基于LLM的多粒度口令分析研究

洪萌; 邱卫东; 王杨德

doi:10.11959/j.issn.2096-109x.2024008

您当前的位置：

首页 >

文章列表页 >

基于LLM的多粒度口令分析研究

学术论文 | 更新时间：2024-06-03

- 基于LLM的多粒度口令分析研究
- Research on multi-granularity password analysis based on LLM
- 网络与信息安全学报 2024年10卷第1期页码：112-122
- 作者机构：
- 作者简介：
  
  [ "洪萌（1995− ），女，江苏南通人，上海交通大学硕士生，主要研究方向为密码分析" ]
  [ "邱卫东（1973− ），男，江西修水人，上海交通大学教授、博士生导师，主要研究方向为计算机取证、密码分析、人工智能安全、大数据隐私保护" ]
  [ "王杨德（1987− ），男，辽宁沈阳人，上海交通大学博士生，主要研究方向为计算机取证、密码分析" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61972249);国家重点研发计划;The National Key R＆D Program of China(2023YFB3106501)
- DOI：10.11959/j.issn.2096-109x.2024008
  中图分类号： TP309
- 网络首发：2024-02，
  
  纸质出版：2024-02-25
- 稿件说明：
移动端阅览
洪萌, 邱卫东, 王杨德. 基于LLM的多粒度口令分析研究[J]. 网络与信息安全学报, 2024,10(1):112-122.

Meng HONG, Weidong QIU, Yangde WANG. Research on multi-granularity password analysis based on LLM[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 112-122.
洪萌, 邱卫东, 王杨德. 基于LLM的多粒度口令分析研究[J]. 网络与信息安全学报, 2024,10(1):112-122. DOI： 10.11959/j.issn.2096-109x.2024008.

Meng HONG, Weidong QIU, Yangde WANG. Research on multi-granularity password analysis based on LLM[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 112-122. DOI： 10.11959/j.issn.2096-109x.2024008.

摘要

基于口令的认证是常见的身份认证机制。然而，大规模口令泄露事件时有发生，表明口令仍面临着被猜测或者盗用等风险。由于口令可以被视作一种特殊的自然语言，近年来运用自然语言处理技术进行口令分析的研究工作逐渐展开。目前少有工作在大语言模型（LLM，large language model）上探究口令文本分词粒度对口令分析效果的影响。为此，提出了基于 LLM 的多粒度口令分析框架，总体上沿用预训练范式，在大量未标记数据集上自主学习口令分布先验知识。该框架由同步网络、主干网络、尾部网络3个模块构成。其中，同步网络模块实现了char-level、template-level和chunk-level这3种粒度的口令分词，并提取了口令的字符分布、结构、词块组成等特征知识；主干网络模块构建了通用的口令模型来学习口令组成规律；尾部网络模块生成了候选口令对目标库进行猜测分析。在Tianya、Twitter等8个口令库上进行大量实验，分析总结了多粒度分词下所提框架在不同语言环境中的口令分析效果。实验结果表明，在中文用户场景中，基于char-level和chunk-level分词的框架口令分析性能接近一致，且显著优于基于template-level分词的框架；在英文用户场景中，基于chunk-level分词的框架口令分析性能最佳。

Abstract

Password-based authentication has been widely used as the primary authentication mechanism.However

occasional large-scale password leaks have highlighted the vulnerability of passwords to risks such as guessing or theft.In recent years

research on password analysis using natural language processing techniques has progressed

treating passwords as a special form of natural language.Nevertheless

limited studies have investigated the impact of password text segmentation granularity on the effectiveness of password analysis with large language models.A multi-granularity password-analyzing framework was proposed based on a large language model

which follows the pre-training paradigm and autonomously learns prior knowledge of password distribution from large unlabelled datasets.The framework comprised three modules: the synchronization network

backbone network

and tail network.The synchronization network module implemented char-level

template-level

and chunk-level password segmentation

extracting knowledge on character distribution

structure

word chunk composition

and other password features.The backbone network module constructed a generic password model to learn the rules governing password composition.The tail network module generated candidate passwords for guessing and analyzing target databases.Experimental evaluations were conducted on eight password databases including Tianya and Twitter

analyzing and summarizing the effectiveness of the proposed framework under different language environments and word segmentation granularities.The results indicate that in Chinese user scenarios

the performance of the password-analyzing framework based on char-level and chunk-level segmentation is comparable

and significantly superior to the framework based on template-level segmentation.In English user scenarios

the framework based on chunk-level segmentation demonstrates the best password-analyzing performance.

关键词

Keywords

references

BONNEAU J , HERLEY C , OORSCHOT P C V , et al . The quest to replace passwords:a framework for comparative evaluation of web authentication schemes [C ] // Proceedings of 2012 IEEE Symposium on Security and Privacy . 2012 : 553 - 567 .

BONNEAU J , HERLEY C , VAN OORSCHOT P C , et al . Passwords and the evolution of imperfect authentication [J ] . Communications of the ACM , 2015 , 58 ( 7 ): 78 - 87 .

YAN J , BLACKWELL A , ANDERSON R , et al . Password memorability and security:empirical results [J ] . IEEE Security ＆ Privacy , 2004 , 2 ( 5 ): 25 - 31 .

DELL'AMICO M , MICHIARDI P , ROUDIER Y . Measuring password strength:an empirical analysis [J ] . arXiv preprint arXiv:0907.3402 , 2009 .

MA J , YANG W N , LUO M , et al . A study of probabilistic password models [C ] // Proceedings of 2014 IEEE Symposium on Security and Privacy . 2014 : 689 - 704 .

DÜRMUTH M , ANGELSTORF F , CASTELLUCCIA C , et al . OMEN:faster password guessing using an ordered Markov enumerator [C ] // Proceedings of International Symposium on Engineering Secure Software and Systems . 2015 : 119 - 132 .

MELICHER W , UR B , SEGRETI S M , et al . Fast,lean,and accurate:modeling password guess ability using neural networks [C ] // Proceedings of the 25th USENIX Conference on Security Symposium . 2016 : 175 - 191 .

WEIR M , AGGARWAL S , MEDEIROS B D , et al . Password cracking using probabilistic context-free grammars [C ] // Proceedings of 2009 30th IEEE Symposium on Security and Privacy . 2009 : 391 - 405 .

PASQUINI D , GANGWAL A , ATENIESE G , et al . Improving password guessing via representation learning [C ] // Proceedings of 2021 IEEE Symposium on Security and Privacy (SP) . 2021 : 1382 - 1399 .

NARAYANAN A , SHMATIKOV V . Fast dictionary attacks on passwords using time-space tradeoff [C ] // Proceedings of the 12th ACM Conference on Computer and Communications Security . 2005 : 364 - 372 .

CASTELLUCCIA C , DÜRMUTH M , PERITO D . Adaptive password-strength meters from Markov models [C ] // Proceedings of NDSS . 2012 .

CHOU H C , LEE H C , YU H J , et al . Password cracking based on learned patterns from disclosed passwords [J ] . IJICIC , 2013 , 9 ( 2 ): 821 - 839 .

SHAY R , KOMANDURI S , KELLEY P G , et al . Encountering stronger password requirements:user attitudes and behaviors [C ] // Proceedings of the Sixth Symposium on Usable Privacy and Security . 2010 : 1 - 20 .

VERAS R , COLLINS C , THORPE J . On semantic patterns of passwords and their security impact [C ] // Proceedings of NDSS . 2014 .

XU M , YU J , ZHANG X , et al . Improving real-world password guessing attacks via bi-directional transformers [C ] // Proceedings of 32nd USENIX Security Symposium (USENIX Security 23) . 2023 : 1001 - 1018 .

ZHAO W X , ZHOU K , LI J , et al . A survey of large language models [J ] . arXiv preprint arXiv:2303.18223 , 2023 .

SHANAHAN M . Talking about large language models [J ] . arXiv preprint arXiv:2212.03551 , 2022 .

QIU X P , SUN T X , XU Y G , et al . Pre-trained models for natural language processing:a survey [J ] . Science China Technological Sciences , 2020 , 63 ( 10 ): 1872 - 1897 .

HAN X , ZHANG Z Y , DING N , et al . Pre-trained models:past,present and future [J ] . AI Open , 2021 , 2 : 225 - 250 .

RADFORD A , WU J , CHILD R , et al . Language models are unsupervised multitask learners [J ] . OpenAI Blog , 2019 , 1 ( 8 ): 9 .

RANDO J , PÉREZ-CRUZ F , HITAJ B . PassGPT:password modeling and (guided) generation with large language models [J ] . arXiv preprint arXiv:2306.01545 , 2023 .

XU M , WANG C W , YU J T , et al . Chunk-level password guessing:towards modeling refined password composition representations [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 5 - 20 .

LI H , CHEN M Q , YAN S B , et al . Password guessing via neural language modeling [M ] // Machine Learning for Cyber Security . 2019 : 78 - 93 .

DELL'AMICO M , FILIPPONE M . Monte Carlo strength evaluation:fast and reliable password checking [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 158 - 169 .

GAGE P . A new algorithm for data compression [J ] . C Users Journal , 1994 , 12 ( 2 ): 23 - 38 .

DEVLIN J , CHANG M W , LEE K , et al . Bert:pre-training of deep bidirectional transformers for language understanding [J ] . arXiv preprint arXiv:1810.04805 , 2018 .

YANG Z , DAI Z , YANG Y , et al . XLNet:generalized autoregressive pretraining for language understanding [J ] . Advances in Neural Information Processing Systems , 2019 ,32.

HITAJ B , GASTI P , ATENIESE G , et al . PassGAN:A deep learning approach for password guessing [M ] // Applied Cryptography and Network Security . Cham : Springer International Publishing , 2019 : 217 - 237 .

浏览量

157

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

AutoVulnFix: 大语言模型驱动的智能搜索自适应漏洞修复系统

基于隐私集合求交的大模型双向隐私授权

mmDefender: 基于多模态多语言对抗训练的大语言模型增强方法

物联网设备固件自动化漏洞挖掘技术研究综述

“最小必要”原则视角检测移动应用程序的隐私合规性