Password guessing method and device, electronic equipment and medium

Abstract

The embodiment of the invention relates to the technical field of password security, and provides a password guessing method and device, electronic equipment and a medium, and the method comprises the steps: obtaining a to-be-guessed target password; guessing a target position where the target password may have character transformation through a password language model of a self-attention mechanism; and replacing the characters at the target position based on a plurality of character replacement rules learned by the password language model of the self-attention mechanism in a training process to obtain a guess password data set. Therefore, password guessing and rule extraction are carried out based on password analysis, the obtained guessed password can effectively simulate conversion of a user on the password, meanwhile, character and structure distribution of the password can be effectively learned, and the accuracy and the coverage rate of the guessed password are improved.

Description

Technical Field

[0001] The present invention relates to the field of password security technology, and in particular to a password guessing method, device, electronic equipment and medium. Background Art

[0002] Existing password guessing models do not adequately handle password correlation: Existing password guessing models (such as Probabilistic Context Free Grammar (PCFG), Markov models, and neural network-based methods) mainly focus on the overall characteristics of passwords and ignore the potential correlations between different passwords. This results in these models being unable to effectively capture these correlations when users use similar passwords, thereby reducing the accuracy of predictions and increasing the risk of account hacking.

[0003] Limitations of rule-based password guessing models: Existing rule-based password guessing methods rely heavily on manual selection and design of rules. The effectiveness of the rules directly affects the efficiency and accuracy of password cracking. Since rule selection and design rely on experience, these methods are limited in efficiency and effectiveness when dealing with complex and diverse password patterns.

[0004] Too much reliance on expert experience: Traditional password cracking technology usually requires a lot of expert experience to select and optimize rules. This reliance limits the application of automated technology and makes rule design complicated and difficult to adapt to various password modes.

[0005] The quality of generated passwords is limited by rule selection: In rule-based password guessing, the quality of generated passwords is highly dependent on the selected rules. Inappropriate rules will reduce the quality of generated passwords and the success rate of cracking, especially when facing complex password patterns, the performance of existing methods will drop significantly.

[0006] Among many security technologies, text passwords are still the most commonly used user authentication method. This method is widely favored due to its practicality and ease of implementation. Although users are generally aware of the importance of password security, they tend to reduce the strength of their passwords due to the contradiction between memorability and randomness. For example, users may use password templates containing common phrases, or reuse or slightly modify the same password on different websites. This practice makes passwords highly predictable, especially in the event of a password database leak, increasing the risk of being attacked.

[0007] Mainstream password guessing models include probabilistic context-free grammar (PCFG), Markov model, and neural network-based methods. These data-driven probabilistic models capture generation patterns by learning a large amount of password data. The PCFG model captures the rules and structure of password generation by learning a large amount of password data. It is based on the concept of context-free grammar and regards password generation as a process that conforms to certain grammatical rules, thereby inferring the possible form of the password. The Markov model predicts the pattern of password generation by analyzing the sequence probability of password characters. It focuses on the dependencies between password characters and infers new passwords based on these dependencies. The neural network-based method uses deep learning technology to model the complex patterns of password generation. By training the neural network, the model can identify high-level features in the password data, thereby improving the accuracy of password guessing.

[0008] The commonly used technical solutions generally include the following steps: data collection: collect a large amount of password data, including passwords used by users on different websites; feature extraction: extract features from password data, including password length, character composition and sequence, etc.; model training: use the collected data and extracted features to train PCFG models, Markov models or neural network models; password generation and guessing: based on the trained model, generate possible passwords and make guesses; password verification: compare with the actual password to determine the accuracy of the guess.

[0009] Mainstream password guessing models, such as probabilistic context-free grammar (PCFG), Markov models, and neural network-based methods, capture password generation patterns by learning a large amount of password data. However, these models mainly focus on the overall characteristics of passwords, such as the probability distribution of password structure and character sequences, but rarely consider the potential correlation between different passwords. This limitation is manifested in practice as when users use passwords with similar structures on multiple websites, the predictive ability of existing models is significantly reduced, and they are unable to effectively identify and utilize the correlation between these passwords, increasing account security risks.

[0010] In the field of rule-based password guessing, despite the wide research coverage, existing rule-based models and tools still have obvious deficiencies in practical applications. Existing technologies usually rely on experience and knowledge to select rules, which makes the selection and design of rules a key factor. Since the rules for password generation are complex and changeable, the selection of rules directly affects the efficiency and success rate of password guessing. When dealing with complex password patterns, existing models often cannot adapt to these changes, resulting in poor cracking results. Summary of the invention

[0011] The present invention provides a password guessing method, device, electronic device and medium, which are used to solve the defect in the prior art that password guessing rules are selected based on experience and knowledge, which affects the efficiency and success rate of password guessing, thereby reducing manual dependence, improving password guessing efficiency and accuracy, and enhancing adaptability and intelligence.

[0012] The present invention provides a password guessing method, comprising: Get the target password to be guessed; Guess the target position where the character change may occur in the target password through the password language model of the self-attention mechanism; The characters at the target position are replaced based on a plurality of character replacement rules learned during the training process of the password language model of the self-attention mechanism to obtain a guessed password data set; The password language model of the self-attention mechanism is trained by the following steps: Collecting multiple user password data and performing data preprocessing on the multiple user password data, screening out user password data with password lengths within a preset range and ASCII printable characters as sample user password data sets; Screening the password pairs having a common substring in the sample user password data set; The generative pre-trained Transformer model is trained based on the password pairs to obtain the password language model of the self-attention mechanism.

[0013] In a possible implementation, the method further includes: Analyzing a first mapping relationship between the target password and the guessed password data set; A password guessing rule is extracted based on the first mapping relationship, and the password language model of the self-attention mechanism is optimized based on the password guessing rule.

[0014] In a possible implementation, the method further includes: Each sample user password data in the sample user password data set includes user account information and all passwords corresponding to the user account information; Comparing all passwords in the sample user password data set based on a preset screening condition, screening out password pairs having a common substring in the sample user password data set; Among them, the preset screening conditions at least include whether the characters of the password pair are the same, whether the password pairs are substrings of each other, whether the password pair is case-converted, whether the password pair conforms to the leet transformation, whether the password pair is in reverse order, whether the password pair conforms to the sequential key, and whether there is a common string in the password pair.

[0015] In a possible implementation, the method further includes: Inputting the password pair into a generative pre-trained Transformer model, and learning a second mapping relationship between the password pairs, positions where character transformations occur between the password pairs, and a weight of each position where character transformations occur through the generative pre-trained Transformer model; The learned generative pre-trained Transformer model is used as the password language model of the self-attention mechanism.

[0016] In a possible implementation, the method further includes: Input the target password to be guessed into the password language model of the self-attention mechanism, guess multiple positions where the character of the target password may change, and the weight distribution of each position; Determining the probability of character transformation occurring at each position based on the weight distribution; The positions where the probability is greater than a preset threshold are selected as target positions where character changes may occur in the target password.

[0017] In a possible implementation, the method further includes: The target positions are sorted according to the probability of character transformation, and a plurality of target positions whose probability difference is less than a preset difference threshold are retained; Using roulette wheel sampling for the starting characters of the target positions whose probability differences are less than a preset difference threshold; All candidate characters that meet the multiple character replacement rules are used to generate guessed characters next time to obtain a guessed password data set.

[0018] In a possible implementation, the method further includes: The first mapping relationship includes the coverage rate of password guessing; Obtaining a plaintext password set corresponding to the target password to be guessed; The coverage rate of the guessed password data set to the plaintext password set is calculated, where the coverage rate is the proportion of passwords in the plaintext password set that appear in the guessed password data set.

[0019] The present invention also provides a password guessing device, comprising the following modules: An acquisition module is used to obtain a target password to be guessed; A guessing module, used to guess the target position where the character change may occur in the target password through a password language model with a self-attention mechanism; A replacement module, used to replace the characters at the target position based on a plurality of character replacement rules learned by the password language model of the self-attention mechanism during the training process, to obtain a guessed password data set; The model training module is used to collect multiple user password data and perform data preprocessing on the multiple user password data, screen out user password data with password length within a preset range and ASCII printable characters as a sample user password data set; screen password pairs with common substrings in the sample user password data set; and train a generative pre-trained Transformer model based on the password pairs to obtain a password language model of the self-attention mechanism.

[0020] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-described password guessing methods when executing the computer program.

[0021] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the password guessing method described in any one of the above is implemented.

[0022] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the password guessing method described in any one of the above is implemented.

[0023] The password guessing method, device, electronic device and medium provided by the present invention obtain a target password to be guessed; guess the target position where the character change may occur in the target password through a password language model of a self-attention mechanism; replace the characters at the target position based on multiple character replacement rules learned by the password language model of the self-attention mechanism during the training process to obtain a guessed password data set; wherein the password language model of the self-attention mechanism is trained by the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, screening and obtaining user password data with password lengths within a preset range and ASCII printable characters as sample user password data sets; screening password pairs with common substrings in the sample user password data sets; and training a generative pre-trained Transformer model based on the password pairs to obtain the password language model of the self-attention mechanism. Compared with existing rule-based models and tools, which usually rely on experience and knowledge to select rules in actual password guessing applications, since the rules for password generation are complex and changeable, the selection of rules directly affects the efficiency and success rate of password guessing. This solution uses password guessing and rule extraction based on password analysis to obtain guessed passwords that can effectively simulate the user's transformation of the password, and can effectively learn the character and structure distribution of the password, thereby improving the accuracy and coverage of the guessed passwords, helping security experts and password administrators to better understand the weaknesses and potential risks of user passwords, thereby improving the security of the password system to prevent malicious attacks and unauthorized access. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 This is one of the flow charts of the password guessing method provided by the present invention.

[0026] Figure 2 This is the second flow chart of the password guessing method provided by the present invention.

[0027] Figure 3 It is a schematic diagram of the classification judgment flow of the password transformation rules provided by the present invention.

[0028] Figure 4 It is a schematic diagram of the architecture of the cryptographic language model of the self-attention mechanism provided by the present invention.

[0029] Figure 5 It is a structural schematic diagram of the password guessing device provided by the present invention.

[0030] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0033] Figure 1 It is one of the flowcharts of the password guessing method provided by the present invention, such as Figure 1 As shown, the method specifically includes: S11. Obtain the target password to be guessed.

[0034] S12. Guess the target position where the character change may occur in the target password through the password language model of the self-attention mechanism.

[0035] The embodiment of the present invention is mainly used to identify the scenario of users reusing passwords, and is preferably implemented on a Linux operating system platform. The password guessing method provided by the present invention provides a concept of extracting password pair transformation rules based on the analysis of similar password pairs of users. Based on the generative pre-trained Transformer model and the self-attention mechanism, the positions that may change between similar password pairs are judged, the possible changes are inferred and simulated, and replacement content that meets a certain probability threshold is generated, thereby constructing a guessed password data set similar to the target password. This method eliminates the dependence of traditional password guessing rule selection on expert experience or prior knowledge, improves password guessing efficiency, accuracy and coverage, and helps security experts and password managers better understand the weaknesses and potential risks of user passwords, thereby improving the security of the password system to prevent malicious attacks and unauthorized access.

[0036] Specific, combined Figure 2 As shown, a target password to be guessed is obtained, the target password to be guessed (for example, the password currently input by the user) is input into the password language model of the self-attention mechanism, and multiple positions where character changes may occur in the target password are guessed, as well as the weight distribution of each position; the probability of character changes occurring at each position is determined based on the weight distribution; and positions with probabilities greater than a preset threshold are screened as target positions where character changes may occur in the target password.

[0037] First, a password language model with a self-attention mechanism needs to be trained. The model encodes and stores the language knowledge from publicly leaked password libraries from different websites. The model transfers the acquired knowledge to the new target task to avoid training the model from scratch. The password language model with a self-attention mechanism learns the character replacement rules and mapping relationship between the original password and the generated guessed password during the training process.

[0038] S13. Replace the characters at the target position based on multiple character replacement rules learned by the password language model of the self-attention mechanism during the training process to obtain a guessed password data set.

[0039] The target positions are sorted according to the probability of character transformation, and multiple target positions with probability differences less than a preset difference threshold are retained; roulette wheel sampling is used for the starting characters of multiple target positions with probability differences less than a preset difference threshold; all candidate characters that meet the character replacement rules are used to generate guessed characters next time to obtain a guessed password data set.

[0040] Specifically, the target positions are sorted according to the probability of character transformation, and several items with similar probabilities within the threshold range among the first k items are retained for the next generation, and characters are replaced at each position to generate a new password; the starting character of the replacement content is sampled using roulette, and all the candidate characters in the middle that meet the conditions are used for the next generation. If there are no candidate characters that meet the conditions, roulette sampling is used to continue generation; this process is repeated to generate a large number of guessed passwords, and a guessed password data set is obtained.

[0041] First, the algorithm calculates the probability of each character position undergoing a transformation (such as replacement, insertion, deletion, etc.) based on a certain standard (such as common transformations in cryptography, historical data, etc.). Then, the character positions are sorted according to these probabilities, that is, positions that are more likely to change are given priority. Among the sorted positions, the first k positions are selected. Among these k positions, if the probability values ​​of some positions are within a specific threshold range and are close to each other, these positions will be selected for subsequent character replacement operations. This step aims to screen out those positions that are most likely to undergo transformations and have similar transformation probabilities to improve the accuracy of guesses. For the positions screened out in the previous step, the algorithm will perform character replacement operations. The replaced characters can be characters in the candidate character set generated based on a certain rule or model.

[0042] Roulette Wheel Selection is a probabilistic selection method used to select an element from a candidate set by probability. When replacing characters, the starting character is selected from the candidate character set by roulette wheel sampling. For the replaced middle characters, if there are qualified characters in the candidate character set, these characters will be retained for subsequent generation. If there are no qualified middle characters, roulette wheel sampling is continued to be used to generate new candidate characters. By repeating the above process, the algorithm can generate a large number of guessed passwords. These guessed passwords constitute a data set that can be used for subsequent password cracking attempts or security assessments.

[0043] S14. Analyze a first mapping relationship between the target password and the guessed password data set.

[0044] In the embodiment of the present invention, the mapping relationship at least includes the coverage rate of password guessing. The first mapping relationship between the target password and the guessed password data set is analyzed. Specifically, a plaintext password set corresponding to the target password to be guessed is obtained; and the coverage rate of the guessed password data set to the plaintext password set is calculated. The coverage rate is the proportion of passwords in the plaintext password set that appear in the guessed password data set. The plaintext password set can be a set of all guessed passwords for the target password obtained according to the prior art.

[0045] S15. Extract password guessing rules based on the first mapping relationship, and optimize the password language model of the self-attention mechanism based on the password guessing rules.

[0046] The higher the coverage rate, the more passwords are guessed correctly, and the better the password language model of the trained self-attention mechanism is. New password guessing rules can be extracted based on the first mapping relationship between the coverage rate, the target password, and the guessed password dataset, and the password language model of the self-attention mechanism can be optimized and parameters adjusted based on the password guessing rules.

[0047] The password guessing method provided by the present invention obtains a target password to be guessed; guesses a target position where a character change may occur in the target password through a password language model of a self-attention mechanism; replaces the characters at the target position based on multiple character replacement rules learned by the password language model of the self-attention mechanism during training to obtain a guessed password data set; wherein the password language model of the self-attention mechanism is trained by the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, screening and obtaining user password data with a password length within a preset range and ASCII printable characters as a sample user password data set; screening password pairs with common substrings in the sample user password data set; and training a generative pre-trained Transformer model based on the password pairs to obtain the password language model of the self-attention mechanism. Compared with existing rule-based models and tools, which usually rely on experience and knowledge to select rules in actual password guessing applications, since the rules for password generation are complex and changeable, the selection of rules directly affects the efficiency and success rate of password guessing. This solution uses password guessing and rule extraction based on password analysis to obtain guessed passwords that can effectively simulate the user's transformation of the password, and can effectively learn the character and structure distribution of the password, thereby improving the accuracy and coverage of the guessed passwords, helping security experts and password administrators to better understand the weaknesses and potential risks of user passwords, thereby improving the security of the password system to prevent malicious attacks and unauthorized access.

[0048] The following introduces the training process of the password language model of the self-attention mechanism, combined with Figure 4 The architecture diagram of the password language model of the self-attention mechanism is explained as follows: The password language model of the self-attention mechanism consists of an input layer, an output layer, an embedding layer and a backbone network. The input layer segments the input text password into words, the embedding layer maps the password and converts it into a vector representation of a fixed dimension, the backbone network learns the generalized relationship between characters through the self-attention module, and the output layer obtains the probability of the final character.

[0049] The embedding layer encodes the characterized character sequence by the text embedding layer and the position embedding layer respectively, and at the same time builds a self-attention mask matrix for the password to deeply extract features, and sums them to better represent the sequence.

[0050] The backbone network consists of several identical converter blocks. Each unit block includes a multi-head self-attention layer and a feedforward neural network. The multi-head attention layer allows the model to focus on different parts at different positions when processing sequences. Multiple heads are used to capture semantic and grammatical relationships from different levels. The feedforward neural network focuses on different parts at different positions and performs nonlinear mapping of local features at each position to capture complex patterns and representations.

[0051] The self-attention mechanism does not need to rely on past hidden states to judge the relevance between previous tokens. It processes the input sequence through the overall position information, thereby reducing the gradient descent caused by long-term dependencies and providing a more robust and efficient modeling method. The specific process is as follows: 1) Given a set of input sequence representations (vectors) ,in is the length of the sequence. In the model, a set of input sequences is a set of plaintext passwords; 2) Calculate the attention score. The calculation formula is as follows: (Formula 1) 3) Multiply the calculated attention score by the value matrix and perform weighted summation to obtain the final self-attention output. The calculation formula is as follows: (Formula 2) In the above formula, is the query matrix, ; is the key matrix, ; is the value matrix, ; is the weight matrix; is the dimension of the key; is the self-attention mask matrix.

[0052] Firstly, multiple user password data are collected and preprocessed to obtain a sample user password dataset with password length within a preset range and ASCII printable characters; password pairs with common substrings in the sample user password dataset are screened; and a generative pre-trained Transformer model is trained based on the password pairs to obtain a password language model with self-attention mechanism.

[0053] Specifically, publicly leaked password libraries from different websites are selected as pre-training data for this model. A mixed dataset of publicly leaked passwords from the selected websites CSDN, 17173, 7k7k, webhost, dodoniu, and gmail can be used. Then, the dataset is pre-processed to clean passwords with a length less than 6 and greater than 36 and passwords containing characters other than ASCII printable characters, and a sample user password dataset is established. The characteristics of the sample user password dataset are statistically analyzed, including the distribution of password length and the proportion of password character composition.

[0054] Furthermore, all passwords in the sample user password data set are compared based on preset screening conditions to screen out password pairs with common substrings in the sample user password data set, wherein the preset screening conditions include at least whether the characters in the password pair are the same, whether the password pairs are substrings of each other, whether the password pairs are case-converted, whether the password pairs conform to Leet transformation, whether the password pairs are in reverse order, whether the password pairs conform to the sequential key, and whether the password pairs contain a common string.

[0055] Traverse the password pairs of the sample user password data set and classify the categories of their conversion rules. The classification and judgment process for the conversion rules is as follows: Figure 3 As shown, the password pairs with common substring relationships are finally screened out. The characteristics of the sample user password data set are statistically analyzed, including the rule category, number of passwords, and proportion. The rule categories of password characters include three categories, namely: numbers, uppercase and lowercase letters, and special characters. In order to ensure the effectiveness of the rule transformation between password pairs, a restriction condition is introduced for the common substring, that is, the length of the common substring should be greater than 2 and greater than half the length of the shorter substring of the password pair. The characteristics of the data set of statistical password pairs include the frequency of occurrence and the corresponding proportion distribution of password pairs that meet different conversion rules, and the passwords in the password set that are only composed of ASCII printable characters are retained.

[0056] In the model pre-training stage, the preprocessed large-scale password dataset is mapped into vectors and input into the network to encode the language knowledge from the large password corpus and establish a password generation model based on rule transformation.

[0057] The model constructs the password model as a set of passwords Unsupervised distribution estimation of where each password can be represented as a sequence of tokens , using a standard language model object to maximize the likelihood function As follows Represents model parameters: The model focuses on character-level tokens, and each password is After character-level segmentation, it is processed into a character sequence in the form of }, Represents the length of the password. The tokenized character sequence is encoded into a text vector and a position vector by the text embedding layer and the position embedding layer respectively.

[0058] The model constructs a self-attention mask matrix for each password so that during forward propagation, A character can only be noticed to its left to get the password character.

[0059] The password language model of the self-attention mechanism of the embodiment of the present invention is a multi-layer network based on the Transformer architecture. Since there is no input from the encoder, the cross attention module is not introduced. The password sequence is normalized and encoded by the Transformer into a context representation and input into a linear classifier to calculate the distribution on the target token and predict the next password character.

[0060] In order to improve the learning ability of the model and accurately capture the potential associations between characters in the password, a multi-head self-attention operation is used to perform multiple independent calculations to learn token associations from different aspects. The results will be fed forward to the position-level feedforward network in the same block after summing.

[0061] During the training process, the size of the model can be selected and adjusted to balance the computational cost and the performance of the model. In this embodiment, the number of layers, i.e., the number of decoder blocks, the dimension of the embedding layer, the dimension of the feedforward layer, and the number of self-attention heads are adjusted and compared.

[0062] Through multiple rounds of iterative training (400,000 rounds in this embodiment, and the learning rate of the model during training is 2e-5), the network will learn the password distribution and password character relevance of the training data through a recurrent neural network based on the self-attention mechanism. In order to prevent the model from overfitting to small batches of data in the early stage, a linear warm-up strategy is adopted in this embodiment, and the warm-up ratio is set to 0.5.

[0063] During the fine-tuning phase, the model randomly samples the password pairs that have a common string relationship, and uses this data as a fine-tuning dataset to fine-tune the model and learn the potential relationship between password pairs. After that, it samples from the target corpus, predicts the position where each password in the sampled space is prone to change, and generates new replacement content at this position based on the qualified characters, thereby generating a new cluster of similar passwords.

[0064] This embodiment selects leaked passwords from websites CSDN, 17173, 7k7k, webhost, dodoniu and gmail for specific experiments. After training with 100,000 leaked passwords (before cleaning) from different websites, the test sets from different websites are grouped in pairs, and similar guesses are generated for any data set in the group, which can crack more than 50% of the passwords in the other matching data set. Under the same conditions, the cracking rate of existing technologies such as the Hashcat tool based on rule transformation is lower than that of this embodiment.

[0065] The above results show that the guessed passwords obtained by the rule extraction method based on password analysis can effectively simulate the transformation of the password by the user, and can effectively learn the character and structure distribution of the password. The quality of the guessed password is high, the pertinence is strong, and the password space of the guessed password is large.

[0066] Comprehensive experimental results show that compared with the existing technology, the password dataset generated by this method under the condition of known target leaked password library achieves the highest coverage in most tests, and the guessed passwords generated by this method are combined with the user's habit of reusing passwords and the knowledge of large corpus password learning, which can generate guessed passwords that are closer to the general user's behavior habits. In summary, this method adopts a rule extraction method based on password analysis, which can obtain password clusters with high similarity for the user's known plaintext passwords, improve the quality of password generation, and improve the efficiency of password guessing.

[0067] The password guessing device provided by the present invention is described below. The password guessing device described below and the password guessing method described above can be referred to each other.

[0068] Figure 5 It is a schematic diagram of the structure of the password guessing device provided by the present invention, which specifically includes: The acquisition module 501 is used to acquire the target password to be guessed. For detailed description, please refer to the relevant description corresponding to the above method embodiment, which will not be repeated here.

[0069] The guessing module 502 is used to guess the target position where the character change may occur in the target password through the password language model of the self-attention mechanism. For detailed description, please refer to the relevant description corresponding to the above method embodiment, which will not be repeated here.

[0070] The replacement module 503 is used to replace the characters at the target position based on the multiple character replacement rules learned by the password language model of the self-attention mechanism during the training process to obtain a guessed password data set. For detailed description, please refer to the relevant description corresponding to the above method embodiment, which will not be repeated here.

[0071] The model training module 504 is used to collect multiple user password data and perform data preprocessing on the multiple user password data, screen out user password data with password length within a preset range and ASCII printable characters as a sample user password data set; screen password pairs with common substrings in the sample user password data set; train the generative pre-trained Transformer model based on the password pairs to obtain the password language model of the self-attention mechanism. For detailed description, please refer to the relevant description corresponding to the above method embodiment, which will not be repeated here.

[0072] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor (processor) 810, a communication interface (Communications Interface) 820, a memory (memory) 830 and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call the logic instructions in the memory 830 to execute the password guessing method, which includes: obtaining a target password to be guessed; guessing a target position where a character change may occur in the target password through a password language model of a self-attention mechanism; replacing the characters at the target position based on multiple character replacement rules learned by the password language model of the self-attention mechanism during the training process to obtain a guessed password data set; wherein the password language model of the self-attention mechanism is trained by the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, screening and obtaining user password data with a password length within a preset range and ASCII printable characters as a sample user password data set; screening password pairs with common substrings in the sample user password data set; training a generative pre-trained Transformer model based on the password pairs to obtain the password language model of the self-attention mechanism.

[0073] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0074] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the password guessing method provided by the above-mentioned methods, which includes: obtaining a target password to be guessed; guessing a target position where a character change may occur in the target password through a password language model of a self-attention mechanism; replacing the characters at the target position based on multiple character replacement rules learned by the password language model of the self-attention mechanism during the training process to obtain a guessed password data set; wherein the password language model of the self-attention mechanism is trained by the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, screening user password data with a password length within a preset range and ASCII printable characters as a sample user password data set; screening password pairs with common substrings in the sample user password data set; training a generative pre-trained Transformer model based on the password pairs to obtain the password language model of the self-attention mechanism.

[0075] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the password guessing method provided by the above-mentioned methods, the method comprising: obtaining a target password to be guessed; guessing a target position where a character change may occur in the target password through a password language model of a self-attention mechanism; replacing the characters at the target position based on multiple character replacement rules learned by the password language model of the self-attention mechanism during the training process to obtain a guessed password data set; wherein the password language model of the self-attention mechanism is trained by the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, screening out user password data with a password length within a preset range and ASCII printable characters as a sample user password data set; screening password pairs with common substrings in the sample user password data set; and training a generative pre-trained Transformer model based on the password pairs to obtain the password language model of the self-attention mechanism.

[0076] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0077] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A password guessing method, characterized in that: include: Get the target password to be guessed; Guess the target position where the character change may occur in the target password through the password language model of the self-attention mechanism; The characters at the target position are replaced based on a plurality of character replacement rules learned during the training process of the password language model of the self-attention mechanism to obtain a guessed password data set; The password language model of the self-attention mechanism is trained by the following steps: Collecting multiple user password data and performing data preprocessing on the multiple user password data, screening out user password data with password lengths within a preset range and ASCII printable characters as sample user password data sets; Screening the password pairs having a common substring in the sample user password data set; The generative pre-trained Transformer model is trained based on the password pairs to obtain the password language model of the self-attention mechanism.

2. The method according to claim 1, characterized in that The method further comprises: Analyzing a first mapping relationship between the target password and the guessed password data set; A password guessing rule is extracted based on the first mapping relationship, and the password language model of the self-attention mechanism is optimized based on the password guessing rule.

3. The method according to claim 1, characterized in that: Each sample user password data in the sample user password data set includes user account information and all passwords corresponding to the user account information; The screening of password pairs having a common substring in the sample user password data set includes: Comparing all passwords in the sample user password data set based on a preset screening condition, screening out password pairs having a common substring in the sample user password data set; Among them, the preset screening conditions at least include whether the characters of the password pair are the same, whether the password pairs are substrings of each other, whether the password pair is case-converted, whether the password pair conforms to the leet transformation, whether the password pair is in reverse order, whether the password pair conforms to the sequential key, and whether there is a common string in the password pair.

4. The method according to claim 3, characterized in that The generative pre-trained Transformer model is trained based on the password pair to obtain a password language model of a self-attention mechanism, including: Inputting the password pair into a generative pre-trained Transformer model, and learning a second mapping relationship between the password pairs, positions where character transformations occur between the password pairs, and a weight of each position where character transformations occur through the generative pre-trained Transformer model; The learned generative pre-trained Transformer model is used as the password language model of the self-attention mechanism.

5. The method according to claim 1 or 2, characterized in that: The step of obtaining a target password to be guessed and guessing a target position where a character change may occur in the target password through a password language model of a self-attention mechanism includes: Input the target password to be guessed into the password language model of the self-attention mechanism, guess multiple positions where the character of the target password may change, and the weight distribution of each position; Determining the probability of character transformation occurring at each position based on the weight distribution; The positions where the probability is greater than a preset threshold are selected as target positions where character changes may occur in the target password.

6. The method according to claim 5, characterized in that The password language model based on the self-attention mechanism replaces the characters at the target position using multiple character replacement rules learned during the training process to obtain a guessed password data set, including: The target positions are sorted according to the probability of character transformation, and a plurality of target positions whose probability difference is less than a preset difference threshold are retained; Using roulette wheel sampling for the starting characters of the target positions whose probability differences are less than a preset difference threshold; All candidate characters that meet the multiple character replacement rules are used to generate guessed characters next time to obtain a guessed password data set.

7. The method according to claim 6, characterized in that The first mapping relationship includes the coverage rate of password guessing; The analyzing a first mapping relationship between the target password and the guessed password data set includes: Obtaining a plaintext password set corresponding to the target password to be guessed; The coverage rate of the guessed password data set to the plaintext password set is calculated, where the coverage rate is the proportion of passwords in the plaintext password set that appear in the guessed password data set.

8. A password guessing device, characterized in that: include: An acquisition module is used to obtain a target password to be guessed; A guessing module, used to guess the target position where the character change may occur in the target password through a password language model with a self-attention mechanism; A replacement module, used to replace the characters at the target position based on a plurality of character replacement rules learned by the password language model of the self-attention mechanism during the training process, to obtain a guessed password data set; The model training module is used to collect multiple user password data and perform data preprocessing on the multiple user password data, screen out user password data with password length within a preset range and ASCII printable characters as a sample user password data set; screen password pairs with common substrings in the sample user password data set; and train a generative pre-trained Transformer model based on the password pairs to obtain a password language model of the self-attention mechanism.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the password guessing method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the password guessing method according to any one of claims 1 to 7 is implemented.

Images