Research on multi-granularity password analysis based on LLM

Meng HONG; Weidong QIU; Yangde WANG

doi:10.11959/j.issn.2096-109x.2024008

您当前的位置：

首页 >

文章列表页 >

Research on multi-granularity password analysis based on LLM

Papers | 更新时间：2024-06-03

- Research on multi-granularity password analysis based on LLM
- Chinese Journal of Network and Information Security Vol. 10, Issue 1, Pages: 112-122(2024)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024008
  CLC： TP309
- Online First：2024-02，
  
  Published：25 February 2024
- 稿件说明：
移动端阅览
Meng HONG, Weidong QIU, Yangde WANG. Research on multi-granularity password analysis based on LLM[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 112-122.
DOI：

Meng HONG, Weidong QIU, Yangde WANG. Research on multi-granularity password analysis based on LLM[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 112-122. DOI： 10.11959/j.issn.2096-109x.2024008.

摘要

基于口令的认证是常见的身份认证机制。然而，大规模口令泄露事件时有发生，表明口令仍面临着被猜测或者盗用等风险。由于口令可以被视作一种特殊的自然语言，近年来运用自然语言处理技术进行口令分析的研究工作逐渐展开。目前少有工作在大语言模型（LLM，large language model）上探究口令文本分词粒度对口令分析效果的影响。为此，提出了基于 LLM 的多粒度口令分析框架，总体上沿用预训练范式，在大量未标记数据集上自主学习口令分布先验知识。该框架由同步网络、主干网络、尾部网络3个模块构成。其中，同步网络模块实现了char-level、template-level和chunk-level这3种粒度的口令分词，并提取了口令的字符分布、结构、词块组成等特征知识；主干网络模块构建了通用的口令模型来学习口令组成规律；尾部网络模块生成了候选口令对目标库进行猜测分析。在Tianya、Twitter等8个口令库上进行大量实验，分析总结了多粒度分词下所提框架在不同语言环境中的口令分析效果。实验结果表明，在中文用户场景中，基于char-level和chunk-level分词的框架口令分析性能接近一致，且显著优于基于template-level分词的框架；在英文用户场景中，基于chunk-level分词的框架口令分析性能最佳。

Abstract

Password-based authentication has been widely used as the primary authentication mechanism.However

occasional large-scale password leaks have highlighted the vulnerability of passwords to risks such as guessing or theft.In recent years

research on password analysis using natural language processing techniques has progressed

treating passwords as a special form of natural language.Nevertheless

limited studies have investigated the impact of password text segmentation granularity on the effectiveness of password analysis with large language models.A multi-granularity password-analyzing framework was proposed based on a large language model

which follows the pre-training paradigm and autonomously learns prior knowledge of password distribution from large unlabelled datasets.The framework comprised three modules: the synchronization network

backbone network

and tail network.The synchronization network module implemented char-level

template-level

and chunk-level password segmentation

extracting knowledge on character distribution

structure

word chunk composition

and other password features.The backbone network module constructed a generic password model to learn the rules governing password composition.The tail network module generated candidate passwords for guessing and analyzing target databases.Experimental evaluations were conducted on eight password databases including Tianya and Twitter

analyzing and summarizing the effectiveness of the proposed framework under different language environments and word segmentation granularities.The results indicate that in Chinese user scenarios

the performance of the password-analyzing framework based on char-level and chunk-level segmentation is comparable

and significantly superior to the framework based on template-level segmentation.In English user scenarios

the framework based on chunk-level segmentation demonstrates the best password-analyzing performance.

关键词

Keywords

references

BONNEAU J , HERLEY C , OORSCHOT P C V , et al . The quest to replace passwords:a framework for comparative evaluation of web authentication schemes [C ] // Proceedings of 2012 IEEE Symposium on Security and Privacy . 2012 : 553 - 567 .

BONNEAU J , HERLEY C , VAN OORSCHOT P C , et al . Passwords and the evolution of imperfect authentication [J ] . Communications of the ACM , 2015 , 58 ( 7 ): 78 - 87 .

YAN J , BLACKWELL A , ANDERSON R , et al . Password memorability and security:empirical results [J ] . IEEE Security ＆ Privacy , 2004 , 2 ( 5 ): 25 - 31 .

DELL'AMICO M , MICHIARDI P , ROUDIER Y . Measuring password strength:an empirical analysis [J ] . arXiv preprint arXiv:0907.3402 , 2009 .

MA J , YANG W N , LUO M , et al . A study of probabilistic password models [C ] // Proceedings of 2014 IEEE Symposium on Security and Privacy . 2014 : 689 - 704 .

DÜRMUTH M , ANGELSTORF F , CASTELLUCCIA C , et al . OMEN:faster password guessing using an ordered Markov enumerator [C ] // Proceedings of International Symposium on Engineering Secure Software and Systems . 2015 : 119 - 132 .

MELICHER W , UR B , SEGRETI S M , et al . Fast,lean,and accurate:modeling password guess ability using neural networks [C ] // Proceedings of the 25th USENIX Conference on Security Symposium . 2016 : 175 - 191 .

WEIR M , AGGARWAL S , MEDEIROS B D , et al . Password cracking using probabilistic context-free grammars [C ] // Proceedings of 2009 30th IEEE Symposium on Security and Privacy . 2009 : 391 - 405 .

PASQUINI D , GANGWAL A , ATENIESE G , et al . Improving password guessing via representation learning [C ] // Proceedings of 2021 IEEE Symposium on Security and Privacy (SP) . 2021 : 1382 - 1399 .

NARAYANAN A , SHMATIKOV V . Fast dictionary attacks on passwords using time-space tradeoff [C ] // Proceedings of the 12th ACM Conference on Computer and Communications Security . 2005 : 364 - 372 .

CASTELLUCCIA C , DÜRMUTH M , PERITO D . Adaptive password-strength meters from Markov models [C ] // Proceedings of NDSS . 2012 .

CHOU H C , LEE H C , YU H J , et al . Password cracking based on learned patterns from disclosed passwords [J ] . IJICIC , 2013 , 9 ( 2 ): 821 - 839 .

SHAY R , KOMANDURI S , KELLEY P G , et al . Encountering stronger password requirements:user attitudes and behaviors [C ] // Proceedings of the Sixth Symposium on Usable Privacy and Security . 2010 : 1 - 20 .

VERAS R , COLLINS C , THORPE J . On semantic patterns of passwords and their security impact [C ] // Proceedings of NDSS . 2014 .

XU M , YU J , ZHANG X , et al . Improving real-world password guessing attacks via bi-directional transformers [C ] // Proceedings of 32nd USENIX Security Symposium (USENIX Security 23) . 2023 : 1001 - 1018 .

ZHAO W X , ZHOU K , LI J , et al . A survey of large language models [J ] . arXiv preprint arXiv:2303.18223 , 2023 .

SHANAHAN M . Talking about large language models [J ] . arXiv preprint arXiv:2212.03551 , 2022 .

QIU X P , SUN T X , XU Y G , et al . Pre-trained models for natural language processing:a survey [J ] . Science China Technological Sciences , 2020 , 63 ( 10 ): 1872 - 1897 .

HAN X , ZHANG Z Y , DING N , et al . Pre-trained models:past,present and future [J ] . AI Open , 2021 , 2 : 225 - 250 .

RADFORD A , WU J , CHILD R , et al . Language models are unsupervised multitask learners [J ] . OpenAI Blog , 2019 , 1 ( 8 ): 9 .

RANDO J , PÉREZ-CRUZ F , HITAJ B . PassGPT:password modeling and (guided) generation with large language models [J ] . arXiv preprint arXiv:2306.01545 , 2023 .

XU M , WANG C W , YU J T , et al . Chunk-level password guessing:towards modeling refined password composition representations [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 5 - 20 .

LI H , CHEN M Q , YAN S B , et al . Password guessing via neural language modeling [M ] // Machine Learning for Cyber Security . 2019 : 78 - 93 .

DELL'AMICO M , FILIPPONE M . Monte Carlo strength evaluation:fast and reliable password checking [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 158 - 169 .

GAGE P . A new algorithm for data compression [J ] . C Users Journal , 1994 , 12 ( 2 ): 23 - 38 .

DEVLIN J , CHANG M W , LEE K , et al . Bert:pre-training of deep bidirectional transformers for language understanding [J ] . arXiv preprint arXiv:1810.04805 , 2018 .

YANG Z , DAI Z , YANG Y , et al . XLNet:generalized autoregressive pretraining for language understanding [J ] . Advances in Neural Information Processing Systems , 2019 ,32.

HITAJ B , GASTI P , ATENIESE G , et al . PassGAN:A deep learning approach for password guessing [M ] // Applied Cryptography and Network Security . Cham : Springer International Publishing , 2019 : 217 - 237 .

Views

157

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system

Bidirectional privacy authorization for large models based on private set intersection

mmDefender: enhancing large language model with multimodal multilingual adversarial training

Survey on automated vulnerability mining techniques for IoT device firmware

Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle

Related Author

Han Hao

Wu Zicheng

Zhao Xinjian

Ding Yixin

WANG Yuanyuan

FENG Haokang

WU Xuguang

HAN Yiliang

Related Institution

State Grid Jiangsu Electric Power Co., Ltd.

Nanjing University of Aeronautics and Astronautics

College of Cryptography Engineering, Engineering University of PAP

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, China Electric Power Research Institute

⁰