Method, device and electronic equipment for detecting abnormal password

Abstract

The application discloses an abnormal password detection method and device and electronic equipment. It is related to the field of information security. The method comprises the following steps: obtaining a to-be-detected password, and calculating multi-dimensional entropy feature data of the to-be-detected password, wherein the to-be-detected password is a ciphertext password; obtaining target weight values of each entropy feature, and calculating the multi-dimensional entropy feature data by using the target weight values to obtain target feature data of the to-be-detected password; inputting the target feature data into a target anomaly detection model to obtain a first detection result; obtaining scene information of the to-be-detected password, obtaining a preset password list associated with the to-be-detected password in a preset password library according to the scene information, and detecting the to-be-detected password according to the preset password list to obtain a second detection result; and determining a password state of the to-be-detected password according to the first detection result and the second detection result. Through the application, the problem of low accuracy in state detection of ciphertext passwords in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically, to a method, apparatus, and electronic device for detecting abnormal passwords. Background Technology

[0002] In video surveillance systems, the security of camera account passwords is paramount, directly impacting device access control and overall system security. Weak passwords are those that are easy to guess or crack. These passwords often follow simple patterns, such as using common words or number sequences, making them easily vulnerable to unauthorized attacks and posing a security risk.

[0003] Due to the serious security risks posed by weak passwords, it is necessary to check the password status of each user's password in order to promptly identify weak passwords and prompt users to change them, thereby improving account security.

[0004] However, traditional weak password detection methods mainly rely on plaintext comparison, that is, identifying weak passwords by comparing them with a known list of weak passwords or trying all possible password combinations. This method is inadequate when dealing with encrypted passwords because there is no direct correspondence between the encrypted data (ciphertext) and the original password (plaintext). It is impossible to directly determine the password strength through plaintext comparison, thus reducing the accuracy of password detection.

[0005] There is currently no effective solution to the problem of low accuracy in state detection of ciphertext in related technologies. Summary of the Invention

[0006] The main objective of this application is to provide a method, apparatus, and electronic device for detecting abnormal passwords, in order to solve the problem of low accuracy in state detection of ciphertext passwords in related technologies.

[0007] To achieve the above objectives, according to one aspect of this application, a method for detecting abnormal passwords is provided. The method includes: acquiring a password to be detected and calculating multidimensional entropy feature data of the password to be detected, wherein the password to be detected is a ciphertext password; acquiring target weight values ​​for each entropy feature and using the target weight values ​​to calculate the multidimensional entropy feature data to obtain target feature data of the password to be detected; inputting the target feature data into a target anomaly detection model to obtain a first detection result; acquiring scene information of the password to be detected, and based on the scene information, acquiring a preset password list associated with the password to be detected from a preset password library, and detecting the password to be detected based on the preset password list to obtain a second detection result; determining the password state of the password to be detected based on the first detection result and the second detection result, wherein the password state includes a strong password state and a weak password state.

[0008] Optionally, obtaining the password to be tested and calculating its multidimensional entropy feature data includes: obtaining preset format requirements and determining whether the password to be tested conforms to the preset format requirements; if the password to be tested conforms to the preset format requirements, determining the multidimensional entropy feature data based on the ciphertext content of the password to be tested; if the password to be tested does not conform to the preset format requirements, performing a standardization operation on the ciphertext content of the password to be tested to obtain an updated password to be tested, and determining the multidimensional entropy feature data based on the updated ciphertext content of the password to be tested. The standardization operation includes at least one of the following: unified encoding method, removal of invalid characters, outlier removal, and length standardization.

[0009] Optionally, calculating the multidimensional entropy feature data of the password to be tested includes: obtaining the frequency of each character appearing in the ciphertext content of the password to be tested, and determining the overall distribution entropy of the password to be tested based on the frequency; splitting the ciphertext content according to a preset window to obtain M sub-contents, and calculating the overall distribution entropy of each sub-content to obtain M local distribution entropies of the password to be tested, where M is a positive integer; determining the difference between each local distribution entropy and the overall distribution entropy of the password to be tested to obtain M differences, and calculating the average of the M differences to obtain the local entropy difference of the password to be tested; performing a Fourier transform on the ciphertext content to obtain frequency domain data, and determining the spectral energy probability of the frequency domain data, and determining the frequency domain entropy of the password to be tested based on the spectral energy probability; and determining the overall distribution entropy, local entropy difference, and frequency domain entropy of the password to be tested as multidimensional entropy feature data.

[0010] Optionally, obtaining the target weight value of each entropy feature includes: obtaining N sample passwords and calculating the multidimensional entropy feature data for each sample password to obtain N sets of sample feature data, where the sample passwords include positive sample passwords and negative sample passwords, and N is a positive integer; calculating the variance value of each entropy feature in the multidimensional entropy feature data, and determining the stability value of the corresponding entropy feature based on the variance value of each entropy feature; performing correlation analysis on each entropy feature to obtain the independence value of each entropy feature; obtaining the mean difference of each entropy feature in the positive sample passwords and negative sample passwords to obtain the discrimination value of each entropy feature; and determining the target weight value of each entropy feature based on the stability value, independence value, and discrimination value of each entropy feature.

[0011] Optionally, the target anomaly detection model is trained as follows: T positive sample passwords are obtained, and these T positive sample passwords are split and recombined to obtain multiple new positive sample passwords, where T is a positive integer; P negative sample passwords are obtained, and these P negative sample passwords are split and recombined to obtain multiple new negative sample passwords, where P is a positive integer; feature consistency detection is performed on each of the new positive sample passwords using the T positive sample passwords, and the multiple new positive sample passwords are filtered based on the detection results to obtain the first positive sample password that passes the feature consistency detection; feature consistency detection is performed on each of the new negative sample passwords using the P negative sample passwords, and the multiple new negative sample passwords are filtered based on the detection results to obtain the first negative sample password that passes the feature consistency detection; the T positive sample passwords, P negative sample passwords, the first positive sample password, and the first negative sample password are combined to form a sample password set, and the neural network model is trained using the sample password set to obtain the target anomaly detection model.

[0012] Optionally, the second detection result is obtained by detecting the password to be tested according to the preset password list, including: determining whether there is a target password in the preset password list whose ciphertext content is the same as the password to be tested; if there is a target password, the second detection result is determined to be that the password to be tested is abnormal; if there is no target password, the second detection result is determined to be that the password to be tested is not abnormal.

[0013] Optionally, determining the password status of the password to be tested based on the first detection result and the second detection result includes: if the second detection result indicates that the password to be tested is abnormal, determining that the password status of the password to be tested is abnormal; if the second detection result indicates that the password to be tested is not abnormal, obtaining the confidence score in the first detection result; if the confidence score is greater than a preset score, determining the detection status indicated by the first detection result as the password status; if the confidence score is less than or equal to the preset score, determining that the password status of the password to be tested is abnormal.

[0014] To achieve the above objectives, according to another aspect of this application, an anomalous password detection device is provided. The device includes: a first calculation unit for acquiring a password to be detected and calculating multidimensional entropy feature data of the password to be detected, wherein the password to be detected is a ciphertext password; a second calculation unit for acquiring target weight values ​​for each entropy feature and using the target weight values ​​to calculate the multidimensional entropy feature data to obtain target feature data of the password to be detected; a first detection unit for inputting the target feature data into a target anomaly detection model to obtain a first detection result; a second detection unit for acquiring scene information of the password to be detected, and based on the scene information, acquiring a preset password list associated with the password to be detected from a preset password library, and detecting the password to be detected based on the preset password list to obtain a second detection result; and a determination unit for determining the password state of the password to be detected based on the first and second detection results, wherein the password state includes a strong password state and a weak password state.

[0015] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, comprising a memory storing an executable program; and a processor for running the program, wherein the program executes the above-described method for detecting abnormal passwords during runtime.

[0016] To achieve the above objectives, according to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the above-described method for detecting abnormal passwords.

[0017] In this embodiment, the following steps are taken: First, obtain the password to be detected and calculate its multidimensional entropy feature data, where the password to be detected is a ciphertext password. Then, obtain the target weight values ​​for each entropy feature and use these target weight values ​​to calculate the target feature data of the multidimensional entropy feature data. Next, input the target feature data into a target anomaly detection model to obtain a first detection result. Then, obtain the scene information of the password to be detected and, based on the scene information, retrieve a preset password list associated with the password to be detected from a preset password library. Finally, detect the password to be detected based on the preset password list to obtain a second detection result. Finally, determine the password status of the password to be detected based on the first and second detection results. The method involves identifying both strong and weak password states. This is achieved by determining the multidimensional entropy feature data of the password to be tested, then using this data to determine the password's characteristic data. A first detection result is then determined based on this characteristic data, and the first and second detection results are comprehensively analyzed to obtain the password's strength or weakness. This method achieves the goal of determining the password's strength or weakness by acquiring the multidimensional entropy feature data of the ciphertext. This technical effect ensures accurate determination of the password's strength or weakness even when the password is in ciphertext, thus solving the technical problem of low accuracy in detecting the state of ciphertext passwords in related technologies. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 A hardware structure block diagram of a computer terminal for implementing an abnormal password detection method is shown.

[0020] Figure 2 This is a flowchart of the abnormal password detection method provided in Embodiment 1 of this application;

[0021] Figure 3 This is a schematic diagram of an abnormal password detection device according to Embodiment 2 of this application;

[0022] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] It should be noted that the abnormal password detection methods, devices, and electronic devices defined in this disclosure can be used in the field of information security, or in any field other than information security. The application fields of the abnormal password detection methods, devices, and electronic devices defined in this disclosure are not limited.

[0027] It should be noted that all information, user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) used in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse use. If the user chooses to refuse, the process will proceed to the expert decision-making process. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. Users can view the purpose of data use in real time through the authorization interface and have the right to withdraw authorization or delete data at any time. After the authorization is withdrawn, the system will terminate the relevant data processing within 24 hours.

[0028] The embodiments or examples disclosed herein are not exhaustive, but merely illustrative of some embodiments or examples, and are not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment or example can be arbitrarily interchanged. Furthermore, optional methods or examples in a particular embodiment or example can be arbitrarily combined; moreover, embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a particular embodiment or example can be arbitrarily combined with optional methods or examples of other embodiments or examples.

[0029] Example 1

[0030] According to an embodiment of this application, an embodiment of an abnormal password detection method is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing an abnormal password detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as microprocessors or programmable logic devices), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface, a universal serial bus port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0032] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal password detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned abnormal password detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0035] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0036] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for detecting abnormal passwords is shown. Figure 2 This is a flowchart of the abnormal password detection method provided in Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes:

[0037] Step S201: Obtain the password to be tested and calculate the multidimensional entropy feature data of the password to be tested, wherein the password to be tested is a ciphertext password.

[0038] It should be noted that the execution subject in this embodiment can be an abnormal password detection system. This system can perform status detection on the ciphertext password to determine whether the password is a weak password, i.e., an abnormal password, thereby improving the detection accuracy of the ciphertext password.

[0039] It should be noted that the password to be tested refers to the ciphertext password of the camera account in the video surveillance system under encrypted status, i.e., the ciphertext password, such as the password processed by a hash algorithm or symmetric encryption algorithm. Multidimensional entropy feature data involves the statistical distribution and randomness characteristics of the ciphertext, including parameters such as global distribution entropy, local entropy difference, and frequency domain entropy. Global distribution entropy reflects the global complexity of the ciphertext; local entropy difference describes the differences in the internal structural distribution; frequency domain entropy identifies the periodic or pattern characteristics of the ciphertext through Fourier transform, indirectly assessing the password complexity.

[0040] For example, when detecting the password status, the system first retrieves the password to be detected from the video surveillance system's database, i.e., the encrypted camera account password. Data capture, format recognition, and legality verification improve the accuracy and integrity of the ciphertext. Subsequently, the system calculates multi-dimensional entropy feature data for each password to be detected, including overall distribution entropy, local entropy difference, and frequency domain entropy. Overall distribution entropy assesses randomness by statistically analyzing the frequency distribution of each byte or character in the ciphertext, using the formula for information entropy. The more uniform the ciphertext distribution, the higher the entropy value, and the stronger the password. Local entropy difference involves sliding window segmentation of the ciphertext sequence. By comparing the entropy differences between different subsequences, potential regularities or local repetitions are identified. The smaller the entropy difference, the higher the similarity of the internal structure of the password, potentially indicating a weak password. Frequency domain entropy transforms the ciphertext to the frequency domain using Fourier transform, analyzing the distribution of its coefficients to identify obvious periodic or patterned features. Identifying such features helps distinguish ciphertexts with low complexity.

[0041] For example, assuming the ciphertext of the password to be tested is "21232f297a57a5a743894a0e4a801fc3", the system first identifies it as a 16-byte SHA-1 hash output, and then calculates its overall distribution entropy, local entropy difference, and frequency domain entropy. By analyzing the frequency distribution of characters in the ciphertext, the system finds that certain characters (such as "a" and "7") appear frequently, resulting in a low overall distribution entropy, indicating a weak password. Further calculation of the local entropy difference using a sliding window reveals that the entropy value does not change significantly in some subsequences, indicating a local repetition pattern and a weak password. Finally, through frequency domain entropy analysis, the model does not detect obvious periodic or patterned features, but the overall entropy value is still low, indicating a weak password. Therefore, the above entropy characteristics can be used as determining features for subsequent password state detection operations.

[0042] Step S202: Obtain the target weight values ​​of each entropy feature, and use the target weight values ​​to calculate the multidimensional entropy feature data to obtain the target feature data of the password to be detected.

[0043] It should be noted that the target weight value can be the quantified weight of the multidimensional entropy features, used to represent the relative importance of each entropy feature in the cryptographic strength assessment.

[0044] For example, the system can calculate the target weight values ​​of each entropy feature based on a large number of labeled ciphertext samples. These weights reflect the effectiveness and stability of each entropy feature in distinguishing between weak and strong ciphers. Furthermore, the system weights and fuses the multidimensional entropy feature data calculated in step S201 based on these weight values ​​to obtain a target feature data vector that comprehensively reflects the entropy features of the cipher to be detected. By weighting the feature confidence, when the target feature data vector is subsequently processed by the target anomaly detection model, the model can more accurately identify which entropy features are more important for detecting weak ciphers, thereby improving the accuracy and robustness of the detection results and reducing errors caused by single feature bias.

[0045] For example, when calculating target feature data, assume the target weight for the overall distribution entropy is 0.4, the weight for the local entropy difference is 0.3, and the weight for the frequency domain entropy is 0.3. The system will then use these weights to perform a weighted average of the previously calculated entropy feature values, resulting in a target feature data vector, such as [3.2×0.4, 0.5×0.3, 2.8×0.3]=[1.28, 0.15, 0.84]. This vector will serve as the input for subsequent model decisions, integrating information from multi-dimensional entropy features and improving the accuracy of the decisions.

[0046] Step S203: Input the target feature data into the target anomaly detection model to obtain the first detection result.

[0047] It should be noted that the target anomaly detection model is a trained weak password discrimination model. This model can identify abnormal features of encrypted passwords based on target feature data vectors, and determine whether they are weak or strong passwords through machine learning algorithms or deep learning techniques.

[0048] For example, the system inputs the target feature data generated in step S202 into the target anomaly detection model. Based on the classification boundary learned internally, the target anomaly detection model outputs the first detection result that the password to be detected belongs to "weak password" or "strong password", and provides the judgment confidence level to evaluate the reliability of the model results.

[0049] For example, for the feature vector [1.28, 0.15, 0.84], the model may output a classification result of "weak password" with a confidence level of 92%.

[0050] Step S204: Obtain the scene information of the password to be tested, and obtain the preset password list associated with the password to be tested from the preset password library according to the scene information, and test the password to be tested according to the preset password list to obtain the second test result.

[0051] It should be noted that scene information refers to non-cryptographic features such as the deployment environment, service type, and manufacturer information of the camera equipment. The preset password library contains a database of customized weak password dictionaries. This dictionary is generated based on the camera's deployment region, manufacturer abbreviation, and service keywords, and contains a candidate set of ciphertexts for possible weak passwords, used for comparison and analysis with the ciphertext of the password to be tested. The preset password list is a set of weak password ciphertexts selected from the preset password library and associated with the scene information of the password to be tested.

[0052] For example, after obtaining the first detection result, the system will search the preset password list that matches the password in the preset password database according to the scenario information of the password to be detected, and determine the degree of matching between the ciphertext of the password to be detected and each preset weak password in the preset password list, and obtain the second detection result.

[0053] For example, if a camera is deployed at a communication base station, the preset password database may contain "admin" or "123456". The system will compare and analyze the password to be tested. If it finds that the password is highly similar to or matches any of the above, the second detection result is that the password to be tested is a weak password.

[0054] Step S205: Determine the password status of the password to be tested based on the first detection result and the second detection result, wherein the password status includes a strong password status and a weak password status.

[0055] For example, after obtaining the first and second detection results, the system can comprehensively determine whether the password to be detected is a strong or weak password based on the first detection result determined by the model and the second detection result of dictionary matching. For instance, for the ciphertext "21232f297a57a5a743894a0e4a801fc3", the model determines it as a "weak password" with a confidence level of 92%, and the dictionary matching result is also "weak password". Based on these two consistent and high-confidence detection results, the system ultimately confirms that the password is a "weak password".

[0056] The abnormal password detection method provided in this application embodiment involves: acquiring the password to be detected and calculating its multidimensional entropy feature data, wherein the password to be detected is a ciphertext password; acquiring target weight values ​​for each entropy feature and using these target weight values ​​to calculate the multidimensional entropy feature data to obtain target feature data for the password to be detected; inputting the target feature data into a target anomaly detection model to obtain a first detection result; acquiring scene information of the password to be detected and, based on the scene information, retrieving a preset password list associated with the password to be detected from a preset password library, and detecting the password to be detected based on the preset password list to obtain a second detection result; and then, based on the first and second detection results... The method for determining the password state of the password to be tested by detecting the multidimensional entropy feature data of the password to be tested, and then determining the feature data of the password to be tested based on the multidimensional entropy feature data, and then determining the first detection result based on the feature data, and then comprehensively analyzing the first detection result and the second detection result to obtain the password strength state of the password to be tested. This achieves the goal of determining the password strength state of the password to be tested by obtaining the multidimensional entropy feature data of the ciphertext of the password to be tested, thus realizing the technical effect of accurately determining the password strength state even when the password is in ciphertext state, and thus solving the technical problem of low accuracy in the state detection of ciphertext passwords in related technologies.

[0057] To accurately determine the multidimensional entropy feature data, optionally, in the abnormal password detection method provided in this application embodiment, obtaining the password to be detected and calculating the multidimensional entropy feature data of the password to be detected includes: obtaining preset format requirements and determining whether the password to be detected conforms to the preset format requirements; if the password to be detected conforms to the preset format requirements, determining the multidimensional entropy feature data based on the ciphertext content of the password to be detected; if the password to be detected does not conform to the preset format requirements, performing a standardization operation on the ciphertext content of the password to be detected to obtain an updated password to be detected, and determining the multidimensional entropy feature data based on the updated ciphertext content of the password to be detected, wherein the standardization operation includes at least one of the following: unified encoding method, removal of invalid characters, outlier removal, and length standardization.

[0058] For example, before calculating the multidimensional entropy feature data, it is necessary to first obtain the preset format requirements and determine whether the ciphertext of the password to be tested conforms to the preset format requirements. These preset format requirements include, but are not limited to, the ciphertext encoding method, the range of valid character sets, and the data length. Subsequently, the system will perform a format check on the ciphertext to verify whether it meets the aforementioned preset format standards.

[0059] For example, suppose the preset format requirement is: ciphertext output using the SHA-256 hash algorithm, with a fixed length of 64 bytes and UTF-8 encoding. When the system imports the ciphertext "21232f297a57a5a743894a0e4a801fc3", it will first check if it is a 64-byte SHA-256 output and if the encoding is UTF-8. Since this example is only 32 bytes, it does not meet the preset length requirement, and the system will determine that its format is non-compliant.

[0060] Furthermore, for passwords conforming to the preset format requirements, the system directly calculates multidimensional entropy feature data. This process involves three main aspects: global distribution entropy, local entropy difference, and frequency domain entropy. Global distribution entropy is used to assess the global randomness of the ciphertext, local entropy difference focuses on the distribution differences within the character sequence, and frequency domain entropy identifies possible periodic or patterned features in the ciphertext through frequency domain transformation. These features together constitute the multidimensional entropy feature data of the ciphertext, providing crucial information for subsequent weak password detection.

[0061] For example, assuming the password to be detected, “a3dceb3c2c6d1c2d9e8b8a8a8a8a8a8a8”, is in the correct format, the system will calculate its overall distribution entropy, local entropy difference, and frequency domain entropy to obtain the feature vector [5.8, 2.1, 5.5].

[0062] When the system detects that the format of the password to be tested does not conform to the preset requirements, it will automatically perform standardization operations to ensure that all input data meets the same analysis standards. Standardization operations include unifying the encoding method, removing invalid characters, eliminating outliers, and standardizing the length. For example, all input ciphertexts are converted into a unified encoding format, non-standard characters are filtered out, and the length of the ciphertext is standardized to adapt to the multidimensional entropy feature extraction algorithm.

[0063] For example, for ciphertext "21232f297a57a5a743894a0e4a801fc3" that does not meet the length requirement, the system will expand or prune it to reach the preset length of 64 bytes before performing subsequent entropy feature calculations. For example, the ciphertext can be expanded by adding random padding or cyclically repeating existing characters to maintain the consistency of its statistical characteristics.

[0064] This embodiment improves the accuracy of generating multidimensional entropy feature data by detecting the password to be tested using a preset format before generating multidimensional entropy feature data, and processing the password to be tested if it does not meet the preset format requirements. This improves the accuracy of determining the password strength status based on the multidimensional entropy feature data.

[0065] To accurately calculate multidimensional entropy feature data, optionally, in the abnormal password detection method provided in this application embodiment, calculating the multidimensional entropy feature data of the password to be detected includes: obtaining the frequency of each character appearing in the ciphertext content of the password to be detected, and determining the overall distribution entropy of the password to be detected based on the frequency; splitting the ciphertext content according to a preset window to obtain M sub-contents, and calculating the overall distribution entropy of each sub-content to obtain M local distribution entropies of the password to be detected, where M is a positive integer; determining the difference between each local distribution entropy and the overall distribution entropy of the password to be detected to obtain M differences, and calculating the average of the M differences to obtain the local entropy difference of the password to be detected; performing a Fourier transform on the ciphertext content to obtain frequency domain data, and determining the spectral energy probability of the frequency domain data, and determining the frequency domain entropy of the password to be detected based on the spectral energy probability; and determining the overall distribution entropy, local entropy difference, and frequency domain entropy of the password to be detected as multidimensional entropy feature data.

[0066] It should be noted that multidimensional entropy feature data includes a set of statistical features such as global distribution entropy, local entropy difference, and frequency domain entropy, used to quantitatively evaluate the randomness and complexity of ciphertext. Global distribution entropy reflects the global distribution characteristics of the frequency of characters appearing in the ciphertext, measuring the global randomness and complexity of the cryptography. Local entropy difference assesses the variability and pattern of the internal structure of the cryptography by dividing the ciphertext into subsequences and calculating the difference between the entropy value of each subsequence and the global entropy value. Frequency domain entropy, based on the frequency domain transformation of the ciphertext, analyzes the probability distribution of spectral energy obtained from the Fourier transform to identify the existence of periodic or patterned features, indirectly evaluating the complexity of the cryptography.

[0067] For example, when determining multidimensional entropy feature data, the overall distribution entropy can first be determined. This requires counting the occurrences of each character in the password to be tested and establishing a character frequency distribution table. Based on this distribution table, the overall distribution entropy is calculated using information entropy theory. Specifically, the formula for calculating information entropy H(X) is:

[0068] H(X)=(-∑P(x)log_2(P(x)));

[0069] Here, P(x) represents the probability of a specific character x appearing at its position. The overall distribution entropy H(X) measures the randomness and complexity of the entire ciphertext sequence. The larger the entropy value, the more random the distribution of the ciphertext, meaning it is difficult to predict or crack.

[0070] For example, for the ciphertext "21232f297a57a5a743894a0e4a801fc3", the system counts the occurrence frequency of each hexadecimal character, calculates its probability P(x), and then substitutes it into the information entropy formula to obtain the overall distribution entropy. Assuming the character 'a' has the highest probability of occurrence, the calculated overall distribution entropy may be low, indicating that the ciphertext exhibits low complexity from a global perspective.

[0071] Furthermore, it is necessary to calculate the local entropy difference. This is done by using a sliding window to divide the ciphertext of the password to be tested into M subsequences. For each subsequence, the statistical and information entropy calculation process described above is repeated to obtain M local distribution entropies. The calculation of the local entropy difference aims to assess the variability and regularity of the internal structure of the ciphertext. To this end, the system first calculates the difference between the local distribution entropy of each subsequence and its overall distribution entropy, and then calculates the average of the M differences to obtain the local entropy difference of the password to be tested. A high local entropy difference indicates diversity and irregularity in the internal structure of the ciphertext; conversely, a low local entropy difference suggests the existence of easily detectable patterns or regularities, i.e., the risk of a weak cipher.

[0072] For example, the ciphertext "21232f297a57a5a743894a0e4a801fc3" is divided into eight four-byte subsequences: "2123", "2f29", "7a57", "a743", "894a", "0e4a", "801f", and "c3". The overall distribution entropy of each subsequence is calculated. Assuming the entropy of the subsequence "2123" is 2.5 and the overall distribution entropy is 3.2, the difference between the two is 0.7. Similarly, after calculating the remaining M-1 differences, the system averages these differences to obtain the local entropy difference, reflecting the entropy fluctuation of the internal structure.

[0073] Finally, the system transforms the ciphertext content from the time domain to the frequency domain and performs a Fourier transform to obtain frequency domain data. The calculation of frequency domain entropy focuses on the distribution of spectral energy. By analyzing the energy probability distribution of each frequency band in the frequency domain data, potential periodic or patterned features are identified, thereby determining the frequency domain entropy. The level of frequency domain entropy directly reflects whether the spectral energy distribution of the ciphertext is uniform; the more uniform the energy distribution, the higher the entropy value, and the higher the complexity of the cipher.

[0074] For example, for the ciphertext "21232f297a57a5a743894a0e4a801fc3", the system first converts it into frequency domain data. In the frequency domain, certain frequency bands may have higher energy probabilities, indicating the presence of some periodicity or repetition pattern in the original sequence. The system determines the frequency domain entropy by comprehensively calculating the energy probability distribution of each frequency band, thereby assessing the periodicity characteristics and complexity level of the ciphertext.

[0075] Finally, the system integrates the calculated overall distribution entropy, local entropy difference, and frequency domain entropy into multidimensional entropy feature data, constructing a feature vector that comprehensively describes the strength of the ciphertext. By analyzing and evaluating these statistical features, the system can indirectly determine the complexity and security of the ciphertext of the password under encryption without the need for decryption, effectively avoiding the security risks of password leakage.

[0076] This embodiment improves the accuracy of subsequent password strength assessment based on multidimensional entropy feature data by accurately calculating the multidimensional entropy feature data of the password, including the extraction of overall distribution entropy, local entropy difference, and frequency domain entropy. At the same time, it can also quantitatively assess the security of the password without exposing the plaintext content of the password, thereby improving the efficiency and security of password security management in video surveillance systems.

[0077] To accurately determine the target weight values ​​of each entropy feature, optionally, in the abnormal password detection method provided in this application embodiment, obtaining the target weight values ​​of each entropy feature includes: obtaining N sample passwords, and calculating the multidimensional entropy feature data of each sample password to obtain N sets of sample feature data, wherein the sample passwords include positive sample passwords and negative sample passwords, and N is a positive integer; calculating the variance value of each entropy feature in the multidimensional entropy feature data, and determining the stability value of the corresponding entropy feature based on the variance value of each entropy feature; performing correlation analysis on each entropy feature to obtain the independence value of each entropy feature; obtaining the mean difference of each entropy feature in the positive sample passwords and negative sample passwords to obtain the discrimination value of each entropy feature; and determining the target weight value of each entropy feature based on the stability value, independence value, and discrimination value of each entropy feature.

[0078] It should be noted that sample passwords refer to the set of ciphertexts used for model training and validation, including positive sample passwords (weak passwords) and negative sample passwords (strong passwords). Variance measures the dispersion of a feature's distribution within the sample password set; a smaller variance indicates a more stable feature, while a larger variance indicates greater volatility and lower stability. The stability value is calculated based on the variance of the entropy feature and represents its stability within the sample set. The independence value is derived from correlation analysis between entropy features, reflecting the independence of a particular entropy feature from other features. The discriminant value measures the mean difference between a particular entropy feature and positive sample passwords (weak passwords) and negative sample passwords (strong passwords); a high discriminant value indicates that the feature is significantly different between the two types of passwords.

[0079] For example, when determining the target weight values ​​for each entropy feature, a certain number of sample passwords must first be collected, including positive sample passwords (i.e., weak ciphertext) and negative sample passwords (i.e., strong ciphertext). Subsequently, the system preprocesses each sample password and calculates the overall distribution entropy, local entropy difference, and frequency domain entropy of each sample password.

[0080] For example, the system collected 200 sample passwords, of which 100 were known positive sample passwords (weak passwords) and 100 were known negative sample passwords (strong passwords). For each sample password, the system calculated its overall distribution entropy, local entropy difference, and frequency domain entropy in sequence according to a preset algorithm to obtain the corresponding entropy feature value.

[0081] Furthermore, the system calculates the variance of each entropy feature in the N sets of sample feature data to assess the stability of the feature. A smaller variance value indicates greater stability of the feature within the sample set and less influence from individual sample differences. Based on this, the system assigns a stability value to each entropy feature to quantify its statistical volatility. After stability assessment, the system further analyzes the correlation between entropy features to determine their independence values. The independence value reflects whether an entropy feature can independently distinguish between weak and strong ciphers; a higher value indicates stronger independence, which helps improve the model's discriminative ability and interpretability.

[0082] For example, by analyzing the correlation matrix of sample feature data, the system found a strong negative correlation between the overall distribution entropy and the frequency domain entropy, meaning that the two can predict each other to some extent, with a low degree of independence. In contrast, the frequency domain entropy has a weaker correlation with the other two features, exhibiting a higher degree of independence.

[0083] Finally, the system calculates the mean difference between positive and negative sample passwords for each entropy feature to determine its discrimination value.

[0084] Based on the above analysis results, the system will assign a target weight value to each entropy feature according to the stability value, independence value, and discrimination value, so that features with good stability, strong independence, and high discrimination will dominate in the subsequent model processing, thereby improving the accuracy of the model detection results.

[0085] For example, after considering stability, independence, and discriminative power, the system assigns a target weight value of 0.5 to the overall distribution entropy, 0.3 to the local entropy difference, and 0.2 to the frequency domain entropy, forming a target weight distribution of multidimensional entropy features to guide model training and feature fusion.

[0086] This embodiment determines the target weight value of each entropy feature, and then performs weighted processing on each parameter in the multidimensional entropy feature data according to the target weight value to obtain more accurate target feature data, thereby improving the accuracy of the detection results obtained by the subsequent detection of the target feature data by the model.

[0087] To improve the accuracy of the model output, optionally, in the abnormal password detection method provided in this application embodiment, the target anomaly detection model is trained as follows: T positive sample passwords are obtained, and the T positive sample passwords are split and recombined to obtain multiple new positive sample passwords, where T is a positive integer; P negative sample passwords are obtained, and the P negative sample passwords are split and recombined to obtain multiple new negative sample passwords, where P is a positive integer; feature consistency detection is performed on each new positive sample password using the T positive sample passwords, and the multiple new positive sample passwords are filtered according to the detection results to obtain a first positive sample password that passes the feature consistency detection; feature consistency detection is performed on each new negative sample password using the P negative sample passwords, and the multiple new negative sample passwords are filtered according to the detection results to obtain a first negative sample password that passes the feature consistency detection; the T positive sample passwords, P negative sample passwords, the first positive sample password, and the first negative sample password are combined to form a sample password set, and the sample password set is used to train the neural network model to obtain the target anomaly detection model.

[0088] It should be noted that the target anomaly detection model refers to a machine learning model used to detect weak passwords. Based on ciphertext feature enhancement and multidimensional entropy modeling, it can distinguish between the encryption outputs of weak and strong passwords. Positive sample passwords represent the encryption form of weak passwords and are used by the model to learn the feature distribution of weak passwords. Negative sample passwords represent the encryption form of strong passwords and are used by the model to learn the feature distribution of strong passwords. Feature consistency detection is used to evaluate whether the ciphertext after splitting and recombining retains similar statistical characteristics to the original positive / negative sample passwords, thereby improving the effectiveness of the enhanced samples.

[0089] For example, when training the model, a training set for model training needs to be obtained first. The system first selects T positive sample passwords (i.e., weak password encryption outputs) from the pre-labeled password samples, and then performs feature enhancement processing. These positive sample passwords are split and recombined through mechanisms such as sliding window splitting, local perturbation, and sample mixing. For example, for the weak password ciphertext sample "21232f297a57a5a743894a0e4a801fc3", the system will use a fixed window length (e.g., 8 bytes) for sliding block splitting. Then, through perturbation strategies such as byte substitution or random shifting, multiple new positive sample passwords with similar feature distributions but different structures to the original ciphertext are generated to expand the distribution range of weak password samples and improve the model's discrimination ability. The same method is used to obtain and process negative sample passwords to obtain multiple new negative sample passwords.

[0090] Furthermore, to verify the usability of the newly added ciphertext, after generating the split and recombined ciphertext samples, the system performs a feature consistency check to assess whether the new samples maintain a multidimensional entropy feature distribution similar to the original positive sample ciphertext. This check involves calculating the feature distance between the new positive sample ciphertext and the original positive sample ciphertext (i.e., the T weak ciphertexts), ensuring that the statistical characteristics of the new samples are consistent with the original samples and avoiding the introduction of biased samples. The system selects the new positive sample ciphertexts that pass the consistency check, defines them as the first positive sample ciphertext, and uses them for model training.

[0091] Similar to the positive sample passwords, the system uses feature consistency detection to filter newly added negative sample passwords, ensuring that their feature distribution remains consistent with the original negative sample passwords (i.e., the P strong ciphertexts), thus avoiding bias during model learning. Through this filtering process, the system generates the first negative sample password that matches the features of the strong password, thereby enhancing the model's ability to recognize strong passwords.

[0092] Finally, the system integrates the positive and negative sample passwords (i.e., T positive samples, P negative samples, the first positive sample, and the first negative sample) selected through consistency checks into a sample password set, which is used to train the neural network model. The neural network learns the multidimensional entropy feature data of these samples to establish a mapping relationship from ciphertext features to password strength categories, and finally trains the target anomaly detection model.

[0093] For example, the system uses a set of sample passwords—the positive sample password "21232f297a57a5a743894a0e4a8", the negative sample password "a3dceb3c2c6d1c2d9e8b8a8a8a8a"—that have passed consistency checks, along with the first positive sample password and the first negative sample password, to train a multilayer perceptron neural network model. Through iterative learning, the model gradually optimizes its weights and bias parameters to achieve efficient differentiation between weak and strong ciphertexts.

[0094] This embodiment, through feature enhancement and consistency detection, not only expands the feature distribution range of positive and negative sample passwords, but also improves the representativeness and effectiveness of newly added sample passwords, providing high-quality training data for model training. This enhances the model's discriminative ability and generalization performance, enabling it to more accurately identify and distinguish the encryption features of weak and strong passwords, and improving the accuracy of detection results.

[0095] Optionally, in the abnormal password detection method provided in this application embodiment, detecting the password to be detected according to a preset password list to obtain a second detection result includes: determining whether there is a target password in the preset password list whose ciphertext content is the same as the password to be detected; if there is a target password, determining the second detection result as the password to be detected being abnormal; if there is no target password, determining the second detection result as the password to be detected being normal.

[0096] For example, when determining the second detection result, it is first necessary to traverse each item in the preset password list and check one by one whether there is a target password that completely matches the ciphertext content of the password to be detected by using the string comparison method. Although this operation is similar to the ciphertext comparison in traditional weak password detection, there is no need to decrypt the password here, but to directly perform matching analysis in the encrypted state.

[0097] If the system finds a target password in the preset password list that exactly matches the password to be tested, the second detection result will determine that the password to be tested is abnormal, that is, the encrypted password is judged to be a weak password. This indicates that even in the encrypted state, the password may still be vulnerable to simple guessing or enumeration attacks, posing a security risk. Conversely, if the system fails to find a target password in the preset password list that matches the password to be tested, the second detection result will determine that the password to be tested is not abnormal, indicating that the encrypted password is not listed as a weak password in the current scenario, and is initially judged to be a secure or strong password.

[0098] This embodiment achieves the technical effect of accurately determining the second detection result by comparing each password in the preset password list with the password to be detected.

[0099] Optionally, in the abnormal password detection method provided in this application embodiment, determining the password state of the password to be detected based on the first detection result and the second detection result includes: if the second detection result indicates that the password to be detected is abnormal, determining that the password state of the password to be detected is abnormal; if the second detection result indicates that the password to be detected is not abnormal, obtaining the confidence score in the first detection result; if the confidence score is greater than a preset score, determining the detection state indicated by the first detection result as the password state; if the confidence score is less than or equal to the preset score, determining that the password state of the password to be detected is abnormal.

[0100] For example, when determining the final detection result, the second detection result needs to be determined first. If the second detection result indicates that the password to be tested matches the weak password candidate in the list, that is, there is a target password with the same ciphertext content, the system will immediately determine the status of the password to be tested as "abnormal" regardless of the first detection result, that is, judge it as a weak password.

[0101] If no weak password that perfectly matches the password to be tested is found in the preset password list, the system will evaluate it based on the confidence score in the first detection result. If the confidence score is greater than the preset score, the accuracy of the representation model output result is high. Therefore, the status of the password to be tested can be determined based on the first detection result. For example, if the first detection result is: the password status is a strong password and the confidence score is 100%, then the password status can be determined to be a strong password.

[0102] If the confidence score is less than or equal to the preset score, the representation model cannot determine the state of the password. Therefore, it needs to be identified as an anomaly, and the operation and maintenance department can further detect its state to improve the accuracy of the password state detection results.

[0103] This embodiment determines the final state of the password by combining the first detection result and the second detection result, thereby improving the accuracy of password state detection.

[0104] The following is an optional abnormal password detection process provided according to Embodiment 1 of this application, including:

[0105] Step 1: Import sample data of weak and strong passwords:

[0106] Based on the historical account password strength annotations, imported annotated weak and strong password ciphertext samples are used to construct a training dataset. In this step, ciphertext samples include, but are not limited to, encrypted outputs generated by hash algorithms or symmetric encryption algorithms, or password ciphertexts generated by other common encryption methods; sample annotation uses a binary category annotation method to facilitate supervised learning. To ensure sample representativeness, stratified sampling can be performed according to the source system, camera device manufacturer, region, or time period to control the ratio of weak / strong samples, forming a training set, validation set, and test set.

[0107] For ease of understanding, the following is a fictional example ciphertext to illustrate sample types and differential characteristics (the example does not represent any real system):

[0108] Weak password ciphertext samples (corresponding plaintexts are common weak passwords, such as admin1234, qwert123, etc.; specific plaintexts are not provided here): 21232f297a57a5a743894a0e4a801fc3 (This is a fictional illustrative ciphertext used to simulate the output of a weak password with low entropy and a simple pattern); 8ddcff3a80f4189ca1c9d4d902c3c909 (This is a fictional illustrative ciphertext).

[0109] Strong ciphertext samples (the corresponding plaintext is a high-complexity cipher, the specific plaintext is not provided here): a3dceb3c2c6d1c2d9e8b8a8a8a8a8a8a8 (This is a fictional illustrative ciphertext, its structure is used to simulate the output of a high-entropy, patternless strong cipher); b59c67bf196a4758191e42f76670ceba (This is a fictional illustrative ciphertext).

[0110] It should be noted that all the examples above are fictional and are not intended for any real-world scenarios or subject to any limitations.

[0111] Step 2: Preprocessing and feature enhancement of the encrypted sample:

[0112] The input ciphertext is formatted, slide-blocked, and enhanced with local perturbations to generate an expanded sample set.

[0113] In this step, normalization may include standardizing the encoding method, removing invalid characters, eliminating outliers, and length standardization through truncation or padding; sliding block segmentation divides the ciphertext sequence into segments with a fixed window length and step size to characterize the local distribution; local perturbation enhances sample diversity by byte substitution or shift transformation while maintaining the overall encryption structure; sample mixing involves randomly cross-combining segments of different ciphertexts to construct difficult examples that closely approximate the decision boundary, thereby improving the model's discriminative ability. To avoid bias introduced by enhancement, upper and lower limits can be set for the enhancement ratio, window parameters, and perturbation amplitude, and constraints can be imposed using repetition rate and reconstruction consistency indicators.

[0114] Step 3: Perform enhanced sample consistency verification:

[0115] After completing the ciphertext enhancement, feature consistency verification is performed between the expanded sample and the original sample.

[0116] In this step, the feature distance between the expanded sample and the original sample is calculated to evaluate whether the augmentation process has preserved the distribution characteristics of the original data.

[0117] In this step, the feature distance is used to reflect the degree of difference between samples in the statistical feature space, and can comprehensively consider factors such as distribution similarity, structural offset, and feature change trend. When the detection result shows that the feature deviation of the augmented sample exceeds the preset threshold, the system automatically adjusts the augmentation parameters, such as adjusting the perturbation amplitude, sliding window size, or resampling ratio, and regenerates the augmented sample to improve the statistical consistency and effectiveness of the data augmentation process.

[0118] This step avoids shifts in the distribution of sample features caused by the augmentation process, thereby improving the representativeness of training samples and the stability of model learning.

[0119] Step 4: Extract multidimensional information entropy features:

[0120] Statistical analysis was performed on the enhanced ciphertext samples to calculate the overall distribution entropy, local entropy difference, and frequency domain entropy characteristics.

[0121] In this step, the overall distribution entropy is used to reflect the global complexity of the ciphertext; the local entropy difference is used to describe the distribution differences of the internal structure of the ciphertext; and the frequency domain entropy is calculated by transforming the ciphertext sequence to the frequency domain through Fourier transform, and then calculating the information entropy of its coefficient distribution, which is used to identify periodic or pattern features.

[0122] In this step, the Z-Score normalization method can be used to standardize the scale of each entropy feature to eliminate the influence of different ciphertext lengths and value ranges on the results; for abnormal entropy values ​​that exceed the statistical distribution range (e.g., ±3 standard deviations), pruning or smoothing can be performed to improve feature stability.

[0123] Taking the weak ciphertext 21232f297a57a5a743894a0e4a801fc3 and the strong ciphertext a3dceb3c2c6d1c2d9e8b8a8a8a8a8a8a8 as examples, the multidimensional entropy feature value of their byte distribution is calculated using a sliding window. The results are as follows:

[0124] Weak ciphertext feature vector: [Overall distribution entropy: 3.2, local entropy difference: 0.5, frequency domain entropy: 2.8];

[0125] Strong ciphertext feature vector: [Overall distribution entropy: 5.8, local entropy difference: 2.1, frequency domain entropy: 5.5].

[0126] Step 5: Calculate feature confidence and perform weighted optimization:

[0127] Based on the stability, variance, and discriminative power of each entropy feature, the feature confidence weights are calculated, and the feature vectors are then weighted and fused.

[0128] In this step, feature confidence reflects the effectiveness of the feature in distinguishing between weak and strong ciphertexts; the weighted fusion process is carried out in a linear or nonlinear manner, so that high-confidence features have a greater weight in the model input, thereby improving the overall discrimination accuracy and robustness.

[0129] In this step, the model can adaptively adjust the feature weight distribution according to the output characteristics of different encryption algorithms, thereby maintaining the consistency and reliability of the detection results.

[0130] Step 6: Train the weak password discrimination model:

[0131] Using weighted optimized feature vectors and their sample labels, a weak cipher discrimination model is trained through supervised learning to establish a mapping from the ciphertext feature space to the ciphertext strength category. To balance detection efficiency and discrimination accuracy, the discrimination model is preferably implemented using a lightweight machine learning classification algorithm with low computational overhead and high interpretability, such as, but not limited to, logistic regression, support vector machines, or lightweight neural networks. Model training uses cross-entropy as the loss function for optimization, and an early stopping strategy is employed on the validation set to prevent overfitting, thereby improving the model's generalization performance and stability. After training, the model parameters and feature standardization configuration file are saved for rapid identification and reproducibility detection of unknown ciphertext samples during the detection phase.

[0132] Step 7: Import the encrypted data to be tested:

[0133] Import the encrypted account data exported from the video surveillance system, perform format recognition and standardization to ensure the encrypted data is consistent with the input during the training phase. If multiple encryption algorithms are output, first identify the output format and length characteristics, and then perform encoding conversion and length alignment according to the corresponding specifications.

[0134] Step 8: Model Decision and Confidence Output:

[0135] The ciphertext to be tested is processed in the same way as the block segmentation, feature extraction and weighting, and then input into the trained model to obtain the preliminary weak password judgment result.

[0136] Step 9: Generate a customized dictionary of weak passwords and perform matching:

[0137] A customized weak password dictionary is generated based on the deployment region, common vendor abbreviations, and business keywords, and then compared with the test accounts using this dictionary. The dictionary generation includes strategies such as keyword extraction, initial letter combination of pinyin, symbol expansion, and number concatenation; the dictionary size and matching depth can be parameterized to achieve a balance between coverage and computational overhead.

[0138] Step 10: Fuse the judgment results and output the detection conclusion:

[0139] The model's judgment results are combined with the dictionary matching results for analysis, and the final password security detection conclusion is output.

[0140] If the dictionary match is successful, the password is determined to be weak. If the dictionary match is unsuccessful, the final detection result is determined based on the confidence level of the model output. If the confidence level is greater than a preset value, such as 60%, the detection result is determined based on the model result. If the confidence level is less than or equal to the preset value, the final detection result is determined as pending and further verification is performed, such as sending it to the operations and maintenance department for verification, thereby improving the accuracy of the verification result. Table 1 shows an illustration of the verification results.

[0141] Table 1

[0142]

[0143] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0144] Example 2

[0145] This application also provides an abnormal password detection device. It should be noted that the abnormal password detection device of this application can be used to execute the abnormal password detection method provided in the above embodiments. The abnormal password detection device provided in this application will be described below.

[0146] According to an embodiment of this application, an apparatus for implementing the above-described method for detecting abnormal passwords is also provided. Figure 3 This is a schematic diagram of an abnormal password detection device according to Embodiment 2 of this application, as shown below. Figure 4 As shown, the device includes:

[0147] The first calculation unit 31 is used to obtain the password to be tested and calculate the multidimensional entropy feature data of the password to be tested, wherein the password to be tested is a ciphertext password.

[0148] The second calculation unit 32 is used to obtain the target weight values ​​of each entropy feature, and to use the target weight values ​​to calculate the multidimensional entropy feature data to obtain the target feature data of the password to be detected.

[0149] The first detection unit 33 is used to input target feature data into the target anomaly detection model to obtain the first detection result.

[0150] The second detection unit 34 is used to obtain scene information of the password to be detected, and obtain a preset password list associated with the password to be detected in the preset password library according to the scene information, and detect the password to be detected according to the preset password list to obtain a second detection result.

[0151] The determining unit 35 is used to determine the password state of the password to be detected based on the first detection result and the second detection result, wherein the password state includes a strong password state and a weak password state.

[0152] The abnormal password detection device provided in this application determines the multidimensional entropy feature data of the password to be detected, and determines the feature data of the password to be detected based on the multidimensional entropy feature data. Then, it determines the first detection result based on the feature data, and comprehensively analyzes the first detection result and the second detection result to obtain the password strength state of the password to be detected. This achieves the purpose of determining the password strength state of the password to be detected by obtaining the multidimensional entropy feature data of the ciphertext of the password to be detected. Thus, it realizes the technical effect of accurately determining the password strength state even when the password is in ciphertext state, thereby solving the technical problem of low accuracy in detecting the state of ciphertext passwords in related technologies.

[0153] Optionally, in the abnormal password detection device provided in this application embodiment, the first calculation unit 31 includes: a first judgment module, used to obtain preset format requirements and determine whether the password to be detected conforms to the preset format requirements; a first determination module, used to determine multidimensional entropy feature data based on the ciphertext content of the password to be detected if the password to be detected conforms to the preset format requirements; and a second determination module, used to perform a standardization operation on the ciphertext content of the password to be detected if the password to be detected does not conform to the preset format requirements, to obtain an updated password to be detected, and to determine multidimensional entropy feature data based on the updated ciphertext content of the password to be detected, wherein the standardization operation includes at least one of the following: encoding method unification, removal of invalid characters, outlier removal, and length standardization.

[0154] Optionally, in the abnormal password detection device provided in this application embodiment, the first calculation unit 31 includes: a first acquisition module, used to acquire the frequency of each character appearing in the ciphertext content of the password to be detected, and determine the overall distribution entropy of the password to be detected based on the frequency; a first calculation module, used to split the ciphertext content according to a preset window to obtain M sub-contents, and calculate the overall distribution entropy of each sub-content to obtain M local distribution entropies of the password to be detected, where M is a positive integer; a third determination module, used to determine the difference between each local distribution entropy and the overall distribution entropy of the password to be detected, to obtain M differences, and calculate the average of the M differences to obtain the local entropy difference of the password to be detected; a fourth determination module, used to perform Fourier transform on the ciphertext content to obtain frequency domain data, and determine the spectral energy probability of the frequency domain data, and determine the frequency domain entropy of the password to be detected based on the spectral energy probability; a fifth determination module, used to determine the overall distribution entropy, local entropy difference, and frequency domain entropy of the password to be detected as multidimensional entropy feature data.

[0155] Optionally, in the abnormal password detection device provided in this application embodiment, the second calculation unit 32 includes: a second acquisition module, used to acquire N sample passwords and calculate the multidimensional entropy feature data of each sample password to obtain N sets of sample feature data, wherein the sample passwords include positive sample passwords and negative sample passwords, and N is a positive integer; a second calculation module, used to calculate the variance value of each entropy feature in the multidimensional entropy feature data, and determine the stability value of the corresponding entropy feature based on the variance value of each entropy feature; an analysis module, used to perform correlation analysis on each entropy feature to obtain the independence value of each entropy feature; a third acquisition module, used to acquire the mean difference of each entropy feature in the positive sample passwords and negative sample passwords to obtain the discrimination value of each entropy feature; and a sixth determination module, used to determine the target weight value of each entropy feature based on the stability value, independence value, and discrimination value of each entropy feature.

[0156] Optionally, in the abnormal password detection device provided in this application embodiment, the target anomaly detection model is trained by the following devices: a first acquisition unit, used to acquire T positive sample passwords, and split and recombine the T positive sample passwords to obtain multiple new positive sample passwords, where T is a positive integer; a second acquisition unit, used to acquire P negative sample passwords, and split and recombine the P negative sample passwords to obtain multiple new negative sample passwords, where P is a positive integer; a third detection unit, used to perform feature consistency detection on each new positive sample password using the T positive sample passwords respectively, and filter the multiple new positive sample passwords according to the detection results to obtain a first positive sample password that passes the feature consistency detection; a fourth detection unit, used to perform feature consistency detection on each new negative sample password using the P negative sample passwords respectively, and filter the multiple new negative sample passwords according to the detection results to obtain a first negative sample password that passes the feature consistency detection; and a training unit, used to form a sample password set by combining the T positive sample passwords, P negative sample passwords, the first positive sample password, and the first negative sample password, and use the sample password set to train the neural network model to obtain the target anomaly detection model.

[0157] Optionally, in the abnormal password detection device provided in this application embodiment, the second detection unit 34 includes: a second judgment module, used to judge whether there is a target password in the preset password list whose ciphertext content is the same as the password to be detected; a seventh determination module, used to determine the second detection result as the password to be detected being abnormal if the target password exists; and an eighth determination module, used to determine the second detection result as the password to be detected being normal if the target password does not exist.

[0158] Optionally, in the abnormal password detection device provided in this application embodiment, the determining unit 35 includes: a ninth determining module, used to determine that the password state of the password to be detected is abnormal when the second detection result indicates that the password to be detected is abnormal; a fourth obtaining module, used to obtain the confidence score in the first detection result when the second detection result indicates that the password to be detected is not abnormal; a tenth determining module, used to determine the detection state indicated by the first detection result as the password state when the confidence score is greater than a preset score; and an eleventh determining module, used to determine that the password state of the password to be detected is abnormal when the confidence score is less than or equal to a preset score.

[0159] It should be noted that the first calculation unit 31, the second calculation unit 32, the first detection unit 33, the second detection unit 34, and the determination unit 35 mentioned above correspond to steps S201 to S205 in Embodiment 1. The instances and application scenarios implemented by each of the above units and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware components or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and can run in the computer terminal 10 provided in Embodiment 1.

[0160] Example 3

[0161] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) processor 1002, memory 1004, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0162] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0163] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0164] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0165] Example 4

[0166] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal password detection method provided in Embodiment 1.

[0167] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0168] Embodiments of this application also provide a computer program product, which, when executed on a data processing device, is adapted to perform the steps of an abnormal password detection method.

[0169] Embodiments of this application also provide a computer-readable storage medium, which includes a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to execute the above-described abnormal password detection method.

[0170] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0171] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0172] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0173] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0174] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0175] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0176] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting abnormal passwords, characterized in that, include: Obtain the password to be tested and calculate the multidimensional entropy feature data of the password to be tested, wherein the password to be tested is a ciphertext password; Obtain the target weight values ​​of each entropy feature, and use the target weight values ​​to calculate the multidimensional entropy feature data to obtain the target feature data of the password to be detected; The target feature data is input into the target anomaly detection model to obtain the first detection result; Obtain the scenario information of the password to be tested, and obtain a preset password list associated with the password to be tested from the preset password library according to the scenario information, and test the password to be tested according to the preset password list to obtain a second test result; The password state of the password to be tested is determined based on the first detection result and the second detection result, wherein the password state includes a strong password state and a weak password state; Calculating the multidimensional entropy feature data of the password to be tested includes: obtaining the frequency of each character appearing in the ciphertext content of the password to be tested, and determining the overall distribution entropy of the password to be tested based on the frequency; splitting the ciphertext content according to a preset window to obtain M sub-contents, and calculating the overall distribution entropy of each sub-content to obtain M local distribution entropies of the password to be tested, where M is a positive integer; determining the difference between each local distribution entropy and the overall distribution entropy of the password to be tested to obtain M differences, and calculating the average of the M differences to obtain the local entropy difference of the password to be tested; performing a Fourier transform on the ciphertext content to obtain frequency domain data, and determining the spectral energy probability of the frequency domain data, and determining the frequency domain entropy of the password to be tested based on the spectral energy probability; and determining the overall distribution entropy, the local entropy difference, and the frequency domain entropy of the password to be tested as the multidimensional entropy feature data.

2. The method according to claim 1, characterized in that, Obtaining the password to be detected and calculating its multidimensional entropy feature data includes: Obtain the preset format requirements and determine whether the password to be tested conforms to the preset format requirements; If the password to be tested conforms to the preset format requirements, the multidimensional entropy feature data is determined based on the ciphertext content of the password to be tested. If the password to be tested does not meet the preset format requirements, the ciphertext content of the password to be tested is standardized to obtain an updated password to be tested, and the multidimensional entropy feature data is determined based on the ciphertext content of the updated password to be tested. The standardization operation includes at least one of the following: unified encoding method, removal of invalid characters, removal of outliers, and length standardization.

3. The method according to claim 1, characterized in that, Obtaining the target weight values ​​for each entropy feature includes: Obtain N sample passwords and calculate the multidimensional entropy feature data for each sample password to obtain N sets of sample feature data, wherein the sample passwords include positive sample passwords and negative sample passwords, and N is a positive integer; Calculate the variance of each entropy feature in the multidimensional entropy feature data, and determine the stability value of the corresponding entropy feature based on the variance of each entropy feature; Correlation analysis was performed on each entropy feature to obtain the independence value of each entropy feature; The mean difference of each entropy feature in the positive sample password and the negative sample password is obtained to obtain the discrimination value of each entropy feature; The target weight value for each entropy feature is determined based on the stability value, independence value, and distinguishability value of each entropy feature.

4. The method according to claim 1, characterized in that, The target anomaly detection model is trained in the following manner: Obtain T positive sample passwords, and then split and recombine the T positive sample passwords to obtain multiple new positive sample passwords, where T is a positive integer; Obtain P negative sample passwords, and split and recombine the P negative sample passwords to obtain multiple new negative sample passwords, where P is a positive integer; The T positive sample passwords are used to perform feature consistency detection on each newly added positive sample password, and the multiple newly added positive sample passwords are filtered according to the detection results to obtain the first positive sample password that passes the feature consistency detection. The P negative sample passwords are used to perform feature consistency detection on each newly added negative sample password, and the multiple newly added negative sample passwords are filtered according to the detection results to obtain the first negative sample password that passes the feature consistency detection. The T positive sample passwords, the P negative sample passwords, the first positive sample password, and the first negative sample password are combined to form a sample password set, and the neural network model is trained using the sample password set to obtain the target anomaly detection model.

5. The method according to claim 1, characterized in that, The password to be tested is tested according to the preset password list, and the second test result includes: Determine whether there is a target password in the preset password list whose ciphertext content is the same as the password to be detected; If the target password exists, the second detection result will be determined as the password to be detected being abnormal; If the target password does not exist, the second detection result is determined to mean that the password to be detected is normal.

6. The method according to claim 1, characterized in that, Determining the password status of the password to be detected based on the first detection result and the second detection result includes: If the second detection result indicates that the password to be detected is abnormal, the password status of the password to be detected is determined to be abnormal; If the second detection result indicates that the password to be detected is normal, obtain the confidence score in the first detection result; If the confidence score is greater than a preset score, the detection state indicated by the first detection result is determined as the password state; If the confidence score is less than or equal to the preset score, the password status of the password to be tested is determined to be abnormal.

7. A device for detecting abnormal passwords, characterized in that, include: The first computing unit is used to acquire the password to be tested and to calculate the multidimensional entropy feature data of the password to be tested, wherein the password to be tested is a ciphertext password; The second calculation unit is used to obtain the target weight value of each entropy feature, and use the target weight value to calculate the multidimensional entropy feature data to obtain the target feature data of the password to be detected; The first detection unit is used to input the target feature data into the target anomaly detection model to obtain the first detection result; The second detection unit is used to obtain the scene information of the password to be detected, and obtain a preset password list associated with the password to be detected in a preset password library according to the scene information, and detect the password to be detected according to the preset password list to obtain a second detection result. A determining unit is configured to determine the password state of the password to be detected based on the first detection result and the second detection result, wherein the password state includes a strong password state and a weak password state; The first calculation unit includes: a first acquisition module, used to acquire the frequency of each character in the ciphertext content of the password to be tested, and determine the overall distribution entropy of the password to be tested based on the frequency; a first calculation module, used to split the ciphertext content according to a preset window to obtain M sub-contents, and calculate the overall distribution entropy of each sub-content to obtain M local distribution entropies of the password to be tested, where M is a positive integer; a third determination module, used to determine the difference between each local distribution entropy and the overall distribution entropy of the password to be tested, to obtain M differences, and calculate the average of the M differences to obtain the local entropy difference of the password to be tested; a fourth determination module, used to perform Fourier transform on the ciphertext content to obtain frequency domain data, and determine the spectral energy probability of the frequency domain data, and determine the frequency domain entropy of the password to be tested based on the spectral energy probability; and a fifth determination module, used to determine the overall distribution entropy, local entropy difference, and frequency domain entropy of the password to be tested as multidimensional entropy feature data.

8. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the abnormal password detection method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the abnormal password detection method according to any one of claims 1 to 6.

Images