Intranet security defense method and system based on weak password linkage risk

Abstract

The invention discloses an intranet security defense method and system based on weak password linkage risk. The method comprises the following steps: performing weak password risk identification including account enumeration vulnerability detection, weak password dictionary attack simulation and password strategy compliance check on a boundary system, and generating a risk level report; performing high-risk function scanning, system version checking and patch checking vulnerability detection on the risk boundary system, and performing association evaluation based on the detected vulnerability and the identified weak password risk; intranet transverse movement behavior monitoring including springboard host recognition, abnormal access detection, sensitive information leakage monitoring and transverse penetration behavior recognition is carried out for the risk boundary system; and carrying out linkage defense response including real-time blocking, voucher security reinforcement, intranet access control and emergency response report aiming at a weak password linkage attack event. By constructing a full-link closed-loop defense system, the security linkage of internal and external networks is improved, and the vulnerability recognition precision and the active defense capability are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an intranet security defense method and system based on the risk of weak password cascading attacks. Background Technology

[0002] In network attack and defense confrontations, weak passwords, as the most basic and frequently occurring security vulnerabilities, often become the initial entry point for attackers to breach internal network defenses. After gaining access to boundary systems using weak passwords, attackers often further exploit unpatched vulnerabilities in those systems to escalate privileges, using them as springboards to move laterally within the internal network, infiltrate core business systems, steal sensitive data, and ultimately cause the serious consequence of "one point lost, the entire domain compromised."

[0003] Currently, existing defense technologies against such chain attacks have significant limitations, mainly in the following aspects: First, weak password detection is mostly limited to single systems or static list comparisons, lacking linkage analysis and risk correlation with perimeter system vulnerabilities; second, existing technologies lack the ability to monitor and perceive the entire chain of subsequent chain attacks triggered by weak password breaches, resulting in blind spots in defense; third, perimeter protection and internal network security measures are usually isolated and fragmented, making it difficult to form a coordinated response and closed-loop defense at different stages of the attack chain. Furthermore, in the vulnerability detection stage, traditional system version identification methods heavily rely on explicit identifiers, such as version numbers in HTTP response headers and system configuration file information. This information is easily tampered with or hidden by attackers, leading to inaccurate judgments of older systems and their known vulnerabilities, thus causing subsequent risk assessments and patching to be based on errors.

[0004] Therefore, there is an urgent need for a systematic defense solution that can proactively identify the chain of risks caused by weak passwords, cover the entire attack chain from the perimeter to the internal network, and has the ability to accurately identify system versions, so as to effectively curb global security incidents caused by weak password risks. Summary of the Invention

[0005] The embodiments of this application provide an intranet security defense method and apparatus based on weak password chain risks, so as to enhance the full attack link defense capability from the boundary to the intranet and improve the system version and vulnerability identification capability.

[0006] To address the aforementioned technical problems, embodiments of this application disclose the following technical solutions: Firstly, an intranet security defense method based on weak password cascading risks is provided, comprising: identifying weak password risks in boundary systems and generating risk level reports based on risky boundary systems; performing vulnerability detection on the risky boundary systems and conducting correlation assessments based on the detected vulnerabilities and identified weak password risks; monitoring intranet lateral movement behavior in the risky boundary systems to identify weak password cascading attack events; and implementing coordinated defense responses to the weak password cascading attack events.

[0007] Furthermore, the weak password risk identification includes at least one of account enumeration vulnerability detection, weak password dictionary attack simulation, and password policy compliance check. When the boundary system is identified with at least one weak password risk, the boundary system is marked as a risky boundary. The account enumeration vulnerability detection includes dynamically testing the login interface of the boundary system by enumerating different account password combinations, and identifying enumeration account vulnerabilities based on the differentiated prompts in the system's returned information. The weak password dictionary attack simulation includes automatically detecting weak passwords in the boundary system based on common usernames and customized dictionaries, and recording successfully logged-in accounts and their permission levels. The password policy compliance check includes verifying whether the boundary system enforces password complexity and a regular password change mechanism, and marking accounts that do not comply with the security policy.

[0008] Furthermore, the vulnerability detection includes high-risk function scanning, which includes scanning the permission function points of the risk boundary system and detecting whether there are permission function vulnerabilities; the permission function points include at least file upload and system configuration modification, and the permission function vulnerabilities include at least missing file type verification and traversable upload paths; when the permission function vulnerabilities exist, the result of the correlation assessment is marked as a combined risk.

[0009] Furthermore, the vulnerability detection includes system version verification, which involves identifying the system version of the risk boundary system through a multi-source heterogeneous feature fusion mechanism. This multi-source heterogeneous feature fusion mechanism includes: passively collecting network communication traffic of the risk boundary system, extracting TCP / IP stack features and application layer protocol fingerprints, and comparing them with a pre-built version and protocol feature mapping library to initially narrow down the system version range; analyzing the digital signature timestamp, compilation time, and hash value of the core executable file of the risk boundary system, combining this with the developer's version release cycle to reverse-engineer the system version, and using version information of pre-installed third-party components for auxiliary verification; sending non-destructive probe requests for specific historical vulnerabilities to the risk boundary system, refining version judgment based on differences in its response behavior; constructing a machine learning classification model based on system samples of known versions, and performing dynamic fingerprint learning and version identification on new or customized systems, wherein the features used for model training include the system's protocol features, file metadata, and vulnerability responses.

[0010] Furthermore, the vulnerability detection includes patch verification, wherein the patch verification includes: comparing the system version identified by the system version verification with the vulnerability database; determining whether the system version is an old and unupgraded version based on the comparison results, and checking whether there are any known privilege escalation vulnerabilities.

[0011] Furthermore, the intranet lateral movement behavior monitoring includes at least one of the following: jump host identification, abnormal access detection, sensitive information leakage monitoring, and lateral penetration behavior identification. The jump host identification includes identifying border servers with both public and internal network interface cards (NICs) through traffic analysis, and monitoring the internal IP address range and database port openness of the border server. The abnormal access detection includes monitoring intranet scanning behavior initiated from the jump host and recording the accessed IP, port, and protocol type. The intranet scanning behavior includes batch port probing and live host probing. The sensitive information leakage monitoring includes scanning the local files of the jump host's server to detect the presence of sensitive information, including plaintext database account passwords and intranet system credentials. The lateral penetration behavior identification includes monitoring abnormal database logins and cross-system authentication. The abnormal database login includes the first access to the database from the jump host, and the cross-system authentication includes logging in from a single sign-on system using acquired sensitive information.

[0012] Furthermore, the coordinated defense response includes at least one of real-time blocking, credential security hardening, intranet access control, and emergency response reporting. The real-time blocking includes: temporarily locking accounts or limiting login frequency when weak password risks are identified; isolating and blocking the execution of malicious files uploaded using vulnerabilities when malicious files are detected; and temporarily blocking intranet access connections through firewall rules when lateral movement within the intranet is detected. Credential security hardening includes: automatically prompting for encrypted storage of sensitive information; forcing password changes and enabling two-factor authentication for accounts logging in with weak passwords or leaked sensitive information. Intranet access control includes: automatically generating access control policies based on the intranet topology of the risk boundary system; and restricting direct communication between jump hosts and intranet databases and single sign-on systems to implement network segmentation isolation.

[0013] Furthermore, the emergency response report includes generating a chain attack event report based on the weak password chain attack event and providing targeted remediation suggestions; the chain attack event report includes at least the source of the weak password, the vulnerability exploitation path, the scope of internal network penetration, and a list of damaged assets.

[0014] Secondly, an intranet security defense system based on weak password cascading risks is provided, characterized by comprising: a weak password risk identification module, used to identify weak password risks in the boundary system and generate a risk level report based on the risky boundary system; a vulnerability detection and correlation module, used to perform vulnerability detection on the risky boundary system and perform correlation assessment based on the detected vulnerabilities and the identified weak password risks; an intranet behavior monitoring module, used to monitor lateral movement behavior in the intranet for the risky boundary system to identify weak password cascading attack events; and a coordinated defense response module, used to perform coordinated defense response to the weak password cascading attack events. The weak password risk identification module is configured to perform account enumeration vulnerability detection, weak password dictionary attack simulation, and password policy compliance check. When it identifies at least one weak password risk in the boundary system, it marks the boundary system as a risky boundary system. The vulnerability detection and association module is configured to perform high-risk function scanning, system version verification, and patch verification. The intranet behavior monitoring module is configured to perform jump host identification, abnormal access detection, sensitive information leakage monitoring, and lateral penetration behavior identification. The coordinated defense response module is configured to perform real-time blocking, credential security hardening, intranet access control, and emergency response reporting.

[0015] Furthermore, the weak password risk identification module includes: an account enumeration detection unit, used to dynamically test the login interface of the boundary system by enumerating different account password combinations, and identify enumeration account vulnerabilities based on differentiated prompts in the system's returned information; a weak password brute-force simulation unit, used to automatically detect weak passwords in the boundary system based on common usernames and a customized dictionary, and record successfully logged-in accounts and their permission levels; a password policy checking unit, used to verify whether the boundary system enforces password complexity and a periodic password change mechanism, and to mark accounts that do not comply with the security policy; the vulnerability detection and association module includes: a high-risk function scanning unit, used to scan the risky boundary system. The system includes: a permission function point detection unit, which identifies the system version of the risky boundary system through a multi-source heterogeneous feature fusion mechanism and compares the system version with a vulnerability database to check for known privilege escalation vulnerabilities; a risk correlation assessment unit, which correlates the detected vulnerabilities with the identified weak password risks; and an internal network behavior monitoring module, which includes: a jump host identification unit, which identifies boundary servers with both public and internal network cards through traffic analysis and monitors the internal network IP address of the boundary server. The system monitors the open status of address ranges and their database ports; an abnormal access detection unit monitors intranet scanning behavior initiated from the jump host and records the accessed IP, port, and protocol type, including batch port probing and live host probing; a sensitive information scanning unit scans the local files of the jump host's server to detect the presence of sensitive information, including plaintext database account passwords and intranet system credentials; and a lateral penetration identification unit monitors abnormal database logins and cross-system authentication, including the first access to the database from the jump host and login from a single sign-on system using acquired sensitive information. The linked defense response module includes: a real-time blocking unit, used to temporarily lock accounts or limit login frequency when weak password risks are identified, isolate malicious files uploaded using vulnerabilities and block their execution when malicious files are detected, and temporarily block intranet access connections through firewall rules when lateral movement behavior is detected within the intranet; a credential hardening unit, used to automatically prompt for encrypted storage of the sensitive information, force password changes and enable two-factor authentication for accounts logging in through weak passwords or leaked sensitive information; and an access control unit, used to automatically generate access control policies based on the intranet topology of the risk boundary system, restricting direct communication between the jump host and the intranet database and single sign-on system to implement network segmentation isolation.The report generation unit is used to generate a chain attack event report based on the weak password chain attack event and provide targeted remediation suggestions. The chain attack event report includes at least the source of the weak password, the vulnerability exploitation path, the scope of internal network penetration, and a list of damaged assets.

[0016] The aforementioned technical solutions offer the following advantages or beneficial effects: By constructing a full-link defense system encompassing weak password risk identification, boundary vulnerability exploitation detection, and intranet lateral movement monitoring, and by proactively identifying and coordinating responses to the complete attack chain from weak passwords to vulnerability exploitation and then to intranet penetration, timely protection against chain attack events is achieved, effectively curbing security incidents where a single breach leads to the entire domain's collapse. By simulating attack behaviors such as weak password brute-force attacks and vulnerability exploitation tests, security risks can be detected before an attack occurs, transforming traditional passive response into proactive early warning, significantly reducing the probability of successful attacks and providing security administrators with a valuable window of opportunity for intervention. When a weak password breach is detected, it automatically triggers scanning for deep system vulnerabilities and monitoring of intranet behavior, and implements targeted coordinated defenses such as real-time blocking and credential hardening based on the correlation assessment results, forming an automated defense closed loop of detection, assessment, and response. By employing multi-source heterogeneous feature fusion and machine learning technology, and through comprehensive analysis of multi-dimensional features such as network traffic fingerprints, file metadata, digital signatures, and vulnerability response behavior, it breaks through the limitations of relying on explicit identification. It can accurately identify the true version of old, tampered, or customized systems, providing a reliable basis for subsequent vulnerability detection and risk assessment, and fundamentally solving the problem of defense failure caused by version misjudgment. Attached Figure Description

[0017] The technical solution and its beneficial effects will become apparent from the following detailed description of specific embodiments of this application, in conjunction with the accompanying drawings.

[0018] Figure 1 A flowchart of the intranet security defense method based on the cascading risks of weak passwords provided in this application; Figure 2 A schematic diagram of the modules of the intranet security defense system 100 based on weak password cascading risks provided in this application; Figure 3 A unit-level schematic diagram of the intranet security defense system 100 based on weak password cascading risks provided in this application.

[0019] Explanation of reference numerals in the attached figures: 100. Intranet Security Defense System Based on Weak Password Chain Risk; 101. Boundary System; 110. Weak Password Risk Identification Module; 120. Vulnerability Detection and Correlation Module; 130. Intranet Behavior Monitoring Module; 140. Linked Defense Response Module; 111. Enumeration Detection Unit; 112. Weak Password Brute-Force Simulation Unit; 113. Password Policy Check Unit; 121. High-Risk Function Scanning Unit; 122. Version and Patch Verification Unit; 123. Risk Correlation Assessment Unit; 131. Jump Host Identification Unit; 132. Abnormal Access Detection Unit; 133. Sensitive Information Scanning Unit; 134. Lateral Penetration Identification Unit; 141. Real-Time Blocking Unit; 142. Credential Hardening Unit; 143. Access Control Unit; 144. Report Generation Unit. Detailed Implementation

[0020] To make the objectives, technical solutions, and beneficial effects of this application clearer, the following detailed description, in conjunction with the accompanying drawings and specific embodiments, further illustrates this application. It should be understood that the specific embodiments described in this specification are merely for explaining this application and are not intended to limit it.

[0021] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "comprising / including / having," etc., are open-ended terms, indicating the presence of, but not limited to, the listed elements; the terms "at least one / at least one" and "several" should be understood as "one or more" or "one or more". The term "and / or" indicates any or all of the parallel relationships. The term "based on" should be understood as "at least partially based on".

[0022] In addition, unless otherwise expressly specified and limited, the computer terminology used in this application has the following meanings: "Weak password" refers to a password with low strength that is easily guessed or cracked, including but not limited to the following: using common dictionary words, shorter than the minimum length requirement, lacking character type combinations, using a default password, being highly similar to a username, or containing predictable user information. "Dictionary" refers to a collection of strings used for automated testing, including but not limited to the following types: common username dictionaries, general weak password dictionaries, customized dictionaries based on specific industry or organizational characteristics, and combined dictionaries incorporating user personal information rules. "Boundary system" refers to computing devices deployed at network boundaries that provide services externally, including but not limited to the following examples: web servers, mail servers, virtual private network gateways, bastion hosts, and various application system interface servers. "Fingerprint" refers to a data pattern that can be used to uniquely or with high probability identify the characteristics of a target system, including but not limited to the following types: TCP / IP protocol stack fingerprints, application layer protocol response fingerprints, file digital signature characteristics, compilation timestamp patterns, and specific vulnerability response behavior characteristics. "Privilege escalation vulnerabilities" refer to security flaws that can be exploited to elevate privilege levels within a system, including but not limited to: operating system local privilege escalation vulnerabilities, application privilege bypass vulnerabilities, and privilege escalation vulnerabilities caused by configuration errors. "Multi-source heterogeneous feature fusion" refers to technical methods for collecting different types of data features from multiple independent sources and performing collaborative analysis, including but not limited to: the fusion analysis of network traffic features, file metadata features, digital signature features, and vulnerability response features. "Passive data collection" refers to not sending any data to the target, but only listening to, recording, and analyzing the network traffic naturally generated by the target system during normal operation.

[0023] In this application, terms such as "module / unit / device / system / server / processor / storage medium / computer program" can be implemented through software, hardware, or a combination of both; "computer-readable storage medium" can be any non-transitory storage medium. Terms such as "acquire / collect / read / receive / calculate / determine / output / generate" are used interchangeably without ambiguity, referring to routine data processing operations performed by the system / device / program. Those skilled in the art can reasonably understand the above terms based on the specific context and make equivalent substitutions for their specific implementations without departing from the spirit and scope of this application.

[0024] In cybersecurity defense practices, chain attacks triggered by weak passwords are one of the main ways internal networks are compromised. Traditional defense methods, due to limitations such as isolated detection targets, fragmented internal and external network protection, and inaccurate version identification, are unable to effectively detect and coordinate the handling of the complete attack chain of "boundary breach, privilege escalation, and internal network roaming".

[0025] To address this, this application proposes an intranet security defense method and system based on the cascading risks of weak passwords, constructing a closed-loop protection system with risk identification, vulnerability correlation, intranet monitoring, and coordinated defense as its main components. By proactively identifying boundary breaches during the weak password risk identification phase, accurately assessing the actual system risk during the vulnerability detection phase, detecting lateral movement in real time during the intranet monitoring phase, and implementing automated collaborative handling during the defense response phase, the system systematically mitigates the cascading security risks that weak passwords may cause. The technical solution of this application will be described in detail below with reference to the accompanying drawings and exemplary embodiments.

[0026] Figure 1 A flowchart illustrating the intranet security defense method based on the cascading risks of weak passwords provided in this application. Figure 1 As shown, the method described in this exemplary embodiment includes the following steps: Step S1 is to identify weak password risks in the boundary system 101 and generate a risk level report based on the risky boundary system; Step S2 is to perform vulnerability detection on the risky boundary system and conduct a correlation assessment based on the detected vulnerabilities and the identified weak password risks; Step S3 is to conduct intranet lateral movement behavior monitoring for the risky boundary system to identify weak password chain attack events; Step S4 is to conduct a coordinated defense response to weak password chain attack events.

[0027] In step S1 above, weak password risk identification includes account enumeration vulnerability detection, weak password dictionary attack simulation, and password policy compliance check. When at least one weak password risk is identified in boundary system 101, boundary system 101 is marked as a risky boundary. In step S2, vulnerability detection includes high-risk function scanning, system version verification, and patch verification. In step S3, intranet lateral movement behavior monitoring includes jump host identification, abnormal access detection, sensitive information leakage monitoring, and lateral penetration behavior identification. In step S4, coordinated defense response includes real-time blocking, credential security hardening, intranet access control, and emergency response reporting.

[0028] Figure 2 This is a schematic diagram of the modules of the intranet security defense system 100 based on the cascading risk of weak passwords provided in this application. Figure 2As shown in this exemplary embodiment, the intranet security defense system 100 includes the following modules: a weak password risk identification module 110, used to identify weak password risks in the boundary system 101 and generate a risk level report based on the risky boundary system; a vulnerability detection and correlation module 120, used to perform vulnerability detection on the risky boundary system and perform correlation assessment based on the detected vulnerabilities and the identified weak password risks; an intranet behavior monitoring module 130, used to monitor intranet lateral movement behavior in the risky boundary system to identify weak password chain attack events; and a coordinated defense response module 140, used to perform coordinated defense response to weak password chain attack events; wherein, the weak password risk identification... The separate module 110 is configured to perform account enumeration vulnerability detection, weak password dictionary attack simulation, and password policy compliance check. When the weak password risk identification module 110 identifies that the boundary system 101 has at least one weak password risk, it marks the boundary system 101 as a risky boundary system. The vulnerability detection and association module 120 is configured to perform high-risk function scanning, system version verification, and patch verification. The intranet behavior monitoring module 130 is configured to perform jump host identification, abnormal access detection, sensitive information leakage monitoring, and lateral penetration behavior identification. The linkage defense response module 140 is configured to perform real-time blocking, credential security hardening, intranet access control, and emergency response reporting.

[0029] The following is combined Figure 1 and Figure 2 The above-mentioned exemplary intranet security defense method and system based on weak password cascading risks will be described in detail.

[0030] In the above exemplary embodiment, the account enumeration vulnerability detection in step S1 includes dynamically testing the login interface of the boundary system 101 by enumerating different account password combinations, and identifying enumeration account vulnerabilities based on the differentiated prompts in the system's returned information; the weak password dictionary attack simulation includes automatically detecting weak passwords in the boundary system 101 based on common usernames and a customized dictionary, and recording the successfully logged-in accounts and their permission levels; the password policy compliance check includes verifying whether the boundary system 101 enforces password complexity and a regular password change mechanism, and marking accounts that do not comply with the security policy. For example, in a port management system, if an attacker attempts to log in to the port management system by enumerating account password combinations, and the system returns "username does not exist" or "incorrect password," the attacker can mark a valid account based on the "incorrect password" prompt, and then use a weak password dictionary to brute-force the valid account to log in, using common password formats such as "admin," "system," "username + 123456," and "employee name pinyin + birthday," to automatically detect weak passwords in the port management system, and record the successfully logged-in accounts and their permission levels. If the port management system does not have password complexity rules and / or a mechanism for regularly changing passwords, then the port management system does not comply with the security policy, and valid accounts whose passwords are not changed regularly should be marked, or even have their login privileges suspended.

[0031] In step S2 above, the high-risk function scan includes scanning the permission function points of the risk boundary system 101 and detecting whether there are permission function vulnerabilities. Permission function points at least include file upload and system configuration modification, and permission function vulnerabilities at least include missing file type verification and traversable upload paths. When such permission function vulnerabilities exist, the associated assessment result is marked as a combined risk. When file type verification is missing, an attack weapon called an "image malware" can upload malicious executable files or web backdoors in the form of seemingly legitimate files such as images. In this case, the risk boundary system should be assessed as a "weak password + vulnerability" combined risk, and the risk level is high.

[0032] In step S2 above, system version verification includes identifying the system version of the risky boundary system through a multi-source heterogeneous feature fusion mechanism. This is mainly achieved through the following steps: passively collecting network communication traffic of the risky boundary system, extracting TCP / IP stack features and application layer protocol fingerprints, and comparing them with a pre-built version and protocol feature mapping library to initially narrow down the system version range; analyzing the digital signature timestamp, compilation time, and hash value of the core executable file of the risky boundary system, combining it with the developer's version release cycle of the risky boundary system to reverse-engineer the system version, and using the version information of pre-installed third-party components for auxiliary verification; sending non-destructive probe requests for specific historical vulnerabilities to the risky boundary system, and refining the version judgment based on the differences in its response behavior; building a machine learning classification model based on system samples of known versions, and performing dynamic fingerprint learning and version identification on new or customized systems. The features used for model training include the system's protocol features, file metadata, and vulnerability responses. In the above steps, TCP / IP stack characteristics include, for example, the initial window size, MSS value, and SACK option enabling logic; application layer protocol fingerprints include, for example, the order of error responses from the web server to malformed URLs and the format of database error messages; core executable files include, for example, kernel32.dll and mysqld.exe; system version deduction includes, for example, deriving the system version based on the correspondence between the signature time and version of Microsoft Windows core files; and pre-installed third-party components include, for example, .NET Framework and OpenSSL. In these steps, the application of machine learning classification models improves the generalization ability of version identification and provides better compatibility with cross-system defense solutions. Furthermore, step S2 further compares the system version identified by the system version check with the vulnerability database, and determines whether the system version is an outdated and not upgraded version based on the comparison results. If it is an outdated and not upgraded version, it can be checked whether the risky system has known privilege escalation vulnerabilities. For example, according to step S2 above, if the TCP initial window size of a risky boundary system matches the characteristics of Windows Server 2008, the signature time of the core file ntoskrnl.exe is 2008, and the response to the MS17-010 probe packet is consistent with an unupgraded version of Windows Server 2008, then it is determined that the risky boundary system has a known privilege escalation vulnerability, and after associating it with weak password risks, it is judged to be extremely high risk.

[0033] In step S3 above, the jump host identification includes identifying border servers with both public and private network interface cards (NICs) through traffic analysis, and monitoring the private IP address range of the border server (e.g., 192.168.xx.xx / 24) and the open status of its database ports (e.g., database ports 3306, 1521, etc.); abnormal access detection includes monitoring private network scanning behavior initiated from the jump host and recording the IP address, port, and protocol type accessed. Private network scanning behavior includes, for example, batch port probing and live host probing; sensitive information leakage monitoring includes scanning the local files of the jump host's server and detecting... Does it contain sensitive information, such as database account passwords and internal network system credentials stored in plaintext? Lateral penetration behavior identification includes monitoring abnormal database logins and cross-system authentication. Abnormal database logins include the first access to the database from the jump host (such as an internal network port 3306 scan initiated from the jump host server, access to the database MySQL / Oracl, and the "xxconfig.ini" configuration file, containing plaintext database credentials). Cross-system authentication includes logging in from a single sign-on system (SSO) using the acquired sensitive information (such as plaintext database credentials).

[0034] In step S4 above, real-time blocking includes temporarily locking accounts or limiting login frequency when weak password risks are identified; isolating and blocking the execution of malicious files (such as "image malware") uploaded using vulnerabilities when detected; and temporarily blocking internal network access connections through firewall rules when lateral movement behavior is detected within the internal network. Credential security hardening includes automatically prompting for encrypted storage of sensitive information, such as replacing MD5 hashes with asymmetric encryption, forcing accounts logging in with weak passwords or leaked sensitive information to change passwords and enabling two-factor authentication. Internal network access control includes automatically generating access control policies based on the internal network topology of the risk boundary system, restricting direct communication between jump hosts and internal network databases and single sign-on systems to implement network segmentation isolation. Emergency response reporting includes generating a chain attack event report based on weak password chain attack events and providing targeted remediation suggestions; the chain attack event report should at least include the source of the weak password, the vulnerability exploitation path, the scope of internal network penetration, and a list of damaged assets.

[0035] Taking the defense of a certain port management system as an example, the implementation process of this invention is as follows: Weak password risk identification: The system tested the login interface of the port management system and found an account enumeration vulnerability (differentiated error message). The weak password of the account "the pinyin of a certain employee's name" was obtained by brute-forcing the custom dictionary, which was judged as high risk and a warning was issued.

[0036] Boundary vulnerability linkage: Scanning the system logged in by this high-privilege account revealed a file type verification vulnerability in the "avatar upload" function (supporting "image malware" uploads); analysis of its network traffic (TCP initial window size matches Windows Server 2008 characteristics), core file signature (ntoskrnl.exe signature date is 2008), and response to MS17-010 probe packets using the version verification unit confirmed that the system was an un-upgraded version of Windows Server 2008 with a known privilege escalation vulnerability, and after associating it with weak password risks, it was determined to be extremely high risk.

[0037] Internal network behavior monitoring: The system server was found to have dual network cards (public network + 192.168.xx.xx / 24 internal network). Internal network port 3306 scan initiated from the server was detected, as well as access to the "xxconfig.ini" configuration file (containing plaintext database credentials).

[0038] Joint defense response: The system temporarily locks accounts with weak passwords, isolates uploaded "image malware" files, blocks abnormal access of the server to the internal MySQL database, prompts users to encrypt and store credentials in the configuration file, enables two-factor authentication, and generates an emergency report containing the attack chain and remediation suggestions.

[0039] Figure 3 This is a unit-level schematic diagram of the intranet security defense system 100 based on the cascading risk of weak passwords provided in this application. Figure 3 As shown, based on the specific steps and execution content of the above exemplary steps, each module in the intranet security defense system 100 based on weak password chain risk should include the following units. The weak password risk identification module 110 includes an account enumeration detection unit 111, a weak password brute-force simulation unit 112, and a password policy checking unit 113, to respectively execute each step in step S1 above; the vulnerability detection and correlation module 120 includes a high-risk function scanning unit 121, a version and patch verification unit 122, and a risk correlation assessment unit 123, to respectively execute each step in step S2 above; the intranet behavior monitoring module 130 includes a jump host identification unit 131, an abnormal access detection unit 132, a sensitive information scanning unit 133, and a lateral penetration identification unit 134, to respectively execute each step in step S3 above, wherein the version and patch verification unit 122 has a built-in traffic collection port, historical vulnerability detection packages, and a machine learning classification model; the coordinated defense response module 140 includes a real-time blocking unit 141, a credential hardening unit 142, an access control unit 143, and a report generation unit 144, to execute each step in step S4 above.

[0040] In summary, the intranet security defense methods and systems based on weak password cascading risks disclosed in the above embodiments systematically solve problems such as insufficient defense against cascading attacks caused by weak passwords, the separation of internal and external network security, and inaccurate system version identification by constructing a full-link closed-loop defense system of "boundary detection, vulnerability association, intranet monitoring, and coordinated defense." The solution provided in this specification can not only proactively identify and warn of weak password risks, but also accurately locate system versions and associated vulnerabilities through a multi-source heterogeneous feature fusion mechanism. It realizes real-time monitoring and coordinated handling of the entire attack chain of "weak password - vulnerability exploitation - lateral movement within the intranet," improving the initiative, accuracy, and systematic nature of intranet security defense while effectively reducing the cascading security risks of "one point of failure leading to the entire domain being compromised." It has good engineering applicability and technical promotion value.

[0041] The above embodiments are provided only to help understand the methods, structures, and core ideas of this application. Those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the scope of protection of the claims.

Claims

1. An intranet security defense method based on the cascading risks of weak passwords, characterized in that, include: Weak password risk identification is performed on the boundary system, and a risk level report is generated based on the risky boundary system; Vulnerability detection is performed on the aforementioned risk boundary system, and a correlation assessment is conducted based on the detected vulnerabilities and the identified weak password risks; Internal network lateral movement behavior monitoring is conducted on the aforementioned risky boundary system to identify weak password chain attack events; A coordinated defense response will be implemented to address the aforementioned weak password chain attack events.

2. The intranet security defense method based on weak password cascading risks as described in claim 1, characterized in that, The weak password risk identification includes at least one of account enumeration vulnerability detection, weak password dictionary attack simulation, and password policy compliance check. When the boundary system is identified with at least one weak password risk, the boundary system is marked as a risky boundary. The account enumeration vulnerability detection includes dynamically testing the login interface of the boundary system by enumerating different combinations of usernames and passwords, and identifying enumeration account vulnerabilities based on the differentiated prompts in the system's returned information. The weak password dictionary attack simulation includes automatically detecting weak passwords in the boundary system based on common usernames and a customized dictionary, and recording the accounts and permission levels of those who successfully log in. The password policy compliance check includes verifying whether the boundary system enforces password complexity and a periodic replacement mechanism, and marking accounts that do not comply with the security policy.

3. The intranet security defense method based on weak password cascading risks as described in claim 1, characterized in that, The vulnerability detection includes high-risk feature scanning, wherein... The high-risk function scan includes scanning the permission function points of the risk boundary system and detecting whether there are permission function vulnerabilities. The permission function points include at least file upload and system configuration modification, and the permission function vulnerabilities include at least missing file type verification and traversable upload path; When the aforementioned permission function vulnerability exists, the result of the association assessment is marked as a combined risk.

4. The intranet security defense method based on weak password cascading risks as described in claim 1, characterized in that, The vulnerability detection includes system version verification, wherein the system version verification includes identifying the system version of the risk boundary system through a multi-source heterogeneous feature fusion mechanism; The multi-source heterogeneous feature fusion mechanism includes: The network communication traffic of the risk boundary system is passively collected, TCP / IP stack features and application layer protocol fingerprints are extracted, and compared with a pre-built version and protocol feature mapping library to initially determine the system version range. The digital signature timestamp, compilation time, and hash value of the core executable file of the risk boundary system are analyzed. The system version is reversed by combining the version release cycle of the developer of the risk boundary system, and the version information of the pre-installed third-party components is used for auxiliary verification. Send non-destructive probe requests for specific historical vulnerabilities to the risk boundary system, and refine the version judgment based on the differences in its response behavior; Machine learning classification models are built based on known versions of system samples, and dynamic fingerprint learning and version identification are performed on new or customized systems. The features used for model training include the system's protocol features, file metadata, and vulnerability responses.

5. The intranet security defense method based on weak password cascading risks as described in claim 4, characterized in that, The vulnerability detection includes patch verification, wherein the patch verification includes: The system version identified by the system version check is compared with the vulnerability database; Based on the comparison results, determine whether the system version is an old and unupgraded version, and check for any known privilege escalation vulnerabilities.

6. The intranet security defense method based on weak password cascading risks as described in claim 1, characterized in that, The intranet lateral movement behavior monitoring includes at least one of the following: jump host identification, abnormal access detection, sensitive information leakage monitoring, and lateral penetration behavior identification. The jump host identification includes identifying a border server with both public and private network cards through traffic analysis, and monitoring the private network IP address range and database port open status of the border server. The abnormal access detection includes monitoring the intranet scanning behavior initiated from the jump host and recording the IP, port and protocol type accessed. The intranet scanning behavior includes batch port detection and live host detection. The sensitive information leakage monitoring includes scanning the local files of the server of the jump host to detect whether there is sensitive information, including database account passwords and intranet system credentials stored in plaintext; The lateral movement behavior identification includes monitoring abnormal database logins and cross-system authentication. The abnormal database logins include the first access to the database from the jump host, and the cross-system authentication includes logging in from a single sign-on system using acquired sensitive information.

7. The intranet security defense method based on weak password cascading risks as described in claim 1, characterized in that, The coordinated defense response includes at least one of the following: real-time blocking, credential security hardening, internal network access control, and emergency response reporting. The real-time blocking includes: temporarily locking the account or limiting the login frequency when weak password risks are identified; isolating the malicious file and blocking its execution when malicious files uploaded by exploiting vulnerabilities are detected; and temporarily blocking internal network access connections through firewall rules when lateral movement behavior on the internal network is detected. The security reinforcement of the credentials includes: automatically prompting for encrypted storage of the sensitive information, and forcibly changing the password and enabling two-factor authentication for accounts that log in through weak passwords or leaked sensitive information. The intranet access control includes: automatically generating access control policies based on the intranet topology of the risk boundary system, restricting direct communication between the jump host and the intranet database and single sign-on system, so as to implement network segmentation isolation.

8. The intranet security defense method based on weak password cascading risks as described in claim 7, characterized in that, The emergency response report includes a chain attack report based on the weak password attack incident, and provides targeted remediation suggestions. The chain attack event report should include at least the source of the weak password, the exploit path, the scope of the internal network penetration, and a list of damaged assets.

9. An intranet security defense system based on the cascading risks of weak passwords, characterized in that, include: The weak password risk identification module is used to identify weak password risks in the boundary system and generate a risk level report based on the risky boundary system. The vulnerability detection and correlation module is used to perform vulnerability detection on the risk boundary system and perform correlation assessment based on the detected vulnerabilities and the identified weak password risks. The intranet behavior monitoring module is used to monitor lateral movement behavior within the intranet for the risky boundary system in order to identify weak password chain attack events. The linkage defense response module is used to perform linkage defense response to the weak password chain attack event; in, The weak password risk identification module is configured to perform account enumeration vulnerability detection, weak password dictionary attack simulation, and password policy compliance check. When it identifies that the boundary system has at least one weak password risk, it marks the boundary system as a risky boundary system. The vulnerability detection and correlation module is configured to perform high-risk function scanning, system version verification, and patch verification. The intranet behavior monitoring module is configured to perform jump host identification, abnormal access detection, sensitive information leakage monitoring, and lateral penetration behavior identification. The linked defense response module is configured to perform real-time blocking, credential security hardening, intranet access control, and emergency response reporting.

10. The intranet security defense system based on weak password cascading risks as described in claim 9, characterized in that, The weak password risk identification module includes: The account enumeration detection unit is used to dynamically test the login interface of the boundary system by enumerating different combinations of usernames and passwords, and to identify account enumeration vulnerabilities based on the differentiated prompts in the system's returned information. The weak password brute-force simulation unit is used to automatically detect weak passwords in the boundary system based on common usernames and a customized dictionary, and to record the accounts and permission levels that successfully log in. The password policy checking unit is used to verify whether the boundary system enforces password complexity and periodic replacement mechanisms, and to mark accounts that do not comply with the security policy. The vulnerability detection and correlation module includes: The high-risk function scanning unit is used to scan the permission function points of the risk boundary system and detect whether there are permission function vulnerabilities. The permission function points include at least file upload and system configuration modification, and the permission function vulnerabilities include at least missing file type verification and traversable upload path. The version and patch verification unit is used to identify the system version of the risk boundary system through a multi-source heterogeneous feature fusion mechanism, and compare the system version with the vulnerability database to check for known privilege escalation vulnerabilities. The risk correlation assessment unit is used to correlate detected vulnerabilities with identified weak password risks. The intranet behavior monitoring module includes: The jump host identification unit is used to identify border servers with both public and private network cards through traffic analysis, and to monitor the private network IP address range and database port open status of the border server. An abnormal access detection unit is used to monitor intranet scanning behavior initiated from the jump host and record the IP, port and protocol type accessed. The intranet scanning behavior includes batch port detection and live host detection. The sensitive information scanning unit is used to scan the local files of the server of the jump host to detect whether there is sensitive information, including database account passwords and intranet system credentials stored in plaintext; Lateral penetration detection unit is used to monitor abnormal database logins and cross-system authentication. The abnormal database logins include the first access to the database from the jump host, and the cross-system authentications include logging in from a single sign-on system using acquired sensitive information. The coordinated defense response module includes: The real-time blocking unit is used to temporarily lock accounts or limit login frequency when weak password risks are identified, isolate malicious files uploaded by exploiting vulnerabilities and block their execution when malicious files are detected, and temporarily block intranet access connections through firewall rules when lateral movement behavior is detected on the intranet. The credential reinforcement unit is used to automatically prompt for encrypted storage of the sensitive information, and to force the password to be changed and enable two-factor authentication for accounts that log in through weak passwords or leaked sensitive information. The access control unit is used to automatically generate access control policies based on the intranet topology of the risk boundary system, restricting direct communication between the jump host and the intranet database and single sign-on system, so as to implement network segmentation isolation. The report generation unit is used to generate a chain attack event report based on the weak password chain attack event and provide targeted remediation suggestions. The chain attack event report includes at least the source of the weak password, the vulnerability exploitation path, the scope of internal network penetration, and a list of damaged assets.

Images