A weak password security evaluation method based on a knowledge graph and an LLM

Abstract

The present application relates to a kind of weak password security evaluation method based on knowledge graph and LLM, belong to network security technical field, including the following steps: S1, file analysis and content extraction step: obtain target file, according to file type it is mapped to corresponding analysis processor, extract text content and output as structured text data;S2, entity and relation extraction step: to the structured text data, first by regular expression detection keyword information, then input into large language model to extract entity, attribute and the relationship between entities;S3, knowledge graph construction and fusion step;S4, weak password generation step;S5, password security comparison step.The present application, by fusing knowledge graph, large language model and bloom filter technology, realize the accurate identification of weak password, comprehensive coverage and safety detection, provide more reliable security protection for digital scene.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically a method for assessing weak password security based on knowledge graphs and LLM. Background Technology

[0002] In today's deeply digitalized world, passwords, as the first line of defense in cybersecurity, are directly related to the privacy and security of personal information, corporate data, and government systems. However, weak passwords remain a prominent hidden danger in the current cybersecurity field: many users habitually set passwords based on personal information such as names and birthdays or simple character combinations. These passwords are extremely vulnerable to brute-force attacks and dictionary attacks, leading to serious security incidents such as data breaches and account theft.

[0003] Existing weak password detection technologies have significant limitations and are insufficient to meet the security protection needs of digital scenarios:

[0004] Traditional detection methods rely on fixed dictionary comparisons, which can only cover general and simple passwords and cannot adapt to weak passwords customized by users (such as password combinations that combine personal information), resulting in a high false negative rate.

[0005] Sensitive information in massive heterogeneous files (such as documents, audio and video, source code, etc.) lacks an effective integration mechanism, making it impossible to establish information associations to uncover potential weak password clues;

[0006] The same entity may have multiple name representations in different files or contexts, resulting in data fragmentation and affecting the comprehensiveness of weak password detection;

[0007] Traditional detection methods require transmitting the user's real password for comparison, which poses a risk of password leakage and does not comply with relevant privacy protection requirements.

[0008] Therefore, those skilled in the art have provided a method for assessing weak cryptography security based on knowledge graphs and LLM to address the problems mentioned in the background section. Summary of the Invention

[0009] To address the problems of high false negative rates, incomplete coverage, data fragmentation, and privacy leakage risks in existing weak password detection technologies, this invention provides a weak password security assessment method based on knowledge graphs and LLM. By integrating knowledge graphs, large language models, and Bloom filter technology, it achieves accurate identification, comprehensive coverage, and security detection of weak passwords, providing more reliable security protection for digital scenarios.

[0010] To achieve the above objectives, the present invention provides the following technical solution:

[0011] A method for assessing the security of weak passwords based on knowledge graphs and LLM includes the following steps:

[0012] S1. File parsing and content extraction steps: Obtain the target file, map it to the corresponding parsing processor according to the file type, extract the text content and output it as structured text data;

[0013] S2. Entity and Relationship Extraction Steps: For the structured text data, keyword information is first detected using regular expressions, and then input into the large language model to extract entities, attributes, and relationships between entities; the entity types include people, files, social media accounts, websites, and keys / sensitive information;

[0014] S3. Knowledge Graph Construction and Fusion Steps: Construct an initial knowledge graph based on the entities and relationships extracted in step S2; perform fusion judgment and merging on the entity nodes in the initial knowledge graph, and complete the missing attributes of the merged entities to form the fused knowledge graph.

[0015] S4. Weak password book generation steps: Based on the entity information in the fused knowledge graph, weak passwords are first generated according to the preset static password generation rules. Then, the fused knowledge graph is used as an external knowledge source and input into the large language model. The large language model infers and dynamically generates weak passwords, which are then summarized to form a weak password book.

[0016] S5. Password security comparison step: Encode the weak password book generated in step S4 using a Bloom filter to obtain a filter bit array; obtain the real password entered by the user on the client, calculate its corresponding position in the filter bit array using the same hash function and perform a query, and determine whether the real password is a potential weak password based on the query result.

[0017] As a further aspect of the present invention: In step S1, mapping the file type to the corresponding parsing processor specifically includes: determining the file format based on the file extension, file header bytes, or MIME type, and mapping it to the parsing processor corresponding to that format; the parsing processor includes a PDF parser, a DOCX parser, a text parser, a source code parser, an image parser, an audio parser, or a video parser.

[0018] As a further aspect of the present invention: in step S1, the structured text data is in JSON format, and its fields include: file name, file creation time, file format, file path, and extracted text content.

[0019] As a further aspect of the present invention: in step S3, the entity nodes are fused and merged, specifically including:

[0020] Calculate the common neighbor ratio of two entity nodes to be merged. If the common neighbor ratio is greater than or equal to a first threshold, they are directly determined to be the same entity and merged.

[0021] If the proportion of common neighbors is less than the first threshold, a fusion score is calculated based on the regular expression matching score, entity extraction confidence, and normalized number of common neighbors. If the fusion score is greater than or equal to the second threshold, they are determined to be the same entity and are merged.

[0022] As a further aspect of the present invention: the calculation formula for the fusion score is as follows:

[0023] Score = w1*R + w2*C + w3*N;

[0024] Wherein, Score is the fusion score, R is the value of the regular expression matching score, C is the entity extraction confidence score, N is the normalized number of common neighbors, and w1, w2, and w3 are preset weighting coefficients, and w1+w2+w3=1.

[0025] As a further aspect of the present invention: In step S3, the missing attributes of the merged entity are filled in by: firstly searching for the corresponding attribute value from the regular expression detection results for filling; if not found, then searching for the corresponding attribute value from the neighboring nodes of the entity, and prioritizing the use of the attribute value of the neighboring node with a confidence level higher than the preset confidence threshold for filling.

[0026] As a further aspect of the present invention: in step S4, the preset static password generation rules include the following patterns:

[0027] Based on a combination of personal information, the personal information includes name, date of birth, phone number, email address, or address;

[0028] Template patterns based on common, simple strings;

[0029] A combination pattern based on concatenating multiple personal information fields;

[0030] Transformation patterns based on character replacement, order adjustment, or addition of suffixes / prefixes to a known string.

[0031] As a further aspect of the present invention: In step S5, the weak cryptography is encoded using a Bloom filter, specifically including: pre-setting the length of the bit array and the number of hash functions; traversing each password in the weak cryptography, using multiple hash functions to calculate multiple array indices, and setting the value at the corresponding index position in the bit array to 1 to generate the filter bit array.

[0032] As a further aspect of the present invention: In step S5, determining whether the real password is a potentially weak password based on the query result specifically involves: if all corresponding positions in the queried filter array have a value of 1, then it is determined to be a potentially weak password; if at least one corresponding position has a value of 0, then it is determined to be a non-weak password.

[0033] As a further aspect of the present invention: in step S2, the keyword information includes password, username, email, birthday, address and their corresponding Chinese expressions.

[0034] Compared with the prior art, the beneficial effects of the present invention are:

[0035] High accuracy in weak password identification: It integrates the multi-source data integration capability of knowledge graphs with the dynamic reasoning generation capability of LLM, covering both traditional general weak passwords and accurately capturing personalized weak passwords combined with personal information, significantly reducing the false negative rate.

[0036] Comprehensive detection coverage: Through full file type analysis (supporting heterogeneous files such as documents, audio and video, and source code), entity merging (solving data fragmentation), and attribute completion, it enables the discovery of weak password clues in multiple scenarios and dimensions, avoiding detection blind spots.

[0037] Reliable privacy and security protection: Password comparison is performed using a Bloom filter, eliminating the need to transmit the user's real password. The judgment is completed only by querying the bit array, fundamentally eliminating the risk of password leakage and meeting privacy protection compliance requirements.

[0038] Excellent adaptability and scalability: Parameters such as entity fusion threshold and weighting coefficient can be dynamically adjusted according to the file size of the detection target. Weak password generation rules and LLM hints support flexible iteration, adapting to the security assessment needs of different digital scenarios such as individuals, enterprises, and government. Attached Figure Description

[0039] Figure 1 This is a flowchart of a weak password security assessment method based on knowledge graphs and LLM. Detailed Implementation

[0040] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0041] As mentioned in the background section of this application, research has revealed significant shortcomings in existing weak password detection technologies, including: traditional detection methods rely on fixed dictionary comparisons, which can only cover general, simple passwords and cannot adapt to user-customized weak passwords (such as password combinations combined with personal information), resulting in a high false negative rate; sensitive information in massive heterogeneous files (such as documents, audio / video, source code, etc.) lacks an effective integration mechanism, making it impossible to establish information associations to uncover potential weak password clues; the same entity may have multiple name representations in different files or contexts, causing data fragmentation and affecting the comprehensiveness of weak password detection; traditional detection requires transmitting the user's real password for comparison, posing a risk of password leakage and failing to meet relevant privacy protection compliance requirements.

[0042] To address the aforementioned shortcomings, this application discloses a weak password security assessment method based on knowledge graphs and LLM. By integrating knowledge graphs, large language models, and Bloom filter technology, it achieves accurate identification, comprehensive coverage, and security detection of weak passwords, providing more reliable security protection for digital scenarios.

[0043] The following will describe in detail, with reference to the accompanying drawings, how the solution of this application solves the above-mentioned technical problems.

[0044] Please see Figure 1 In this embodiment of the invention, a method for assessing weak password security based on knowledge graphs and LLM includes the following steps:

[0045] S1. File parsing and content extraction steps: Obtain the target file, map it to the corresponding parsing processor according to the file type, extract the text content and output it as structured text data;

[0046] S2. Entity and Relationship Extraction Steps: For structured text data, first detect keyword information using regular expressions, then input it into a large language model to extract entities, attributes, and relationships between entities; entity types include people, files, social media accounts, websites, and keys / sensitive information;

[0047] S3. Knowledge Graph Construction and Fusion Steps: Construct an initial knowledge graph based on the entities and relationships extracted in step S2; perform fusion judgment and merging on the entity nodes in the initial knowledge graph, and complete the missing attributes of the merged entities to form the fused knowledge graph.

[0048] S4. Weak password book generation steps: Based on the entity information in the fused knowledge graph, weak passwords are first generated according to the preset static password generation rules. Then, the fused knowledge graph is used as an external knowledge source and input into the large language model. The large language model infers and dynamically generates weak passwords, which are then summarized to form a weak password book.

[0049] S5. Password security comparison step: Encode the weak password book generated in step S4 using a Bloom filter to obtain a filter bit array; obtain the real password entered by the user on the client, use the same hash function to calculate its corresponding position in the filter bit array and perform a query, and determine whether the real password is a potentially weak password based on the query result.

[0050] In this embodiment, step S1, mapping a file to a corresponding parsing processor based on its type, specifically includes: determining the file format based on its extension, header bytes, or MIME type, and mapping it to the parsing processor corresponding to that format; the parsing processor includes PDF parsers, DOCX parsers, text parsers, source code parsers, image parsers, audio parsers, or video parsers. Specifically, PDF parsers, DOCX parsers, text parsers, source code parsers, and other document classes will provide corresponding Python libraries for parsing and extraction. For audio and video parsers, audio and images will be directly extracted using the corresponding parsing tools. If a video file is encountered, this application will extract images and audio frame by frame according to the video format, and then extract text from the obtained image and audio files. All extracted text will be organized into a fixed JSON format, integrated into a new JSON document based on the information in the source file. The document content includes: filename, file creation time, file format, file path, and extracted text content.

[0051] In this embodiment, step S2 specifically involves: inputting the content output in step 1, and first performing regular expression detection. This detects fields such as password, username, email, birthday, and address in the `content` field of `txt_json` (a data structure name containing text in txt and / or JSON format) and their corresponding Chinese expressions such as password, username, email, birthday, and address. The corresponding formula is:

[0052] easy_find = Regex(content);

[0053] This application constructs the following entity types for the knowledge graph: People, File, SocialAccount, Website, and Secret. Each entity type has predefined attributes. For example, People includes: name, alias, email_list, phone_list, gov_id, and confidence. Then, a large language model (LLM) is used to extract entities. Based on the logical relationships between entity types, a multi-dimensional semantic relationship mapping table is constructed, including 14 relationship patterns such as "own," "appears in," "contains," "hosted," and "disclosed." When parsing text, the LLM automatically matches entity pairs according to this relationship system and generates structured relationship instances. It strictly controls the output format and the attributes corresponding to the content through prompts. After the large model extracts entities, attributes, and relationships from the content, it is used for knowledge graph processing. The corresponding formula is expressed as follows:

[0054] LLM_find = LLM(content).

[0055] In this embodiment, step S3, which involves merging and determining entity nodes, specifically includes: calculating the common neighbor ratio of two entity nodes to be merged; if the common neighbor ratio is greater than or equal to a first threshold, they are directly determined to be the same entity and merged; if the common neighbor ratio is less than the first threshold, a fusion score is calculated based on the regular expression matching score, entity extraction confidence, and normalized common neighbor count; if the fusion score is greater than or equal to a second threshold, they are determined to be the same entity and merged. The details are as follows:

[0056] To address the issue of duplicate knowledge graph nodes caused by the same real-world object appearing with multiple different names in different files or contexts, this application first constructs an initial version of the knowledge graph based on LLM_find. Considering the potential overlap in personal information, entity merging is performed on each node in the knowledge graph. For the same entity type, the following principles are used to generate entity pairs to be merged: entities with highly similar names, entities appearing in the same file, entities with numerous relationships to nodes in the same file, and entities possessing the same regular expression rule identification anchor points (such as the same email address, the same phone number, etc.). All entity pairs meeting any of these conditions will proceed to the next step of fusion scoring calculation.

[0057] For two entity nodes A and B to be merged, let their neighbor sets be N(A) and N(B) respectively, calculate the proportion of common neighbors:

[0058] ;

[0059] When Overlap(A, B) ≥ 0.9, meaning that the common neighbors reach more than 90%, nodes A and B are directly considered to represent the same entity, without further scoring. This condition covers stable scenarios such as "the same entity appearing repeatedly across files". When the common neighbor ratio is less than 90%, this application uses a multi-factor weighted scoring model to determine whether entities need to be merged. The scoring factors include:

[0060] ① Regular expression matching and scoring;

[0061] If an entity is precisely matched during the regular expression detection phase (such as email address, phone number, ID number, etc.), the score for this item is high. Several scenarios are as follows:

[0062] The same phone number or email address appears (score 1), a weak match is detected, such as some fields being the same (score 0.5), and there is no match (0).

[0063] ② LLM output confidence level;

[0064] Output confidence values ​​∈ [0, 1], and directly use these confidence values ​​as the scoring factor.

[0065] ③ Overlapping number of neighboring entities;

[0066] Normalize the number of common neighbors:

[0067] ;

[0068] In this embodiment, the formula for calculating the fusion score is:

[0069] Score = w1*R + w2*C + w3*N;

[0070] Wherein, Score is the fusion score, R is the value representing the regular expression matching score, C is the entity extraction confidence score, N is the normalized number of common neighbors, and w1, w2, and w3 are preset weighting coefficients, where w1 + w2 + w3 = 1. A fusion threshold T is set. When Score ≥ T, A and B are considered to represent the same entity. The value of T can be set by the user. If the threshold is too large, the subsequent generation will be more complete, but the cost will increase. If it is too small, the cost will be small, but the generation will have defects. It can be dynamically adjusted according to the file size and number of the detection targets.

[0071] Next, attribute completion is performed on the entity. This application adopts a combination of two methods: first, it searches in easy_find. If the corresponding description of the entity's attribute exists, it is filled directly. If it cannot be found in easy_find, it searches for the corresponding missing attribute in the neighboring nodes. The attribute corresponding to the node with higher confidence is used first to fill in the missing attribute. If the confidence of all neighboring nodes is less than 0.85, it is filled with None. The knowledge graph obtained after the final processing is denoted as G.

[0072] In this embodiment, in step S4, the preset static password generation rules include the following patterns: a combination pattern based on personal information, including name, birthday, phone number, email address, or address; a template pattern based on common simple strings; a combination pattern based on concatenating multiple personal information fields; and a variation pattern based on replacing characters, rearranging their order, or adding suffixes / prefixes to known strings. More specifically:

[0073] First, this application formulates static password generation rules based on common weak password forms. The raw materials for generation will be extracted from a knowledge graph, which will be part of the generated codebook. The construction rules are as follows:

[0074] ① Human Habit-Related Patterns: Based on user's personal information such as name, ID card number, address, phone number, email address, and company information, common password construction methods are abstracted. For example, using the pinyin of the name plus the year (e.g., ...).<NAME_PINYIN> <year>), date of birth on ID card (e.g.<BIRTH_YYYYMMDD> (e.g., city name plus numbers).

[0075] ② User Behavior-Based Weak Passwords: These are simplified passwords commonly used by users, summarized into templates such as "lazy person's passwords" (e.g.,...).<ANY_WORD> Typical weak password structures include 123), keyboard sequences (such as qwerty), and common words plus numbers (such as password123).

[0076] ③ Multi-field combination mode: High-risk passwords are formed by concatenating multiple personal information fields, for example... <name> <birth>、<PHONE_LAST4> <name>A combination of two or three fields.

[0077] ④ Weak transformation mode of the original cipher: Simple transformations are made based on the existing cipher, such as adding a suffix (<OLD_PWD> <123> New passwords can be generated by methods such as case conversion, order reversal, and character replacement (e.g., a → @).

[0078] Next, based on the dynamic generation pattern of the large model, the knowledge graph constructed in this application will serve as a supplement to external knowledge sources, with the LLM acting as a pattern combination reasoning engine. It no longer simply fills in preset templates, but rather, based on what is mentioned in human habits:<NAME_PINYIN> <year>,<ANY_WORD> <123> Furthermore, by combining knowledge graphs with other methods, a weak codebook can be constructed.

[0079] In this embodiment, step S5, encoding the weak cryptography book using a Bloom filter, specifically includes: pre-setting the bit array length and the number of hash functions; traversing each password in the weak cryptography book, calculating multiple array indices using multiple hash functions, and setting the value at the corresponding index position in the bit array to 1 to generate a filter bit array. More specifically:

[0080] Bloom filter construction phase:

[0081] First, define the parameters, determining the size m of the Bloom filter (the length of the bit array). Then, determine the number k hash functions to use. Next, create a binary array B of length m, initializing all bits to 0. Iterate through all generated candidate weak passwords. For each weak password W:

[0082] K hash values ​​(i.e., k array indices) are calculated using k hash functions h_1, h_2, ..., h_k. The corresponding k index positions in array B are all set to 1. The final binary array B (i.e., the Bloom filter itself) and information about the k hash functions used (including their types and m values) are published or sent to the client (user).

[0083] Comparison phase:

[0084] Obtain the definitions of the Bloom filter B and k hash functions h_1, ..., h_k published by the service provider.

[0085] Calculate the real password index:

[0086] Enter the real password P_real. Calculate k hashes for P_real using the same k hash functions to obtain k index positions i_1, i_2, ..., i_k.

[0087] Query filters:

[0088] Check if all the values ​​at these k index positions in Bloom filter B are 1.

[0089] Based on the query results, the following judgments are made: If at least one index bit is 0, the password is definitely not in the weak password book, meaning the current password is not a known weak password. If all k index bits are 1, the password may be in the weak password book, and the password is considered a potentially weak password.

[0090] To further illustrate the present invention, the following describes in detail, with reference to embodiments, a weak password security assessment method based on knowledge graphs and LLM provided by the present invention. Example

[0091] The target company needs a comprehensive security assessment of the account passwords of its employees' office systems. The company has 500 employees and a large number of daily documents, including employee information registration forms, office documents, training videos, source code files, etc.

[0092] Step 1: Collect various internal documents of the company, totaling 1200 documents.

[0093] Step 2: Based on the file extension, file header, and MIME type, classify the files and map them to their respective parsers to extract the text.

[0094] Step 3: The file parser will integrate and extract the results according to the preset JSON format, generating more than 1200 corresponding txt_json files.

[0095] Step 4: Perform regular expression detection on the content field of all txt_json files to accurately identify key information such as password, phone number, email, and ID number, forming the easy_find dataset.

[0096] Step 5: According to the prompt, extract the entities and attributes of 5 types of entities from the content, and match the entities based on 14 types of relationships.

[0097] Step 6: Construct an initial knowledge graph based on the results of Step 6, which includes 520 employee entities, 1200 document entities, and 860 sensitive information entities.

[0098] Step 7: Filter out highly similar entities, such as entity pairs with the names "Zhang San" and "Zhang san", appearing in the same file, and sharing a large number of related nodes. Among them, 35 pairs of entities have an overlap(A, B) > 0.9, so they are directly judged as the same entity and merged. The remaining candidate pairs are calculated using a multi-factor weighted scoring model with a set threshold of 0.75. Finally, 48 duplicate entity pairs are merged to obtain the deduplicated knowledge graph G.

[0099] Step 8: Complete the attributes of the entity, such as the ID number of employee "Li Si" extracted from the neighbor node, with a confidence level of 0.92.

[0100] Step 9: First, generate passwords according to static rules, such as extracting employee names, birthdays, mobile phone numbers, company names, etc. from the knowledge graph, and generating weak passwords according to preset rules, such as "zhangsan1990" (name pinyin + birth year), "138XXXX1234" (mobile phone number), "Company123" (company name + numbers), "LS198805" (name initials + birthday), etc.

[0101] Step 10: Using the knowledge graph as an external knowledge source, generate personalized weak passwords through the LLM reasoning combination model, such as "zhangsan@1234" (name pinyin + character replacement + last 4 digits of mobile phone number) and "19900512Ls" (birthday + case conversion of the first letter of name), etc., and finally form a password book containing more than 8,000 weak passwords.

[0102] Step 11: Bloom Filter Construction: Set the length of the Bloom filter bit array m=100000, the number of hash functions k=3, and create a binary array B with an initial value of 0. Iterate through more than 8000 weak passwords, calculate the index using the 3 hash functions, set the corresponding position in the array to 1, and push array B and hash function information to the client.

[0103] Step 12: The employee enters their personal office system password (real password P_real). The client calculates the index using the same three hash functions and queries the corresponding position value in the Bloom filter array B. If all index bits are 1, it is determined to be a potentially weak password; if there is a 0, it is determined to be a non-weak password.

[0104] Step 13: This assessment detected a total of 136 potentially weak passwords, involving 112 employees. The types of weak passwords included combinations of personal information (such as "wangwu199503"), simple character sequences (such as "password123"), and company information related passwords (such as "FinTech2024").

[0105] This invention offers several advantages, including: 1. High accuracy in weak password identification: By integrating the multi-source data integration capabilities of knowledge graphs with the dynamic reasoning generation capabilities of LLM, it covers both traditionally common weak passwords and accurately captures personalized weak passwords combined with personal information, significantly reducing the false negative rate. 2. Comprehensive detection coverage: Through full file type analysis (supporting heterogeneous files such as documents, audio / video, and source code), entity merging (solving data fragmentation), and attribute completion, it achieves multi-scenario and multi-dimensional weak password clue mining, avoiding detection blind spots. 3. Reliable privacy and security protection: Using a Bloom filter for password comparison eliminates the need to transmit the user's real password; judgment is completed solely through bit array queries, fundamentally eliminating the risk of password leakage and meeting privacy protection compliance requirements. 4. Excellent adaptability and scalability: Parameters such as entity fusion thresholds and weighting coefficients can be dynamically adjusted according to the file size of the detection target. The weak password generation rules and LLM hints support flexible iteration, adapting to the security assessment needs of different digital scenarios such as individuals, enterprises, and government.

[0106] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.< / year> < / name> < / birth> < / name> < / year>

Claims

1. A method for assessing the security of weak passwords based on knowledge graphs and LLM, characterized in that, Includes the following steps: S1. File parsing and content extraction steps: Obtain the target file, map it to the corresponding parsing processor according to the file type, extract the text content and output it as structured text data; S2. Entity and Relationship Extraction Steps: For the structured text data, keyword information is first detected using regular expressions, and then input into the large language model to extract entities, attributes, and relationships between entities; the entity types include people, files, social media accounts, websites, and keys / sensitive information; S3. Knowledge Graph Construction and Integration Steps: Construct an initial knowledge graph based on the entities and relationships extracted in step S2; The entity nodes in the initial knowledge graph are fused and merged, and the missing attributes of the merged entities are filled in to form the fused knowledge graph. S4. Weak password book generation steps: Based on the entity information in the fused knowledge graph, weak passwords are first generated according to the preset static password generation rules. Then, the fused knowledge graph is used as an external knowledge source and input into the large language model. The large language model infers and dynamically generates weak passwords, which are then summarized to form a weak password book. S5. Password security comparison step: Encode the weak password book generated in step S4 using a Bloom filter to obtain a filter bit array; obtain the real password entered by the user on the client, calculate its corresponding position in the filter bit array using the same hash function and perform a query, and determine whether the real password is a potential weak password based on the query result.

2. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 1, characterized in that, In step S1, mapping a file to a corresponding parsing processor based on its file type specifically includes: determining the file format based on the file extension, header bytes, or MIME type, and mapping it to a parsing processor corresponding to that format; the parsing processor includes a PDF parser, a DOCX parser, a text parser, a source code parser, an image parser, an audio parser, or a video parser.

3. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 2, characterized in that, In step S1, the structured text data is in JSON format, and its fields include: file name, file creation time, file format, file path, and extracted text content.

4. The method for weak password security assessment based on knowledge graphs and LLM according to claim 3, characterized in that, In step S3, the entity nodes are fused and merged, which specifically includes: Calculate the common neighbor ratio of two entity nodes to be merged. If the common neighbor ratio is greater than or equal to a first threshold, they are directly determined to be the same entity and merged. If the proportion of common neighbors is less than the first threshold, a fusion score is calculated based on the regular expression matching score, entity extraction confidence, and normalized number of common neighbors. The regular expression matching score is divided into three cases: 1 point for complete matching of key entity information, 0.5 points for weak matching of some fields, and 0 points for no matching. If the fusion score is greater than or equal to the second threshold, they are determined to be the same entity and are merged.

5. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 4, characterized in that, The formula for calculating the fusion score is as follows: Score = w1*R + w2*C + w3*N; Wherein, Score is the fusion score, R is the value representing the regular expression matching score, with 1 point for a perfect match, 0.5 points for a weak match, and 0 points for no match, C is the entity extraction confidence score, N is the normalized number of common neighbors, and w1, w2, and w3 are preset weighting coefficients, and w1+w2+w3=1.

6. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 5, characterized in that, In step S3, the missing attributes of the merged entity are filled in as follows: the corresponding attribute value is first searched for in the regular expression detection results; if not found, the corresponding attribute value is searched for in the neighboring nodes of the entity, and the attribute value of the neighboring node with a confidence level higher than the preset confidence threshold is used for filling in the missing attributes.

7. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 6, characterized in that, In step S4, the preset static password generation rules include the following patterns: Based on a combination of personal information, the personal information includes name, date of birth, phone number, email address, or address; Template patterns based on common, simple strings; A combination pattern based on concatenating multiple personal information fields; Transformation patterns based on character replacement, order adjustment, or addition of suffixes / prefixes to a known string.

8. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 7, characterized in that, In step S5, the weak cryptography is encoded using a Bloom filter, which specifically includes: pre-setting the length of the bit array and the number of hash functions; traversing each password in the weak cryptography, calculating multiple array indices using multiple hash functions, and setting the value at the corresponding index position in the bit array to 1 to generate the filter bit array.

9. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 8, characterized in that, In step S5, the real password is determined to be a potentially weak password based on the query results. Specifically, if all corresponding positions in the queried filter array have a value of 1, it is determined to be a potentially weak password; if at least one corresponding position has a value of 0, it is determined to be a non-weak password.

10. The method for assessing weak cryptography security based on knowledge graphs and LLM according to claim 9, characterized in that, In step S2, the keyword information includes password, username, email, birthday, address, and their corresponding Chinese expressions.

Images