be provided when users register / change their passwords, allowing for convenient real-time monitoring.

[0128] In addition, for weak passwords, targeted improvement suggestions can be made (such as "avoid using names + birthdays like 'lisi20010101'"), thereby improving the security of passwords set by users.

[0129] Furthermore, in some embodiments, the method may also include triggering two-factor authentication upon detecting a brute-force attack attempt. Two-factor authentication can further enhance security.

[0130] In other embodiments, the method further includes the following steps before step S4:

[0131] Based on a pre-built dictionary of weak passwords, the password text is matched to obtain the matching results, which indicate whether the password text is a weak password.

[0132] Specifically, in this step, the password text can also be matched based on a pre-built weak password dictionary. When the password text entered by the user is matched with the weak password dictionary, it indicates that the password is a weak password and the user can be prompted.

[0133] Accordingly, step S4 specifically includes: determining the strength level of the password text based on the password strength score and matching results, and visually displaying it to the user.

[0134] In other words, the strength level of the password text can be determined by combining the password strength score and the matching results, and then displayed to the user.

[0135] Furthermore, to improve detection accuracy and efficiency, the above method may also include:

[0136] By combining the characteristics of university scenarios with real-time threat intelligence, a dynamic weak password dictionary generator is used to update the weak password dictionary, and a priority sorting algorithm is used to sort the weak passwords in the weak password dictionary.

[0137] Therefore, by combining the actual situation and using a dynamic weak password dictionary generator to dynamically update the weak password dictionary, the accuracy and efficiency of matching detection can be improved.

[0138] In the initialization phase, the weak password dictionary includes a certain number (e.g., 10k) of the most frequently used weak passwords in practice, as well as leaked password databases from university settings. This can be represented as:

[0139]

[0140] In addition, dynamic weak password dictionary generators include:

[0141] A rules engine is used to define password generation rules for university settings. It can be represented as:

[0142]

[0143] in, This represents a set of rules for generating passwords (such as "first letter of name + year", "last 6 digits of student ID", etc.).

[0144] The incremental learning module dynamically updates dictionary entries and weights based on historical attack data and user feedback. This can be represented as:

[0145]

[0146] in, Indicates the first The dictionary of weak passwords in the sky This indicates the new user's identity information (student ID, name, college, etc.). Indicates according to the rules and new user information A function to generate weak password templates.

[0147] The distributed computing framework uses MapReduce parallel processing and supports second-level updates of dictionaries with tens of millions of entries.

[0148] The weak password detection method based on multimodal feature fusion and dynamic behavior analysis provided in this application has the following beneficial effects:

[0149] This application innovatively introduces multi-dimensional feature extraction, including password entropy, semantic relevance, user historical behavior, and system login frequency, to improve user feature adaptation and reduce reliance on static dictionaries. Furthermore, through real-time interactive feedback, it enables instant push notifications of password strength assessments and security recommendations. Therefore, the method in this application addresses the problems of strong reliance on static dictionaries, insufficient user feature adaptation, and lack of real-time feedback in existing weak password detection technologies, significantly improving the accuracy and efficiency of weak password detection and defense in higher education institutions, and providing the education sector with an efficient and easily deployable password security solution.

[0150] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0151] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0152] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0153] Those skilled in the art will understand that all or part of the steps of the methods implementing the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0154] Furthermore, the functional units in the various embodiments of this invention can be integrated into a single processing module, or each unit can exist physically separately, or two or more units can be integrated into a single module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The aforementioned storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0155] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0156] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A weak password detection method based on multimodal feature fusion and dynamic behavior analysis, characterized in that, include: Step S1: Obtain the password text entered by the user when registering or changing the password, the environmental parameters at the corresponding time, and the user's identity information; wherein, the environmental parameters include login time, geographical location of login IP, and device fingerprint; Step S2: Based on the password text, environmental parameters, and user identity information, perform multimodal feature extraction; Step S3: Represent the extracted multimodal features and the character sequence of the password text into vectors, and input them into a pre-trained weak password prediction model based on transfer learning to obtain a password strength score; Step S4: Based on the password strength score, determine the strength level of the password text and display it visually to the user; if the password text is determined to be a weak password, modification suggestions are displayed simultaneously. Step S2 includes: Step S21: Calculate the password entropy value based on the password text. The password entropy value includes a relative length score, a character type score, and a randomness score for adjacent character pairs. The calculation formula is as follows: In the formula, Indicates a relative length score. Indicates character type rating. The randomness score of the binary pair representing adjacent characters. This indicates the length of the password text entered by the user. Indicates the maximum allowed length of the password text. Indicates the first The weight of each character Indicates uppercase letters, Represents lowercase letters, Representing numbers, Symbols Indicates the first The number of characters, The first character in the ciphertext One character, Indicates adjacent character pairs The frequency of occurrence; Step S22: Based on the password text entered by the user and the user's identity information, determine the correlation between the password text and the user's identity, expressed by the formula: In the formula, Indicates based on user identity information A set of weak passwords generated using regular expression template sets. Represents the first element in the set. A weak password. This indicates the correlation between the password text and the user's identity. This represents the password text entered by the user. This is an indicator function used to determine the password. Is it The value is 1 if the pattern is correct, and 0 otherwise. Step S23: Based on the environmental parameters, determine the user behavior pattern, expressed by the formula: In the formula, Indicates login frequency characteristics. Indicates abnormal characteristics of the landing site. Let be the indicator function, and represent the ratio of failed login attempts to total login attempts. This indicates a risk score for the login IP address; Step S24: Based on the environmental parameters, calculate the environmental risk factor, expressed by the formula: In the formula, Indicates environmental risk factors, This indicates whether the login IP is a Tor anonymous network node; the value is 0 or 1. This indicates the degree of deviation between the login time and the user's historical behavior; the closer the value is to 1, the higher the degree of abnormality. This indicates how frequently a user changes their login device; the closer the value is to 1, the higher the frequency. Indicates the corresponding weight. .

2. The method according to claim 1, characterized in that, The weak password prediction model based on transfer learning adopts a dual-channel hybrid architecture, the structure of which includes: The first channel is used to extract local feature vectors from the input vector based on the CNN network to identify continuous characters and repetitive segments; The second channel is used to extract the global semantic feature vector of the input vector based on the multi-head attention mechanism in order to detect semantic coherence and cultural relevance. The output layer is used to fuse the local feature vector and the global semantic feature vector, and output the password strength score and risk label based on the fused vector.

3. The method according to claim 1, characterized in that, The procedure preceding step S4 also includes: Based on a pre-built weak password dictionary, the password text is matched to obtain a matching result, which is used to indicate whether the password text is a weak password.

4. The method according to claim 3, characterized in that, Step S4 specifically includes: Based on the password strength score and the matching results, the strength level of the password text is determined and displayed visually to the user.

5. The method according to claim 3, characterized in that, Also includes: By combining the characteristics of university scenarios with real-time threat intelligence, a dynamic weak password dictionary generator is used to update the weak password dictionary, and a priority sorting algorithm is used to sort the weak passwords in the weak password dictionary.

6. The method according to claim 5, characterized in that, The dynamic weak password dictionary generator includes: A rules engine is used to define password generation rules for university settings. The incremental learning module is used to dynamically update dictionary entries and weights based on historical attack data and user feedback. The distributed computing framework uses MapReduce parallel processing and supports second-level updates of dictionaries with tens of millions of entries.

7. The method according to claim 1, characterized in that, Also includes: Two-factor authentication is triggered when a brute-force attack attempt is detected.

Images