CN111385272A - Method and device for detecting weak password - Google Patents
Method and device for detecting weak password Download PDFInfo
- Publication number
- CN111385272A CN111385272A CN201811642809.9A CN201811642809A CN111385272A CN 111385272 A CN111385272 A CN 111385272A CN 201811642809 A CN201811642809 A CN 201811642809A CN 111385272 A CN111385272 A CN 111385272A
- Authority
- CN
- China
- Prior art keywords
- data request
- login
- web
- web system
- log
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 40
- 230000004044 response Effects 0.000 claims abstract description 47
- 238000001514 detection method Methods 0.000 claims abstract description 19
- 238000013473 artificial intelligence Methods 0.000 claims abstract description 17
- 235000014510 cooky Nutrition 0.000 claims description 17
- 238000000605 extraction Methods 0.000 claims description 4
- 230000006399 behavior Effects 0.000 description 16
- 230000006870 function Effects 0.000 description 8
- 230000008901 benefit Effects 0.000 description 4
- 238000004590 computer program Methods 0.000 description 3
- 230000008676 import Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 238000010586 diagram Methods 0.000 description 2
- 238000000429 assembly Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 238000012502 risk assessment Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Evolutionary Computation (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computing Systems (AREA)
- Information Transfer Between Computers (AREA)
Abstract
本发明公开了一种弱口令的检测方法及装置，涉及网络安全技术领域，能够解决现有第三方系统无法检测出用户登录web系统是否使用了弱口令的问题。本发明的方法主要包括：获取终端发出的数据请求；利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；若所述数据请求用于请求登录web系统，则根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；若登录成功，则根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。本发明主要适用于对web系统的弱口令进行识别的场景中。
The invention discloses a weak password detection method and device, relates to the technical field of network security, and can solve the problem that the existing third-party system cannot detect whether a user logs in a web system using a weak password. The method of the present invention mainly includes: acquiring a data request sent by a terminal; using a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system, and the web login identification model is used to log in to the web system according to a known request. The artificial intelligence model obtained by training the login feature in the data request; if the data request is used to request to log in to the web system, then according to the data response corresponding to the data request, determine whether the terminal successfully logs in to the web system; if If the login is successful, it is determined whether the password in the data request is a weak password according to a preset weak password rule. The present invention is mainly applicable to the scene of identifying weak passwords of web systems.
Description
技术领域technical field
本发明涉及网络安全技术领域，特别是涉及一种弱口令的检测方法及装置。The invention relates to the technical field of network security, in particular to a method and device for detecting weak passwords.
背景技术Background technique
弱口令是指容易被人猜测到和破解的口令，比如常见的123456、abcdef等等。长期以来弱口令一直是各种安全检查和风险评估必须检查的项，并且危害等级比较高。但是在一些企业部署的内网采用安全性相对较差的HTTP(HyperText Transfer Protocol，超文本传输协议)进行通信的情况下，一些用户在使用OA(Office Automation，办公自动化)、邮件等web系统时，为了方便输入和记忆依然会设置弱口令，并且这些web系统的服务端也可能不会强制用户设置非弱口令，从而一旦弱口令被破解，将给企业带来很大风险。此外，虽然如管理平台等第三方系统可以监控局域网内各个设备的行为，但是目前第三方系统也只能监控每个用户是否联网、登录了哪些软件、是否出现故障等行为，而无法精确获知用户登录web系统时是否使用了弱口令。Weak passwords refer to passwords that are easily guessed and cracked, such as the common 123456, abcdef, and so on. Weak passwords have long been a must-checked item for various security checks and risk assessments, and the hazard level is relatively high. However, when the intranets deployed by some enterprises use HTTP (HyperText Transfer Protocol) with relatively poor security for communication, some users use OA (Office Automation, Office Automation), mail and other web systems when using , in order to facilitate input and memory, weak passwords will still be set, and the servers of these web systems may not force users to set non-weak passwords, so once the weak password is cracked, it will bring great risks to the enterprise. In addition, although third-party systems such as management platforms can monitor the behavior of each device in the local area network, at present, third-party systems can only monitor whether each user is connected to the Internet, what software is logged in, and whether there is a failure, but cannot accurately know the user. Whether a weak password is used when logging in to the web system.
发明内容SUMMARY OF THE INVENTION
有鉴于此，本发明提供的一种弱口令的检测方法及装置，其目的在于解决现有第三方系统无法检测出用户登录web系统是否使用了弱口令的问题。In view of this, the present invention provides a weak password detection method and device, which aims to solve the problem that existing third-party systems cannot detect whether a user logs in to a web system using a weak password.
本发明的目的是采用以下技术方案来实现的：The purpose of this invention is to adopt following technical scheme to realize:
第一方面，本发明提供了一种弱口令的检测方法，所述方法包括：In a first aspect, the present invention provides a method for detecting a weak password, the method comprising:
获取终端发出的数据请求；Get the data request sent by the terminal;
利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；Utilize a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system, and the web login identification model is an artificial intelligence model obtained by training according to the login feature in the data request for the known request to log in to the web system;
若所述数据请求用于请求登录web系统，则根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；If the data request is for requesting to log in to the web system, determine whether the terminal successfully logs in to the web system according to the data response corresponding to the data request;
若登录成功，则根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。If the login is successful, it is determined whether the password in the data request is a weak password according to a preset weak password rule.
可选的，利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统包括：Optionally, using a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system includes:
从所述数据请求中提取待检测特征；extracting features to be detected from the data request;
将所述待检测特征导入所述web登录识别模型，通过所述web登录识别模型对所述待检测特征进行归类；importing the feature to be detected into the web login identification model, and classifying the feature to be detected by the web login identification model;
根据归类结果确定所述数据请求是否用于请求登录web系统。Whether the data request is for requesting to log in to the web system is determined according to the classification result.
可选的，根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统包括：Optionally, judging whether the terminal successfully logs in to the web system according to the data response corresponding to the data request includes:
将所述数据请求所对应的数据响应与预设登录成功规则进行匹配；matching the data response corresponding to the data request with the preset login success rule;
若匹配成功，则确定所述终端成功登录所述web系统。If the matching is successful, it is determined that the terminal successfully logs in to the web system.
可选的，将所述数据请求所对应的数据响应与预设登录成功规则进行匹配包括：Optionally, matching the data response corresponding to the data request with the preset login success rule includes:
判断所述数据请求所对应的数据响应中是否含有用于表征登录成功的Cookie；Determine whether the data response corresponding to the data request contains a cookie used to represent successful login;
若含有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配成功。If the cookie is contained, it is determined that the data response is successfully matched with the preset login success rule.
可选的，所述登录特征包括以下任一项或多项的组合：Optionally, the login feature includes any one or a combination of the following:
统一资源定位符URL、用户名和口令。Uniform Resource Locator URL, username and password.
第二方面，本发明提供了一种弱口令的检测装置，所述装置包括：In a second aspect, the present invention provides a weak password detection device, the device comprising:
获取单元，用于获取终端发出的数据请求；an acquisition unit, used to acquire the data request sent by the terminal;
识别单元，用于利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；The identification unit is used to identify whether the data request is for requesting to log in to the web system by using a pre-established web login identification model, and the web login identification model is obtained by training according to the login feature in the data request for the known request to log in to the web system artificial intelligence model;
第一判断单元，用于当所述数据请求用于请求登录web系统时，根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；a first judging unit, configured to judge whether the terminal successfully logs in to the web system according to the data response corresponding to the data request when the data request is used for requesting to log in to the web system;
第二判断单元，用于当登录成功时，根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。The second judging unit is configured to judge whether the password in the data request is a weak password according to the preset weak password rule when the login is successful.
可选的，所述识别单元包括：Optionally, the identification unit includes:
提取模块，用于从所述数据请求中提取待检测特征；an extraction module for extracting features to be detected from the data request;
归类模块，用于将所述待检测特征导入所述web登录识别模型，通过所述web登录识别模型对所述待检测特征进行归类；a classification module, configured to import the features to be detected into the web login recognition model, and classify the features to be detected by using the web login recognition model;
第一确定模块，用于根据归类结果确定所述数据请求是否用于请求登录web系统。The first determining module is configured to determine whether the data request is for requesting to log in to the web system according to the classification result.
可选的，所述第一判断单元包括：Optionally, the first judgment unit includes:
匹配模块，用于将所述数据请求所对应的数据响应与预设登录成功规则进行匹配；a matching module, configured to match the data response corresponding to the data request with the preset login success rule;
第二确定模块，用于当匹配成功时，确定所述终端成功登录所述web系统。The second determining module is configured to determine that the terminal successfully logs in to the web system when the matching is successful.
可选的，所述匹配模块，用于判断所述数据请求所对应的数据响应中是否含有用于表征登录成功的Cookie；若含有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配成功。Optionally, the matching module is used to determine whether the data response corresponding to the data request contains a cookie used to indicate successful login; if the cookie is included, then determine that the data response is the same as the preset login The success rule was matched successfully.
可选的，所述登录特征包括以下任一项或多项的组合：Optionally, the login feature includes any one or a combination of the following:
统一资源定位符URL、用户名和口令。Uniform Resource Locator URL, username and password.
第三方面，本发明提供了一种存储介质，所述存储介质存储有多条指令，所述指令适用于由处理器加载并执行如第一方面所述的弱口令的检测方法。In a third aspect, the present invention provides a storage medium, where a plurality of instructions are stored in the storage medium, and the instructions are suitable for being loaded by a processor and executing the weak password detection method according to the first aspect.
第四方面，本发明提供了一种电子设备，所述电子设备包括存储介质和处理器；In a fourth aspect, the present invention provides an electronic device, the electronic device comprising a storage medium and a processor;
所述处理器，适于实现各指令；the processor, adapted to implement each instruction;
所述存储介质，适于存储多条指令；The storage medium is suitable for storing a plurality of instructions;
所述指令适于由所述处理器加载并执行如第一方面所述的弱口令的检测方法。The instructions are adapted to be loaded by the processor and execute the weak password detection method according to the first aspect.
借由上述技术方案，本发明提供的弱口令的检测方法及装置，能够先获取终端发出的数据请求，然后利用根据已知请求登录web系统的数据请求中的登录特征训练得到的人工智能模型web登录识别模型识别该数据请求是否用于请求登录web系统，当该数据请求用于请求登录web系统时，根据该数据请求所对应的数据响应判断该终端是否成功登录web系统，当登录成功时，根据预设弱口令规则来判断该数据请求中的口令是否为弱口令。由此可知，本发明的第三方不仅能够识别出用户登录web系统时是否使用了弱口令，在识别数据请求是否用于请求登录web系统时，还可以利用具有机器自学习功能的web登录识别模型对已知请求登录web系统的登录行为进行自学习，识别出已知登录行为之外的登录行为，从而识别出更多的弱口令。With the above technical solution, the method and device for detecting weak passwords provided by the present invention can first obtain the data request sent by the terminal, and then use the artificial intelligence model web obtained by training the login feature in the data request according to the known request to log in to the web system. The login identification model identifies whether the data request is used to request to log in to the web system. When the data request is used to request to log in to the web system, it is judged whether the terminal successfully logs in to the web system according to the data response corresponding to the data request. When the login is successful, Whether the password in the data request is a weak password is determined according to a preset weak password rule. It can be seen from this that the third party of the present invention can not only identify whether a weak password is used when the user logs in to the web system, but also can use a web login identification model with machine self-learning function when identifying whether the data request is used to log in to the web system Self-learning is performed on the login behaviors of known requests to log in to the web system, and the login behaviors other than the known login behaviors are identified, thereby identifying more weak passwords.
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.
附图说明Description of drawings
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:
图1示出了本发明实施例提供的一种弱口令的检测方法的流程图；1 shows a flowchart of a method for detecting a weak password provided by an embodiment of the present invention;
图2示出了本发明实施例提供的一种弱口令的检测装置的组成框图；Fig. 2 shows the composition block diagram of a weak password detection device provided by an embodiment of the present invention;
图3示出了本发明实施例提供的另一种弱口令的检测装置的组成框图。FIG. 3 shows a block diagram of another weak password detection apparatus provided by an embodiment of the present invention.
具体实施方式Detailed ways
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.
本发明实施例提供了一种弱口令的检测方法，如图1所示，所述方法主要包括：An embodiment of the present invention provides a weak password detection method, as shown in FIG. 1 , the method mainly includes:
101、获取终端发出的数据请求。101. Obtain a data request sent by a terminal.
当用户通过终端登录web系统时，会输入账号、口令等登录信息，终端接收到这些登录信息后，会根据这些登录信息生成用于请求登录web系统的数据请求，并将该数据请求发送给web系统的服务器，以便服务器对数据请求中的登录信息进行验证，并做出对应的响应。本发明实施例作为终端与服务器的第三方，可以采用网络嗅探、网络端口镜像等方式获取数据请求和数据响应。When the user logs in to the web system through the terminal, he will enter the login information such as account number and password. After receiving the login information, the terminal will generate a data request for logging in to the web system according to the login information, and send the data request to the web system. The server of the system, so that the server can verify the login information in the data request and make a corresponding response. In the embodiment of the present invention, as a third party of the terminal and the server, a data request and a data response can be obtained by means of network sniffing, network port mirroring, and the like.
所述终端可以是具有显示功能并且支持交互功能的各种电子设备，包括但不限于智能手机、平板电脑、个人计算机以及台式计算机等。The terminal may be various electronic devices having a display function and supporting an interactive function, including but not limited to a smart phone, a tablet computer, a personal computer, a desktop computer, and the like.
102、利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统。102. Use a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system.
其中，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型。所述登录特征包括以下任一项或多项的组合：URL(Uniform Resource Locator，统一资源定位符)、用户名和口令。由于目前数据识别的常用方法是规则匹配，所以本发明实施例在识别数据请求是否用于请求登录web系统时，也可以采用规则匹配的方式。但是设置的规则仅是已知登录特征的确定性描述，故规则匹配的方式仅能识别与已知登录特征完全相同的特征，而无法识别出其他特征。而人工智能技术在训练人工智能模型时，不仅限于对已知登录特征的确定性描述，还能从中挖掘出与已知登录特征相近的特征。因此，人工智能模型可以识别出更多的登录特征。Wherein, the web login identification model is an artificial intelligence model obtained by training according to the login feature in the data request for the known request to log in to the web system. The login feature includes any one or a combination of the following: URL (Uniform Resource Locator, Uniform Resource Locator), user name and password. Since the current common method for data identification is rule matching, in this embodiment of the present invention, when identifying whether a data request is used for requesting to log in to the web system, a rule matching method can also be used. However, the set rules are only deterministic descriptions of known login features, so the rule matching method can only identify features that are exactly the same as known login features, but cannot identify other features. When artificial intelligence technology trains artificial intelligence models, it is not only limited to the deterministic description of known login features, but also digs out features similar to known login features. Therefore, the AI model can identify more login characteristics.
103、若所述数据请求用于请求登录web系统，则根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统。103. If the data request is for requesting to log in to the web system, determine whether the terminal successfully logs in to the web system according to the data response corresponding to the data request.
当数据请求用于请求登录web系统时，即使数据请求中包含的口令是弱口令，也不一定能够成功登录对应的web系统，因为其可能不是用户注册的口令。因此，在确定数据请求用于请求登录web系统后，直接验证口令是否为弱口令没有意义，需要在确定成功登录web系统后，再验证口令是否为弱口令才有意义。由于数据请求中的登录信息被验证通过后，服务器会给予终端相应用于表征登录成功的数据响应，所以可以根据数据请求所对应的数据响应判断终端是否成功登录web系统。When the data request is used to request to log in to the web system, even if the password included in the data request is a weak password, it may not be possible to successfully log in to the corresponding web system because it may not be the password registered by the user. Therefore, it is meaningless to directly verify whether the password is a weak password after it is determined that the data request is used to request to log in to the web system. After the login information in the data request is verified, the server will give the terminal a corresponding data response indicating successful login, so whether the terminal successfully logs in to the web system can be determined according to the data response corresponding to the data request.
104、若登录成功，则根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。104. If the login is successful, determine whether the password in the data request is a weak password according to a preset weak password rule.
当终端成功登录web服务器后，为了提高账号安全性，可以对登录成功所使用的口令进行弱口令检测，以便在发现其所使用的口令为弱口令时，及时提醒相应用户修改口令。在判断口令是否为弱口令时，可以将该口令与预设弱口令规则进行匹配，若匹配成功，则确定该口令是弱口令，若匹配失败，则确定该秘密不是弱口令。例如可以判断该口令是否为连续的多个数字；若是，则确定该口令是弱口令；反之，不是弱口令。此外，当确定登录失败时，无论数据请求中的口令是否为弱口令，都没有意义，故这种情况下，无需对数据请求中的口令进行任何弱口令识别操作。After the terminal successfully logs in to the web server, in order to improve account security, weak password detection can be performed on the password used for successful login, so that when the password used by the terminal is found to be a weak password, the corresponding user can be reminded to modify the password in time. When judging whether a password is a weak password, the password can be matched with a preset weak password rule. If the match is successful, it is determined that the password is a weak password, and if the match fails, it is determined that the secret is not a weak password. For example, it can be determined whether the password is a plurality of consecutive numbers; if so, it is determined that the password is a weak password; otherwise, it is not a weak password. In addition, when it is determined that the login fails, no matter whether the password in the data request is a weak password, it is meaningless, so in this case, there is no need to perform any weak password identification operation on the password in the data request.
本发明实施例提供的弱口令的检测方法，能够先获取终端发出的数据请求，然后利用根据已知请求登录web系统的数据请求中的登录特征训练得到的人工智能模型web登录识别模型识别该数据请求是否用于请求登录web系统，当该数据请求用于请求登录web系统时，根据该数据请求所对应的数据响应判断该终端是否成功登录web系统，当登录成功时，根据预设弱口令规则来判断该数据请求中的口令是否为弱口令。由此可知，本发明实施例的第三方不仅能够识别出用户登录web系统时是否使用了弱口令，在识别数据请求是否用于请求登录web系统时，还可以利用具有机器自学习功能的web登录识别模型对已知请求登录web系统的登录行为进行自学习，识别出已知登录行为之外的登录行为，从而识别出更多的弱口令。The weak password detection method provided by the embodiment of the present invention can first obtain the data request sent by the terminal, and then use the artificial intelligence model web login recognition model trained according to the login feature in the data request for the known request to log in to the web system to identify the data Whether the request is used to request to log in to the web system, when the data request is used to request to log in to the web system, according to the data response corresponding to the data request to determine whether the terminal successfully logs in to the web system, when the login is successful, according to the preset weak password rules to determine whether the password in the data request is a weak password. It can be seen from this that the third party in the embodiment of the present invention can not only identify whether a weak password is used when the user logs in to the web system, but also can use a web login with a machine self-learning function when identifying whether the data request is used to log in to the web system The recognition model conducts self-learning on the login behaviors of known requests to log in to the web system, and identifies login behaviors other than known login behaviors, thereby identifying more weak passwords.
在本发明的另一个实施例中，进一步介绍上述步骤102的一种可选实施方式，该方式包括：从所述数据请求中提取待检测特征；将所述待检测特征导入所述web登录识别模型，通过所述web登录识别模型对所述待检测特征进行归类；根据归类结果确定所述数据请求是否用于请求登录web系统。In another embodiment of the present invention, an optional implementation manner of the foregoing
其中，待检测特征包括URL、用户名、口令等。将这些待检测特征输入到web登录识别模型中后，登录识别模型可以先识别URL是否为web系统的URL；若是，则可以继续识别待检测特征中是否含有用户名、口令等用于请求登录web系统的的登录信息，若是，则确定该数据请求用于请求登录web系统。The features to be detected include URLs, usernames, passwords, and the like. After these features to be detected are input into the web login recognition model, the login recognition model can first identify whether the URL is the URL of the web system; if so, it can continue to identify whether the features to be detected contain user names, passwords, etc. for requesting to log in to the web The login information of the system, if yes, it is determined that the data request is used for requesting to log in to the web system.
在本发明的另一个实施例中，进一步介绍上述步骤103的一种可选实施方式，该方式包括：将所述数据请求所对应的数据响应与预设登录成功规则进行匹配；若匹配成功，则确定所述终端成功登录所述web系统；若匹配失败，则确定所述终端登录所述web系统失败。In another embodiment of the present invention, an optional implementation manner of the
具体的，判断所述数据请求所对应的数据响应中是否含有用于表征登录成功的Cookie；若含有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配成功；若没有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配失败。Specifically, it is determined whether the data response corresponding to the data request contains a cookie used to indicate successful login; if the cookie is included, it is determined that the data response is successfully matched with the preset login success rule; If the Cookie is selected, it is determined that the data response fails to match the preset login success rule.
其中，用于表征登录成功的Cookie可能是直接收到的Cookie，也可能是在终端页面跳转后收到的Cookie。Among them, the cookie used to represent the successful login may be the cookie received directly, or the cookie received after the terminal page jumps.
进一步的，依据上述方法实施例，本发明的另一个实施例还提供了一种弱口令的检测装置，如图2所示，所述装置主要包括：获取单元21、识别单元22、第一判断单元23和第二判断单元24。其中，Further, according to the above method embodiment, another embodiment of the present invention also provides a weak password detection device, as shown in FIG. 2 , the device mainly includes: an
获取单元21，用于获取终端发出的数据请求；an
识别单元22，用于利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；The
第一判断单元23，用于当所述数据请求用于请求登录web系统时，根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；a
第二判断单元24，用于当登录成功时，根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。The
可选的，如图3所示，所述识别单元22包括：Optionally, as shown in Figure 3, the identifying
提取模块221，用于从所述数据请求中提取待检测特征；
归类模块222，用于将所述待检测特征导入所述web登录识别模型，通过所述web登录识别模型对所述待检测特征进行归类；A
第一确定模块223，用于根据归类结果确定所述数据请求是否用于请求登录web系统。The first determining
可选的，如图3所示，所述第一判断单元23包括：Optionally, as shown in FIG. 3 , the
匹配模块231，用于将所述数据请求所对应的数据响应与预设登录成功规则进行匹配；A
第二确定模块232，用于当匹配成功时，确定所述终端成功登录所述web系统。The second determining
可选的，所述匹配模块231，用于判断所述数据请求所对应的数据响应中是否含有用于表征登录成功的Cookie；若含有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配成功。Optionally, the
可选的，所述登录特征包括以下任一项或多项的组合：Optionally, the login feature includes any one or a combination of the following:
统一资源定位符URL、用户名和口令。Uniform Resource Locator URL, username and password.
本发明实施例提供的弱口令的检测装置，能够先获取终端发出的数据请求，然后利用根据已知请求登录web系统的数据请求中的登录特征训练得到的人工智能模型web登录识别模型识别该数据请求是否用于请求登录web系统，当该数据请求用于请求登录web系统时，根据该数据请求所对应的数据响应判断该终端是否成功登录web系统，当登录成功时，根据预设弱口令规则来判断该数据请求中的口令是否为弱口令。由此可知，本发明实施例的第三方不仅能够识别出用户登录web系统时是否使用了弱口令，在识别数据请求是否用于请求登录web系统时，还可以利用具有机器自学习功能的web登录识别模型对已知请求登录web系统的登录行为进行自学习，识别出已知登录行为之外的登录行为，从而识别出更多的弱口令。The weak password detection device provided by the embodiment of the present invention can first obtain the data request sent by the terminal, and then use the artificial intelligence model web login recognition model trained according to the login feature in the data request for the known request to log in to the web system to identify the data Whether the request is used to request to log in to the web system, when the data request is used to request to log in to the web system, according to the data response corresponding to the data request to determine whether the terminal successfully logs in to the web system, when the login is successful, according to the preset weak password rules to determine whether the password in the data request is a weak password. It can be seen from this that the third party in the embodiment of the present invention can not only identify whether a weak password is used when the user logs in to the web system, but also can use a web login with a machine self-learning function when identifying whether the data request is used to log in to the web system The recognition model conducts self-learning on the login behaviors of known requests to log in to the web system, and identifies login behaviors other than known login behaviors, thereby identifying more weak passwords.
进一步的，依据上述方法实施例，本发明的另一个实施例还提供了一种存储介质，所述存储介质存储有多条指令，所述指令适用于由处理器加载并执行如上所述的弱口令的检测方法。Further, according to the above method embodiment, another embodiment of the present invention further provides a storage medium, the storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above-mentioned weak Password detection method.
存储介质可能包括计算机可读介质中的非永久性存储介质，随机存取存储介质(RAM)和/或非易失性内存等形式，如只读存储介质(ROM)或闪存(flash RAM)，存储介质包括至少一个存储芯片。Storage media may include non-persistent storage media in computer readable media, random access storage media (RAM) and/or non-volatile memory, such as read-only storage media (ROM) or flash memory (flash RAM), The storage medium includes at least one memory chip.
本发明实施例提供的存储介质中存储的指令，能够先获取终端发出的数据请求，然后利用根据已知请求登录web系统的数据请求中的登录特征训练得到的人工智能模型web登录识别模型识别该数据请求是否用于请求登录web系统，当该数据请求用于请求登录web系统时，根据该数据请求所对应的数据响应判断该终端是否成功登录web系统，当登录成功时，根据预设弱口令规则来判断该数据请求中的口令是否为弱口令。由此可知，本发明实施例的第三方不仅能够识别出用户登录web系统时是否使用了弱口令，在识别数据请求是否用于请求登录web系统时，还可以利用具有机器自学习功能的web登录识别模型对已知请求登录web系统的登录行为进行自学习，识别出已知登录行为之外的登录行为，从而识别出更多的弱口令。The instructions stored in the storage medium provided by the embodiment of the present invention can first obtain the data request sent by the terminal, and then use the artificial intelligence model web login recognition model trained according to the login feature in the data request for the known request to log in to the web system to identify the Whether the data request is used to request to log in to the web system, when the data request is used to request to log in to the web system, according to the data response corresponding to the data request to determine whether the terminal successfully logs in to the web system, when the login is successful, according to the preset weak password Rules to determine whether the password in the data request is a weak password. It can be seen from this that the third party in the embodiment of the present invention can not only identify whether a weak password is used when a user logs in to the web system, but also can use a web login with a machine self-learning function when identifying whether the data request is used to log in to the web system The recognition model conducts self-learning on the login behaviors of known requests to log in to the web system, and identifies login behaviors other than known login behaviors, thereby identifying more weak passwords.
进一步的，依据上述方法实施例，本发明的另一个实施例还提供了一种电子设备，所述电子设备包括存储介质和处理器；Further, according to the above method embodiment, another embodiment of the present invention further provides an electronic device, the electronic device includes a storage medium and a processor;
所述处理器，适于实现各指令；the processor, adapted to implement each instruction;
所述存储介质，适于存储多条指令；The storage medium is suitable for storing a plurality of instructions;
所述指令适于由所述处理器加载并执行如上所述的弱口令的检测方法。The instructions are adapted to be loaded by the processor and execute the weak password detection method as described above.
处理器中包含内核，由内核去存储器中调取相应的程序单元。内核可以设置一个或以上，通过调整内核参数来识别用户登录web系统是否使用了弱口令。The processor includes a kernel, and the kernel calls the corresponding program unit from the memory. The kernel can set one or more, by adjusting the kernel parameters to identify whether the user uses a weak password to log in to the web system.
本发明实施例提供的电子设备，能够先获取终端发出的数据请求，然后利用根据已知请求登录web系统的数据请求中的登录特征训练得到的人工智能模型web登录识别模型识别该数据请求是否用于请求登录web系统，当该数据请求用于请求登录web系统时，根据该数据请求所对应的数据响应判断该终端是否成功登录web系统，当登录成功时，根据预设弱口令规则来判断该数据请求中的口令是否为弱口令。由此可知，本发明实施例的第三方不仅能够识别出用户登录web系统时是否使用了弱口令，在识别数据请求是否用于请求登录web系统时，还可以利用具有机器自学习功能的web登录识别模型对已知请求登录web系统的登录行为进行自学习，识别出已知登录行为之外的登录行为，从而识别出更多的弱口令。The electronic device provided by the embodiment of the present invention can first obtain the data request sent by the terminal, and then use the artificial intelligence model web login recognition model trained according to the login feature in the data request for the known request to log in to the web system to identify whether the data request uses For requesting to log in to the web system, when the data request is used to request to log in to the web system, determine whether the terminal successfully logs in to the web system according to the data response corresponding to the data request, and when the login is successful, according to the preset weak password rule. Whether the password in the data request is a weak password. It can be seen from this that the third party in the embodiment of the present invention can not only identify whether a weak password is used when the user logs in to the web system, but also can use a web login with a machine self-learning function when identifying whether the data request is used to log in to the web system The recognition model conducts self-learning on the login behaviors of known requests to log in to the web system, and identifies login behaviors other than known login behaviors, thereby identifying more weak passwords.
本申请还提供了一种计算机程序产品，当在第三方设备上执行时，适于执行初始化有如下方法步骤的程序代码：The application also provides a computer program product, which, when executed on a third-party device, is suitable for executing program codes initialized with the following method steps:
获取终端发出的数据请求；Get the data request sent by the terminal;
利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；Utilize a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system, and the web login identification model is an artificial intelligence model obtained by training according to the login feature in the data request for the known request to log in to the web system;
若所述数据请求用于请求登录web系统，则根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；If the data request is for requesting to log in to the web system, determine whether the terminal successfully logs in to the web system according to the data response corresponding to the data request;
若登录成功，则根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。If the login is successful, it is determined whether the password in the data request is a weak password according to a preset weak password rule.
本发明实施例还公开了：The embodiment of the present invention also discloses:
A1、一种弱口令的检测方法，所述方法包括：A1. A method for detecting a weak password, the method comprising:
获取终端发出的数据请求；Get the data request sent by the terminal;
利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；Utilize a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system, and the web login identification model is an artificial intelligence model obtained by training according to the login feature in the data request for the known request to log in to the web system;
若所述数据请求用于请求登录web系统，则根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；If the data request is for requesting to log in to the web system, determine whether the terminal successfully logs in to the web system according to the data response corresponding to the data request;
若登录成功，则根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。If the login is successful, it is determined whether the password in the data request is a weak password according to a preset weak password rule.
A2、根据A1所述的方法，利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统包括：A2. According to the method described in A1, using a pre-established web login identification model to identify whether the data request is for requesting to log in to the web system includes:
从所述数据请求中提取待检测特征；extracting features to be detected from the data request;
将所述待检测特征导入所述web登录识别模型，通过所述web登录识别模型对所述待检测特征进行归类；importing the feature to be detected into the web login identification model, and classifying the feature to be detected by the web login identification model;
根据归类结果确定所述数据请求是否用于请求登录web系统。Whether the data request is for requesting to log in to the web system is determined according to the classification result.
A3、根据A1所述的方法，根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统包括：A3. According to the method of A1, judging whether the terminal successfully logs in to the web system according to the data response corresponding to the data request includes:
将所述数据请求所对应的数据响应与预设登录成功规则进行匹配；matching the data response corresponding to the data request with the preset login success rule;
若匹配成功，则确定所述终端成功登录所述web系统。If the matching is successful, it is determined that the terminal successfully logs in to the web system.
A4、根据A3所述的方法，将所述数据请求所对应的数据响应与预设登录成功规则进行匹配包括：A4. According to the method described in A3, matching the data response corresponding to the data request with the preset login success rule includes:
判断所述数据请求所对应的数据响应中是否含有用于表征登录成功的Cookie；Determine whether the data response corresponding to the data request contains a cookie used to represent successful login;
若含有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配成功。If the cookie is contained, it is determined that the data response is successfully matched with the preset login success rule.
A5、根据A1-A4中任一项所述的方法，所述登录特征包括以下任一项或多项的组合：A5. The method according to any one of A1-A4, wherein the login feature includes any one or a combination of the following:
统一资源定位符URL、用户名和口令。Uniform Resource Locator URL, username and password.
B6、一种弱口令的检测装置，所述装置包括：B6, a weak password detection device, the device comprises:
获取单元，用于获取终端发出的数据请求；an acquisition unit, used to acquire the data request sent by the terminal;
识别单元，用于利用预先建立的web登录识别模型识别所述数据请求是否用于请求登录web系统，所述web登录识别模型是根据已知请求登录web系统的数据请求中的登录特征进行训练得到的人工智能模型；The identification unit is used to identify whether the data request is for requesting to log in to the web system by using a pre-established web login identification model, and the web login identification model is obtained by training according to the login feature in the data request for the known request to log in to the web system artificial intelligence model;
第一判断单元，用于当所述数据请求用于请求登录web系统时，根据所述数据请求所对应的数据响应判断所述终端是否成功登录所述web系统；a first judging unit, configured to judge whether the terminal successfully logs in to the web system according to the data response corresponding to the data request when the data request is used for requesting to log in to the web system;
第二判断单元，用于当登录成功时，根据预设弱口令规则判断所述数据请求中的口令是否为弱口令。The second judging unit is configured to judge whether the password in the data request is a weak password according to the preset weak password rule when the login is successful.
B7、根据B6所述的装置，所述识别单元包括：B7. The device according to B6, wherein the identification unit comprises:
提取模块，用于从所述数据请求中提取待检测特征；an extraction module for extracting features to be detected from the data request;
归类模块，用于将所述待检测特征导入所述web登录识别模型，通过所述web登录识别模型对所述待检测特征进行归类；a classification module, configured to import the features to be detected into the web login recognition model, and classify the features to be detected by using the web login recognition model;
第一确定模块，用于根据归类结果确定所述数据请求是否用于请求登录web系统。The first determining module is configured to determine whether the data request is for requesting to log in to the web system according to the classification result.
B8、根据B6所述的装置，所述第一判断单元包括：B8. The device according to B6, wherein the first judgment unit includes:
匹配模块，用于将所述数据请求所对应的数据响应与预设登录成功规则进行匹配；a matching module, configured to match the data response corresponding to the data request with the preset login success rule;
第二确定模块，用于当匹配成功时，确定所述终端成功登录所述web系统。The second determining module is configured to determine that the terminal successfully logs in to the web system when the matching is successful.
B9、根据B8所述的装置，所述匹配模块，用于判断所述数据请求所对应的数据响应中是否含有用于表征登录成功的Cookie；若含有所述Cookie，则确定所述数据响应与所述预设登录成功规则匹配成功。B9. The device according to B8, wherein the matching module is used to determine whether the data response corresponding to the data request contains a cookie used to indicate successful login; The preset login success rule is matched successfully.
B10、根据B6-B9中任一项所述的装置，所述登录特征包括以下任一项或多项的组合：B10. The device according to any one of B6-B9, wherein the login feature includes any one or a combination of the following:
统一资源定位符URL、用户名和口令。Uniform Resource Locator URL, username and password.
C11、一种存储介质，所述存储介质存储有多条指令，所述指令适用于由处理器加载并执行如A1-A5中任一项所述的弱口令的检测方法。C11. A storage medium, the storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the weak password detection method according to any one of A1-A5.
D12、一种电子设备，所述电子设备包括存储介质和处理器；D12. An electronic device, the electronic device comprising a storage medium and a processor;
所述处理器，适于实现各指令；the processor, adapted to implement each instruction;
所述存储介质，适于存储多条指令；The storage medium is suitable for storing a plurality of instructions;
所述指令适于由所述处理器加载并执行如A1-A5中任一项所述的弱口令的检测方法。The instructions are adapted to be loaded by the processor and execute the weak password detection method as described in any one of A1-A5.
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.
可以理解的是，上述方法及装置中的相关特征可以相互参考。另外，上述实施例中的“第一”、“第二”等是用于区分各实施例，而并不代表各实施例的优劣。It can be understood that the relevant features in the above-mentioned methods and apparatuses may refer to each other. In addition, "first", "second", etc. in the above-mentioned embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求防护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求防护的实施例的任意之一都可以以任意的组合方式来使用。Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的弱口令的检测方法及装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that, in practice, a microprocessor or a digital signal processor (DSP) may be used to implement some or all functions of some or all of the components in the weak password detection method and apparatus according to the embodiments of the present invention . The present invention can also be implemented as apparatus or apparatus programs (eg, computer programs and computer program products) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811642809.9A CN111385272B (en) | 2018-12-29 | 2018-12-29 | Weak password detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811642809.9A CN111385272B (en) | 2018-12-29 | 2018-12-29 | Weak password detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111385272A true CN111385272A (en) | 2020-07-07 |
| CN111385272B CN111385272B (en) | 2024-06-21 |
Family
ID=71222311
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811642809.9A Active CN111385272B (en) | 2018-12-29 | 2018-12-29 | Weak password detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111385272B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112084487A (en) * | 2020-09-10 | 2020-12-15 | 北京天融信网络安全技术有限公司 | Weak password analysis method and device, storage medium and electronic equipment |
| CN112613029A (en) * | 2021-01-06 | 2021-04-06 | 深信服科技股份有限公司 | Weak password detection method and device, computer storage medium and equipment |
| CN114006773A (en) * | 2021-12-31 | 2022-02-01 | 北京微步在线科技有限公司 | Weak password judgment method, device, equipment and storage medium |
Citations (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090055910A1 (en) * | 2007-08-20 | 2009-02-26 | Lee Mark C | System and methods for weak authentication data reinforcement |
| US20130055379A1 (en) * | 2011-08-23 | 2013-02-28 | Research In Motion Limited | System, device and method for authentication |
| US20130097697A1 (en) * | 2011-10-14 | 2013-04-18 | Microsoft Corporation | Security Primitives Employing Hard Artificial Intelligence Problems |
| CN103701805A (en) * | 2013-12-26 | 2014-04-02 | 山石网科通信技术有限公司 | Method and device for detecting weak password in network |
| CN104717219A (en) * | 2015-03-20 | 2015-06-17 | 百度在线网络技术（北京）有限公司 | Vocal print login method and device based on artificial intelligence |
| CN105656887A (en) * | 2015-12-30 | 2016-06-08 | 百度在线网络技术（北京）有限公司 | Artificial intelligence-based voiceprint authentication method and device |
| CN105871825A (en) * | 2016-03-28 | 2016-08-17 | 深圳市双赢伟业科技股份有限公司 | Method and system for security detection of router |
| CN106790149A (en) * | 2016-12-28 | 2017-05-31 | 北京安天网络安全技术有限公司 | The method and system that a kind of defence IoT equipment is invaded |
| CN106934274A (en) * | 2015-12-31 | 2017-07-07 | 中国移动通信集团黑龙江有限公司 | A kind of weak passwurd detection method, apparatus and system |
| CN107196899A (en) * | 2017-03-21 | 2017-09-22 | 北京神州泰岳软件股份有限公司 | Equipment weak passwurd management method and device |
| CN107330331A (en) * | 2016-04-29 | 2017-11-07 | 阿里巴巴集团控股有限公司 | There are the methods, devices and systems of the system of leak in identification |
| CN107426231A (en) * | 2017-08-03 | 2017-12-01 | 北京奇安信科技有限公司 | A kind of method and device for identifying user behavior |
| CN107465642A (en) * | 2016-06-02 | 2017-12-12 | 百度在线网络技术（北京）有限公司 | A kind of method and device for judging account abnormal login |
| US20180041537A1 (en) * | 2016-08-02 | 2018-02-08 | Sophos Limited | Identifying and remediating phishing security weaknesses |
| CN107707553A (en) * | 2017-10-18 | 2018-02-16 | 北京启明星辰信息安全技术有限公司 | Weak passwurd scan method, device and computer-readable storage medium |
| CN107846415A (en) * | 2017-12-11 | 2018-03-27 | 北京奇虎科技有限公司 | A server login method and device |
| CN108053247A (en) * | 2017-12-15 | 2018-05-18 | 北京知道创宇信息技术有限公司 | A kind of false amount identification model generation method, false amount recognition methods and computing device |
| CN108768824A (en) * | 2018-05-15 | 2018-11-06 | 腾讯科技（深圳）有限公司 | Information processing method and device |
| CN108763920A (en) * | 2018-05-23 | 2018-11-06 | 四川大学 | A kind of password strength assessment model based on integrated study |
| CN108809895A (en) * | 2017-04-27 | 2018-11-13 | 腾讯科技（深圳）有限公司 | The detection method and device of weak passwurd |
| CN108881138A (en) * | 2017-10-26 | 2018-11-23 | 新华三信息安全技术有限公司 | A kind of web-page requests recognition methods and device |
-
2018
- 2018-12-29 CN CN201811642809.9A patent/CN111385272B/en active Active
Patent Citations (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090055910A1 (en) * | 2007-08-20 | 2009-02-26 | Lee Mark C | System and methods for weak authentication data reinforcement |
| US20130055379A1 (en) * | 2011-08-23 | 2013-02-28 | Research In Motion Limited | System, device and method for authentication |
| US20130097697A1 (en) * | 2011-10-14 | 2013-04-18 | Microsoft Corporation | Security Primitives Employing Hard Artificial Intelligence Problems |
| CN103701805A (en) * | 2013-12-26 | 2014-04-02 | 山石网科通信技术有限公司 | Method and device for detecting weak password in network |
| CN104717219A (en) * | 2015-03-20 | 2015-06-17 | 百度在线网络技术（北京）有限公司 | Vocal print login method and device based on artificial intelligence |
| CN105656887A (en) * | 2015-12-30 | 2016-06-08 | 百度在线网络技术（北京）有限公司 | Artificial intelligence-based voiceprint authentication method and device |
| CN106934274A (en) * | 2015-12-31 | 2017-07-07 | 中国移动通信集团黑龙江有限公司 | A kind of weak passwurd detection method, apparatus and system |
| CN105871825A (en) * | 2016-03-28 | 2016-08-17 | 深圳市双赢伟业科技股份有限公司 | Method and system for security detection of router |
| CN107330331A (en) * | 2016-04-29 | 2017-11-07 | 阿里巴巴集团控股有限公司 | There are the methods, devices and systems of the system of leak in identification |
| CN107465642A (en) * | 2016-06-02 | 2017-12-12 | 百度在线网络技术（北京）有限公司 | A kind of method and device for judging account abnormal login |
| US20180041537A1 (en) * | 2016-08-02 | 2018-02-08 | Sophos Limited | Identifying and remediating phishing security weaknesses |
| CN106790149A (en) * | 2016-12-28 | 2017-05-31 | 北京安天网络安全技术有限公司 | The method and system that a kind of defence IoT equipment is invaded |
| CN107196899A (en) * | 2017-03-21 | 2017-09-22 | 北京神州泰岳软件股份有限公司 | Equipment weak passwurd management method and device |
| CN108809895A (en) * | 2017-04-27 | 2018-11-13 | 腾讯科技（深圳）有限公司 | The detection method and device of weak passwurd |
| CN107426231A (en) * | 2017-08-03 | 2017-12-01 | 北京奇安信科技有限公司 | A kind of method and device for identifying user behavior |
| CN107707553A (en) * | 2017-10-18 | 2018-02-16 | 北京启明星辰信息安全技术有限公司 | Weak passwurd scan method, device and computer-readable storage medium |
| CN108881138A (en) * | 2017-10-26 | 2018-11-23 | 新华三信息安全技术有限公司 | A kind of web-page requests recognition methods and device |
| CN107846415A (en) * | 2017-12-11 | 2018-03-27 | 北京奇虎科技有限公司 | A server login method and device |
| CN108053247A (en) * | 2017-12-15 | 2018-05-18 | 北京知道创宇信息技术有限公司 | A kind of false amount identification model generation method, false amount recognition methods and computing device |
| CN108768824A (en) * | 2018-05-15 | 2018-11-06 | 腾讯科技（深圳）有限公司 | Information processing method and device |
| CN108763920A (en) * | 2018-05-23 | 2018-11-06 | 四川大学 | A kind of password strength assessment model based on integrated study |
Non-Patent Citations (6)
| Title |
|---|
| SHUO ZHAI等: ""Design and implementation of password-based identity authentication system"", 《2010 INTERNATIONAL CONFERENCE ON COMPUTER APPLICATION AND SYSTEM MODELING (ICCASM 2010)》 * |
| 何金栋: ""Web中间件弱口令检测系统的设计和实现"", 《通讯世界》 * |
| 张滨: ""人工智能在安全领域的应用"", 《电信工程技术与标准化》, 15 December 2018 (2018-12-15) * |
| 时宗胜;: "人工智能技术在移动互联网中的应用研究", 数字通信世界, no. 10, 1 October 2017 (2017-10-01) * |
| 黄志威;: "改进的AdaBoost检测算法在身份识别中的应用", 科技通报, no. 10, 31 October 2015 (2015-10-31) * |
| 黎源等: ""集中弱口令检查系统的分析与设计"", 《中小企业管理与科技(上旬刊)》 * |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112084487A (en) * | 2020-09-10 | 2020-12-15 | 北京天融信网络安全技术有限公司 | Weak password analysis method and device, storage medium and electronic equipment |
| CN112613029A (en) * | 2021-01-06 | 2021-04-06 | 深信服科技股份有限公司 | Weak password detection method and device, computer storage medium and equipment |
| CN114006773A (en) * | 2021-12-31 | 2022-02-01 | 北京微步在线科技有限公司 | Weak password judgment method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111385272B (en) | 2024-06-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108683666B (en) | Webpage identification method and device | |
| CN109167797B (en) | Network attack analysis method and device | |
| US11582139B2 (en) | System, method and computer readable medium for determining an event generator type | |
| CN103685307B (en) | The method and system of feature based storehouse detection fishing fraud webpage, client, server | |
| CN105991590B (en) | A kind of method, system, client and server for verifying user identity | |
| US12021894B2 (en) | Phishing detection based on modeling of web page content | |
| CN110413908A (en) | The method and apparatus classified based on web site contents to uniform resource locator | |
| WO2015039553A1 (en) | Method and system for identifying fraudulent websites priority claim and related application | |
| KR20180079423A (en) | Dynamic update of CAPTCHA Challenge | |
| CN112287355B (en) | Vulnerability detection method and device, computer equipment and storage medium | |
| CN108718298B (en) | Malicious external connection flow detection method and device | |
| CN107528818B (en) | Data processing method and device for media file | |
| US11301560B2 (en) | Real-time detection and blocking of counterfeit websites | |
| US12041084B2 (en) | Systems and methods for determining user intent at a website and responding to the user intent | |
| CN111385272A (en) | Method and device for detecting weak password | |
| CN106304070B (en) | A kind of network automatic connection method and device | |
| CN103986731A (en) | Method and device for detecting phishing web pages through image matching | |
| CN108156165A (en) | A kind of method and system for reporting detection by mistake | |
| CN107766224B (en) | Test method and test device | |
| CN112887329B (en) | Hidden service traceability method, device and electronic equipment | |
| CN103647652B (en) | A kind of method for realizing data transfer, device and server | |
| CN113836509B (en) | Information acquisition method, device, electronic equipment and storage medium | |
| CN108920955B (en) | Webpage backdoor detection method, device, equipment and storage medium | |
| CN110213341B (en) | Method and device for detecting downloading of application program | |
| CN117541379A (en) | Information self-certification method and device, electronic equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |