| 引用本文： |
-
白小凡,王俊琦,赵易如,王笑克,赵磊.基于行为仿真的Web系统口令安全测试方法[J].信息安全学报,2026,11(3):1-17 [点击复制]
- BAI Xiaofan,WANG Junqi,ZHAO Yiru,WANG Xiaoke,ZHAO Lei.A Behavioral Simulation Approach for Password Security Testing in Web Systems[J].Journal of Cyber Security,2026,11(3):1-17 [点击复制]
|
|
| |
|
|
| 本文已被：浏览 558次 下载 300次 |
码上扫一扫！ |
| 基于行为仿真的Web系统口令安全测试方法 |
|
白小凡1,2, 王俊琦1,2, 赵易如1,2, 王笑克1,2, 赵磊1,2
|
|
|
| (1.武汉大学国家网络安全学院 武汉 中国 430072;2.武汉大学空天信息安全与可信计算教育部重点实验室 武汉 中国 430072) |
|
| 摘要: |
| 身份认证是保障信息系统安全的重要手段,自20世纪70年代以来,口令一直是最常用的身份认证方式。然而,由于低信息熵弱口令的滥用和凭证泄露事件的频繁发生,基于口令的身份认证面临安全挑战。攻击者能够利用暴力破解和凭证填充等方式入侵系统,威胁信息系统的整体安全性。现有的自动化口令安全检测方法主要包括脚本集成方法、基于分析登录表单构造报文的方法和脚本录制方法。然而,这些方法在通用性、有效性和大规模检测效率等方面存在显著局限,难以应对现代Web系统中复杂多样的身份认证机制。为应对上述挑战,本文提出了一种基于行为仿真的Web系统口令安全测试方法。该方法首先设计了三种登录行为模型,即单步式登录、分段式登录和弹出式登录,并基于这些模型提出了标签定位与登录行为链的自动化构造方法,从而实现了基于行为仿真的凭证提交。此外,本文提出了一种基于差分比较的报文重构策略,通过差分分析识别加密、签名等防护机制,并针对不同的保护策略选择相应的报文重构方法。实验结果表明,本文提出的方法在登录页面识别准确率、报文构造通用性及大规模检测效率等方面均显著优于现有方法。其中,登录页面识别误报率在两个数据集上分别为0.52%和1.68%,显著低于Shepherd方法的30.30%。本文的研究为提升现代Web系统的口令安全性提供了一种高效可行的解决方案。 |
| 关键词: 身份认证 不安全口令 登录行为模型 行为仿真 |
| DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.01 |
| 投稿时间：2024-10-22修订日期：2025-02-25 |
| 基金项目:本课题得到国家自然科学基金项目(No.U2436205,No.62532008,No.62172305)和中国博士后科学基金会与湖北省联合资助项目(No.2025T054HB)资助。 |
|
| A Behavioral Simulation Approach for Password Security Testing in Web Systems |
|
BAI Xiaofan1,2, WANG Junqi1,2, ZHAO Yiru1,2, WANG Xiaoke1,2, ZHAO Lei1,2
|
| (1.School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China;2.Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Education, Wuhan University, Wuhan 430072, China) |
| Abstract: |
| Authentication is a fundamental measure to ensure the security of information systems. Since the 1970s, passwords have been the most widely used method for authentication. However, the widespread use of weak passwords with low entropy and the frequent occurrence of credential leakage incidents have introduced significant security challenges to password-based authentication. Attackers often exploit vulnerabilities through brute force attacks and credential stuffing, jeopardizing the overall security of information systems. Existing automated password security detection methods, such as script integration, login form-based message construction, and script recording, suffer from notable limitations in generality, effectiveness, and scalability. These constraints hinder their ability to address the increasingly complex and diverse authentication mechanisms prevalent in modern web systems. To overcome these challenges, this study presents a novel password security testing approach for web systems based on behavioral simulation. The method begins with the design of three distinct login behavior models: single-step login, multi-step login, and popup login. Building upon these models, an automated mechanism for label identification and login behavior chain construction is introduced, enabling a simulated and adaptive credential submission process. Additionally, a differential comparison-based message reconstruction strategy is proposed, leveraging differential analysis to identify protective mechanisms such as encryption and digital signatures. Tailored reconstruction methods are then applied based on the identified protection strategies. Experimental results provide strong evidence of the proposed approach’s superiority in login page identification accuracy, message construction generality, and large-scale detection efficiency, as measured by credential submission time. Notably, the false positive rates for login page identification are 0.52% and 1.68% across two datasets, significantly outperforming the 30.30% rate achieved by the Shepherd method. This research offers an efficient and robust solution for improving password security in modern web systems. |
| Key words: authentication insecure passwords login behavior model behavioral simulation |
|
|
|
|
|
