A Targeted Online Password Guessing Method Based on Pointer Generation Network

Abstract

This invention discloses a targeted online password guessing method based on a pointer generation network. The steps include: 1) selecting a password dataset, which includes personal information and corresponding passwords of multiple users; 2) extracting the required attribute information from the personal information in the password dataset, and representing the extracted attributes according to various preset information formats to obtain a list of personal information of the corresponding user; based on the user's personal information list, segmenting the user's password using a forward maximum matching method to obtain a list of password fragments of the corresponding user; 3) training a pointer generation network using the processing result of step 2); 4) for a target user, generating the target user's personal information list and inputting it into the trained pointer generation network to generate guessed password fragments, and then combining the generated password fragments into multiple candidate passwords; then selecting K candidate passwords as the password of the target user.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a targeted online password guessing method based on pointer generation networks. Background Technology

[0002] Based on the method of guessing the password and whether it uses the user's personal information, password guessing methods can be divided into offline guessing and targeted online guessing. Commonly used targeted online password guessing methods mainly include the following:

[0003] 1) Personal-PCFG. Based on the original Probabilistic Context-Free Grammar (PCFG) model, this model introduces six categories of personal information: birthday, name, email address, username, mobile phone number, and ID card number. The model employs a length-based matching method for personal information. First, each personal information is matched against the password, recording the type of personal information matched and the length of the substring. Then, the matched substring is labeled as a personal information tag. For unmatched strings in the password, PCFG's built-in tags are used. During the generation phase, for different target users, the built-in tags and personal information tags in the high-probability password structure are sequentially replaced with high-frequency strings and user personal information substrings to generate a candidate password set.

[0004] 2) TarGuess-I. Because length-based matching methods have some drawbacks, such as overestimating the use of personal information like birthdays or phone numbers, and being insensitive to subtypes of personal information, this model proposes a type-based personal information matching method. By predefining type-based personal information tags, the content of these tags is used to match passwords. The subscript numbers of the tags do not represent length, but rather the subtype of the personal information, such as the full spelling of the name or the initials. By combining the type-based personal information matching method with the PCFG model, this model improves the guessing success rate to some extent.

[0005] Both of these methods are based on the PCFG model, which is entirely based on statistical probability. They have the disadvantage of requiring a fixed order of password structure for different users, so these methods are not optimal in targeted password guessing. Summary of the Invention

[0006] The purpose of this invention is to address the aforementioned problems by providing a targeted online password guessing method based on pointer generation networks, which can improve password guessing performance. Specifically, this invention employs pointer generation networks from natural language processing for online password guessing scenarios, significantly enhancing the effectiveness.

[0007] The technical solution adopted in this invention is as follows:

[0008] A targeted online password guessing method based on pointer generation networks includes the following steps:

[0009] The first step is to filter out personal information and passwords that do not meet the requirements in the raw dataset and preprocess the remaining data.

[0010] 1) Filtering conditions include:

[0011] 1-1) Personal information includes five attributes: name, email address, mobile phone number, account name, and ID card number;

[0012] 1-2) The password consists of only 96 printable characters in ASCII code.

[0013] 2) The pretreatment process includes:

[0014] 2-1) Extract the corresponding content from the five attributes of personal information according to the predefined information format;

[0015] 2-2) For each user, the personal information format content is compiled into a dictionary, and the password is segmented according to the forward maximum matching method. Unmatched strings in the password are treated as single characters.

[0016] 2-3) After preprocessing, for each user, their personal information is a list of extracted information formats, and their password is a list of segmented password fragments.

[0017] The second step is to train a pointer generation network based on personal information and password fragments, learn how personal information affects password construction and the commonly used structural components of passwords, and save the trained and optimized pointer generation network model.

[0018] The third step is to load the pointer generation network model, input a list of the current user's personal information format, output the guessed password fragments, and concatenate the guessed password fragments to form candidate guessed passwords.

[0019] The beneficial effects of this invention are:

[0020] This invention, by employing a pointer generation network model, overcomes the limitation of the fixed order of password structure construction in previous targeted online password guessing models using PCFG. This increases the diversity of password structure generation, improves the success rate of targeted online password guessing, and also offers advantages such as high automation and small model storage space. Based on the password guessing success rate, this invention can better assess the security strength of passwords online. Attached Figure Description

[0021] Figure 1 This is a flowchart of the method of the present invention.

[0022] Figure 2 This is a comparison chart based on the 12306 dataset with PCFG, Personal-PCFG, and TarGuess-I methods.

[0023] Figure 3 This is a comparison chart based on the PII-CSDN dataset with PCFG, Personal-PCFG, and TarGuess-I methods.

[0024] Figure 4 This is a comparison chart based on the PII-Dodonew dataset with PCFG, Personal-PCFG, and TarGuess-I methods.

[0025] Figure 5 This is a comparison chart of the length distribution of real test passwords and PG-Pass guessed passwords.

[0026] Figure 6 This is a trend chart showing the changes in the PG-Pass password guessing structure under different guessing attempts.

[0027] Figure 7 This is a comparative analysis chart of PG-Pass guessing results based on different datasets. Detailed Implementation

[0028] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below through specific embodiments and accompanying drawings.

[0029] The flowchart of the method proposed in this invention is as follows: Figure 1 As shown, it includes three steps: data preprocessing, model training, and password generation.

[0030] The first step is data preprocessing. Passwords can be viewed as short texts, but they differ from natural language. Compared to Chinese text, passwords are not composed of Chinese characters, but rather of pinyin letters or single characters; compared to English text, passwords do not contain spaces as word separators. Therefore, natural language processing models cannot be directly applied to password text.

[0031] Taking a publicly leaked password dataset as an example, the raw data contains two parts: personal information and passwords. The personal information includes five attributes: name, email address, mobile phone number, account name, and ID card number. The name consists of Chinese characters, and the birthdate is hidden within the ID card number. In the preprocessing, this invention performs the following operations:

[0032] 1) Extract personal information such as name (in pinyin format), email prefix, mobile phone number, account name, date of birth, and ID card number from five attributes: name, email, mobile phone number, account name, and ID card number;

[0033] 2) Represent personal information according to a custom information format. Please see Table 3 for the custom information format.

[0034] 3) For each user, based on the personal information list, the user password is segmented using the forward maximum matching method. Unmatched strings in the password are segmented into individual characters to obtain a list of user password fragments.

[0035] Specifically, the training data includes the three operation steps mentioned above, and the test data includes the two operation steps 1) to 2).

[0036] The second step is the model training process. For targeted online password guessing, the data for each user constitutes a dataset D. Dataset D (the preprocessed dataset mentioned above) contains two parts during the training phase: a list of personal information and a list of user password fragments, as shown below. For example, U1 represents the personal information list of the first user, and P1 represents the password fragment list of the first user. Simultaneously, U1 = [u 11 ,...,u 1k ] and P1 = [p 11 ,...,p 1l Each contains multiple values, where u 11 This represents the first piece of personal information for the first user, p. 11 This represents the first password fragment of the first user, U n P represents the list of personal information for the nth user. n U represents the list of password fragments for the nth user. n =[u n1 ,...,u nk ], P n =[p n1 ,...,p nl ], u nk p represents the k-th personal information content of the n-th user. nl This represents the l-th password fragment of the n-th user; n is the total number of users, k is the total number of personal information, and l is the total number of password fragments after the password data of the n-th user is segmented.

[0037] D = {[U1,P1],[U2,P2],...,[U n ,P n ]}

[0038] The model employs a pointer generation network, a widely used technique in text summarization that automatically generates text summaries based on article content. In this invention, a list of personal information is simulated as article content, with each personal information fragment resembling a word. By inputting the personal information list, the model learns to generate candidate password fragments, with the password fragment list acting as a text summary, and each password fragment resembling a word.

[0039] The third step is the password generation process. The trained pointer generation network model takes a list of personal information as input and generates guessed password fragments. These fragments are then combined in sequence to generate candidate passwords. During password fragment generation, the model employs a beam search method. Beam search has a hyperparameter K, meaning that in each step, this invention only retains the K outputs with the highest current conditional probability. Finally, this invention obtains K candidate passwords.

[0040] Next, we will conduct experimental verification.

[0041] (1) Experimental setup

[0042] 1) Datasets: This invention uses three publicly available real datasets, namely CSDN, Dodonew, and 12306 (Table 1), and describes attributes such as data source, number of data entries, and time of leakage. Because the original data from CSDN and Dodonew does not contain personal information, this invention uses email address matching to match CSDN and Dodonew with 12306, obtaining the PII-CSDN and PII-Dodonew datasets respectively. Table 2 shows the number of password entries in the matched datasets PII-CSDN and PII-Dodonew.

[0043] Table 1 Dataset Attributes

[0044] Dataset Name Website Types Number of passwords Leak time Does it contain personal information? CSDN IT exchange website 6,428,632 2011 Dodonew Internet services 16,283,140 2011 12306 Ticketing website 130,347 2014 √

[0045] Table 2 Attributes of the matched dataset

[0046] Dataset Name Number of passwords Does it contain personal information? PII-Dodonew 49,567 √ PII-CSDN 12,412 √

[0047] 2) Model parameters

[0048] General settings: For the pointer generation network, the hidden layer dimension is set to 256, the word embedding dimension is set to 128, and only the pointer network is used without the covering mechanism. During the training phase, the learning rate of the Adagrad optimization algorithm is set to 0.15. During both training and testing phases, the data batch size is set to 8, the personal information tag content list is set to a length of 400 tokens, and the password fragment is limited to a length of 15 tokens.

[0049] Parameter optimization: For parameters that may affect the model performance, this invention conducted comparative experiments and obtained the optimal settings as follows.

[0050] ① Custom Personal Information Format: 29 personal information tags were defined by Wang et al. in TarGuess-I. The definitions of these 29 personal information tags are shown in Table 3.

[0051] Table 3. Personal Information Tags and Descriptions Used

[0052]

[0053]

[0054] ② Order of Personal Information List: In natural language processing, the order of words in a sentence is crucial to experimental results. Therefore, this invention tested whether the order of personal information affected the experimental results. The results showed that the order of personal information had almost no impact on the final guess success rate.

[0055] ③ Vocabulary Size: This invention uses different vocabulary sizes for comparative experiments. The results show that the guessing success rate is similar when the vocabulary size is between 30,000 and 80,000. In this invention, the vocabulary size is set to 50,000.

[0056] 3) Number of guesses: Each website has a limit on the number of password login attempts to defend against guessing attacks. According to the US National Identity Authentication Guidelines (NIST) SP800-63-2, for Level 1 or Level 2 systems, the number of erroneous login attempts allowed per account should not exceed 100 within 30 days. Therefore, in this paper, the maximum number of guesses is set to 100. That is, for each user account, this invention allows a maximum of 100 guesses.

[0057] (4) Experimental Results

[0058] 1) Based on the 12306 dataset

[0059] Use 50% of the data in the 12306 dataset for training and 50% for testing. Figure 2As shown, PG-Pass represents the method of this invention, PCFG represents the PCFG algorithm invented by Weir et al., Personal-PCFG represents the Personal-PCFG algorithm invented by Li et al., and TarGuess-I represents the TarGuess-I algorithm invented by Wang et al. The pointer generation network-based method of this invention has a guessing success rate approximately 100%-1000% higher than TarGuess-I. In one guess, the PG-Pass model achieves a guessing success rate of 19.49%, approximately ten times higher than TarGuess-I. In 100 guesses, the PG-Pass model achieves a guessing success rate as high as 41.07%, approximately twice that of TarGuess-I.

[0060] Experimental results show that the method proposed in this invention can effectively learn the influence of personal information on password generation and the rules governing password construction.

[0061] 2) Based on PII-CSDN and PII-Dodonew datasets

[0062] To achieve better verification results, this invention simulates online attacks. The invention is trained on the 12306 dataset and tested on the matching datasets PII-CSDN and PII-Dododew. Figure 3 and Figure 4 The results show that on the PII-CSDN dataset, it outperforms the TarGuess-I model by approximately 11%–179%. On the PII-Dodonew dataset, it outperforms the TarGuess-I model by approximately 42%–216%. The success rates for guessing 100 times on the PII-Dodonew and PII-CSDN datasets reached 55.59% and 58.73%, respectively.

[0063] Experimental results show that the PG-Pass model has good applicability.

[0064] (5) Results Analysis

[0065] This invention analyzes the characteristics of successfully guessed passwords from two aspects: length distribution and structural distribution.

[0066] 1) Length Analysis: This invention calculates the length distribution of real test passwords and model-guessed passwords in the 12306 dataset, such as... Figure 5 As shown. This invention found that the length distribution of guessed passwords is similar to that of actual passwords. Passwords with a length of 10 characters account for the largest proportion, followed by passwords with a length of 9 characters and 8 characters.

[0067] This also reflects that the PG-Pass model can learn the password length distribution very well and generate passwords proportionally.

[0068] 2) Structural Analysis: First, this invention analyzes the structure of the successfully guessed password in the 12306 dataset. Figure 6 The paper demonstrates the trend of the number of password structures generated by the model under different guessing attempts. With one guess, 22 password structures were tried. With 100 guesses, 364 password structures were tried. The diversity of the generated password structures may be one reason for the good performance of the method in this invention.

[0069] Furthermore, this invention compares the high-frequency structure distribution of successfully guessed passwords and actual passwords, as shown in Table 4. The first four structures are completely identical, and only the order of two of the first ten structures differs. Therefore, the method of this invention can effectively learn the structure distribution of passwords.

[0070] Table 4. High-frequency structural distribution of successfully guessed passwords and real passwords.

[0071] The top 10 structures when guessing 100 times Top 10 structures in the test set 1 E1 E1 2 A2+E1 A2+E1 3 "qq"+E1 "qq"+E1 4 N1 N1 5 "a"+E1 N2+E1 6 N2+E1 "a"+E1 7 A2+A3 A2+A3 8 E2 E2 9 "q"+E1 "q"+E1 10 N2+A1 N2+A1

[0072] Finally, the effectiveness of this invention on different datasets was analyzed. Figure 7 The distribution of the ten most frequent structures in the 12306, PII-Dodonew, and PII-CSDN test sets is shown. It is evident that the structure distribution in the PII-Dodonew and PII-CSDN datasets is more concentrated compared to the 12306 dataset, with the highest-ranking A1 structure accounting for 42.86% and 36.98% respectively. In contrast, the highest-ranking E1 structure in the 12306 dataset accounts for only 21.86%. This phenomenon explains why the method of this invention performs better on the PII-Dodonew and PII-CSDN datasets than on the 12306 dataset. When guessing 100 times, although the method of this invention achieves a high guessing success rate for each structure in the 12306 dataset, the final result of the model is 41.07%. In the PII-Dodonew and PII-CSDN datasets, although the model's guessing success rate is not the highest for each structure in the test set, the final guessing success rates of the model reach 55.59% and 58.73% respectively.

[0073] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A targeted online password guessing method based on pointer generation networks, comprising the following steps: 1) Select a password dataset, which includes personal information and corresponding passwords for multiple users; 2) Extract the required attribute information from the personal information in the password dataset, and represent the extracted attributes according to various preset information formats to obtain the personal information list of the corresponding user; based on the user's personal information list, use the forward maximum matching method to segment the user's password to obtain the password fragment list of the corresponding user; 3) Using the processing results of step 2), construct a dataset D = {[U1,P1],[U2,P2],...,[U...} n ,P n ]}; where U n P represents the list of personal information for the nth user. n U represents the list of password fragments for the nth user. n =[u n1 ,...,u nk ], P n =[p n1 ,...,p nl ], u nk p represents the k-th personal information content of the n-th user. nl This represents the l-th password fragment of the n-th user; n is the total number of users, k is the total number of personal information, and l is the total number of password fragments after the password data of the n-th user is segmented. 4) Use the dataset D to train pointers to generate a network; 5) For a target user, generate the target user's personal information list and input it into the trained pointer generation network to generate guessed password fragments. Then, combine the generated password fragments into multiple candidate passwords. Then, use the beam search method to obtain K candidate passwords as the target user's password.

2. The method according to claim 1, characterized in that, The pointer generation network was trained based on the dataset D using the Adagrad optimization algorithm.

3. The method according to claim 2, characterized in that, The learning rate for the Adagrad optimization algorithm was set to 0.

15.

4. The method according to claim 1, 2, or 3, characterized in that, The vocabulary used in the process of training pointers to generate the network using the dataset D has a vocabulary size between 30,000 and 80,000.

5. The method according to claim 1, 2, or 3, characterized in that, The preset information formats are defined as 29 personal information tags in TarGuess-I.

6. The method according to claim 1, 2, or 3, characterized in that, The attribute information includes: birthday, name, email address, username, mobile phone number, and ID card number.

7. A server, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images