Password guessing methods, devices, electronic equipment and media

Abstract

This invention relates to the field of cryptographic security technology, providing a password guessing method, apparatus, electronic device, and medium. The method includes: acquiring a target password to be guessed; guessing the target positions where character transformations may occur in the target password using a cryptographic language model with a self-attention mechanism; and replacing characters at the target positions based on multiple character substitution rules learned during the training of the cryptographic language model with the self-attention mechanism, thereby obtaining a password guessing dataset. Thus, by performing password guessing and rule extraction based on cryptanalysis, the obtained password guesses can effectively simulate user transformations of the password, and can also effectively learn the character and structural distribution of the password, improving the accuracy and coverage of password guessing.

Description

Technical Field

[0001] This invention relates to the field of cryptographic security technology, and in particular to a cryptographic guessing method, apparatus, electronic device, and medium. Background Technology

[0002] Existing password guessing models are insufficient in handling password correlations: Current password guessing models (such as Probabilistic Context-Free Grammar (PCFG), Markov models, and neural network-based methods) primarily focus on the overall characteristics of passwords, neglecting the potential correlations between different passwords. This results in these models failing to effectively capture these correlations when users use similar passwords, thus reducing prediction accuracy and increasing the risk of account compromise.

[0003] Limitations of rule-based cryptographic guessing models: Existing rule-based cryptographic guessing methods heavily rely on the manual selection and design of rules. The effectiveness of these rules directly impacts the efficiency and accuracy of cryptographic cracking. Because rule selection and design depend on experience, these methods are limited in both efficiency and effectiveness when dealing with complex and diverse cryptographic patterns.

[0004] Over-reliance on expert experience: Traditional cryptographic cracking techniques typically require extensive expert experience to select and optimize rules. This reliance limits the application of automation techniques and makes rule design complex and difficult to adapt to various cryptographic patterns.

[0005] The quality of generated passwords is limited by the choice of rules: In rule-based password guessing, the quality of the generated passwords is highly dependent on the chosen rules. Unsuitable rules will reduce the quality of the generated passwords and the success rate of cracking them, especially when faced with complex password patterns, where the performance of existing methods will significantly decline.

[0006] Among many security technologies, text-based passwords remain the most commonly used method of user authentication. This method is widely favored due to its practicality and ease of implementation. Although users are generally aware of the importance of password security, the trade-off between ease of memorization and randomness often leads them to weaken their passwords. For example, users might use password templates containing common phrases, or reuse or slightly modify the same password across different websites. This practice makes passwords highly predictable, increasing the risk of attack, especially in the event of a password database breach.

[0007] Mainstream password guessing models include probabilistic context-free grammars (PCFG), Markov models, and neural network-based methods. These data-driven probabilistic models capture generation patterns by learning from large amounts of cipher data. PCFG models learn from large amounts of cipher data to capture the rules and structure of password generation. Based on the concept of context-free grammars, it views password generation as a process conforming to certain grammatical rules, thus inferring possible password forms. Markov models predict password generation patterns by analyzing the sequence probabilities of cipher characters. They focus on the dependencies between cipher characters and infer new passwords based on these dependencies. Neural network-based methods utilize deep learning techniques to model complex patterns in password generation. By training neural networks, the models can identify high-level features in cipher data, thereby improving the accuracy of password guessing.

[0008] The commonly used technical solutions generally include the following steps: Data collection: Collecting a large amount of password data, including passwords used by users on different websites; Feature extraction: Extracting features from the password data, including password length, character composition and sequence, etc.; Model training: Using the collected data and extracted features, training a PCFG model, Markov model or neural network model; Password generation and guessing: Generating possible passwords based on the trained model and guessing them; Password verification: Comparing the guess with the actual password to determine the accuracy of the guess.

[0009] Mainstream password guessing models, such as probabilistic context-free grammars (PCFG), Markov models, and neural network-based methods, capture password generation patterns by learning from large amounts of password data. However, these models primarily focus on the overall characteristics of passwords, such as password structure and the probability distribution of character sequences, while giving less consideration to the potential correlations between different passwords. This limitation manifests in practice as a significant decrease in the predictive power of existing models when users use passwords with similar structures on multiple websites, failing to effectively identify and exploit the correlations between these passwords, thus increasing account security risks.

[0010] In the field of rule-based cryptography, despite broad research coverage, existing rule-based models and tools still have significant shortcomings in practical applications. Current technologies typically rely on experience and knowledge to select rules, making rule selection and design crucial factors. Because cryptographic rules are complex and varied, the choice of rules directly impacts the efficiency and success rate of cryptographic guessing. Existing models often fail to adapt to these changes when dealing with complex cryptographic patterns, resulting in poor cracking results. Summary of the Invention

[0011] This invention provides a password guessing method, apparatus, electronic device, and medium to address the shortcomings of existing technologies that rely on experience and knowledge to select password guessing rules, which affects the efficiency and success rate of password guessing. This invention aims to reduce reliance on manual intervention, improve the efficiency and accuracy of password guessing, and enhance adaptability and intelligence.

[0012] This invention provides a password guessing method, comprising:

[0013] Obtain the target password to be guessed;

[0014] The target location where character transformations may occur in the target cipher is guessed using a cryptographic language model with a self-attention mechanism;

[0015] The cryptographic language model based on the self-attention mechanism learns multiple character substitution rules during training to replace characters at the target positions, thereby obtaining a password guessing dataset.

[0016] The self-attention mechanism cryptographic language model is trained through the following steps:

[0017] Collect multiple user password data and perform data preprocessing on the multiple user password data. Filter out user password data whose password length is within a preset range and whose ASCII code can be printed, and use this as a sample user password dataset.

[0018] Filter password pairs with a common substring from the sample user password dataset;

[0019] The self-attention mechanism cryptographic language model is obtained by training the generative pre-trained Transformer model based on the cryptographic pair.

[0020] In one possible implementation, the method further includes:

[0021] Analyze the first mapping relationship between the target password and the guessed password dataset;

[0022] Based on the first mapping relationship, password guessing rules are extracted, and the password guessing rules are used to optimize the self-attention mechanism cryptographic language model.

[0023] In one possible implementation, the method further includes:

[0024] Each sample user password data in the sample user password dataset includes user account information and all passwords corresponding to the user account information.

[0025] Based on preset filtering conditions, all passwords in the sample user password dataset are compared, and password pairs with common substrings are obtained from the sample user password dataset.

[0026] The preset filtering conditions include at least whether the characters in the password pairs are the same, whether the password pairs are substrings of each other, whether the password pairs are case-sensitive, whether the password pairs conform to Leet transformation, whether the password pairs are in reverse order, whether the password pairs conform to sequence keys, and whether the password pairs have a common string.

[0027] In one possible implementation, the method further includes:

[0028] The password pairs are input into a generative pre-trained Transformer model, which learns the second mapping relationship between the password pairs, the positions where character transformations occur between the password pairs, and the weights of each position where character transformations occur.

[0029] The learned generative pre-trained Transformer model is used as the cryptographic language model for the self-attention mechanism.

[0030] In one possible implementation, the method further includes:

[0031] The target password to be guessed is input into the cryptographic language model of the self-attention mechanism to guess multiple positions where character transformations may occur in the target password, as well as the weight distribution of each position;

[0032] The probability of a character transformation occurring at each position is determined based on the weight distribution.

[0033] Positions with a probability greater than a preset threshold are selected as target positions where character transformations may occur in the target password.

[0034] In one possible implementation, the method further includes:

[0035] The target positions are sorted according to the probability of character transformation, and multiple target positions with probability differences less than a preset difference threshold are retained;

[0036] The starting characters at the target positions where the probability difference is less than a preset difference threshold are sampled using a roulette wheel.

[0037] All candidate characters that meet the multiple character replacement rules are used in the next generation of guess characters to obtain the guessed password dataset.

[0038] In one possible implementation, the method further includes:

[0039] The first mapping relationship includes the coverage of password guessing;

[0040] Obtain the plaintext cipher set corresponding to the target cipher to be guessed;

[0041] Calculate the coverage of the guessed cipher dataset to the plaintext cipher set, where the coverage is the proportion of ciphers in the plaintext cipher set that appear in the guessed cipher dataset.

[0042] The present invention also provides a password guessing device, comprising the following modules:

[0043] The acquisition module is used to acquire the target password to be guessed;

[0044] The guessing module is used to guess the target position where character transformations may occur in the target cipher using a cryptographic language model with a self-attention mechanism;

[0045] The replacement module is used to replace characters at the target position with multiple character replacement rules learned during the training of the cryptographic language model based on the self-attention mechanism, so as to obtain a guessed password dataset.

[0046] The model training module is used to collect multiple user password data and preprocess the multiple user password data to select user password data whose password length is within a preset range and whose ASCII code can be printed, as a sample user password dataset; to select password pairs with common substrings in the sample user password dataset; and to train the generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model.

[0047] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the password guessing method as described above.

[0048] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the password guessing method as described above.

[0049] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the password guessing method as described above.

[0050] The password guessing method, apparatus, electronic device, and medium provided by this invention involve: acquiring a target password to be guessed; guessing the target positions where character transformations might occur in the target password using a self-attention mechanism cryptographic language model; and replacing characters at the target positions based on multiple character substitution rules learned during the training of the self-attention mechanism cryptographic language model to obtain a password guessing dataset. The self-attention mechanism cryptographic language model is trained through the following steps: collecting multiple user password data and preprocessing the data to select user password data with a password length within a preset range and printable ASCII characters, as a sample user password dataset; selecting password pairs with a common substring from the sample user password dataset; and training a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model. Compared to existing rule-based models and tools that typically rely on experience and knowledge to select rules in practical password guessing applications, where the rules for password generation are complex and varied, the selection of rules directly affects the efficiency and success rate of password guessing. This solution uses cryptanalysis for password guessing and rule extraction. The guessed passwords obtained can effectively simulate the changes made by users to passwords, and can also effectively learn the character and structural distribution of passwords, improving the accuracy and coverage of password guessing. This helps security experts and password administrators better understand the weaknesses and potential risks of user passwords, thereby improving the security of the password system and preventing malicious attacks and unauthorized access. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0052] Figure 1 This is one of the flowcharts illustrating the password guessing method provided by the present invention.

[0053] Figure 2 This is the second flowchart of the password guessing method provided by the present invention.

[0054] Figure 3 This is a schematic diagram of the classification and judgment process of the cryptographic transformation rules provided by the present invention.

[0055] Figure 4 This is a schematic diagram of the architecture of the cryptographic language model with self-attention mechanism provided by the present invention.

[0056] Figure 5This is a schematic diagram of the password guessing device provided by the present invention.

[0057] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0059] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.

[0060] Figure 1 This is one of the flowcharts illustrating the password guessing method provided by the present invention, such as... Figure 1 As shown, the method specifically includes:

[0061] S11. Obtain the target password to be guessed.

[0062] S12. Guess the target position where character transformations may occur in the target cipher using a cryptographic language model with a self-attention mechanism.

[0063] This invention is primarily applied to scenarios involving the identification of users reusing passwords, and is preferably implemented on a Linux operating system platform. The password guessing method provided by this invention offers a concept of extracting password pair transformation rules based on the analysis of similar password pairs. By using a generative pre-trained Transformer model and a self-attention mechanism, it judges the possible changes between similar password pairs, infers and simulates possible changes, and generates replacement content that meets a certain probability threshold. This constructs a password guessing dataset similar to the target password. This method eliminates the reliance on expert experience or prior knowledge in traditional password guessing rule selection, improving password guessing efficiency, accuracy, and coverage. It helps security experts and password administrators better understand the weaknesses and potential risks of user passwords, thereby enhancing the security of the password system to prevent malicious attacks and unauthorized access.

[0064] Specifically, in combination Figure 2As shown, the target password to be guessed is obtained, and the target password to be guessed (e.g., the password currently entered by the user) is input into the password language model with a self-attention mechanism. Multiple positions where character transformations may occur in the target password are guessed, as well as the weight distribution of each position. The probability of character transformation occurring at each position is determined based on the weight distribution. Positions with a probability greater than a preset threshold are selected as target positions where character transformations may occur in the target password.

[0065] First, a self-attention cryptographic language model needs to be trained. This model encodes and stores language knowledge from publicly available cryptographic databases from different websites. The model then transfers this acquired knowledge to new target tasks to avoid training the model from scratch. During training, the self-attention cryptographic language model learns the character substitution rules and mapping relationships between the original cipher and the generated guessed cipher.

[0066] S13. The cryptographic language model based on the self-attention mechanism learns multiple character substitution rules during training to replace the characters at the target positions, thereby obtaining a guessed password dataset.

[0067] The target positions are sorted according to the probability of character transformation, and multiple target positions with probability differences less than a preset difference threshold are retained; the starting characters of multiple target positions with probability differences less than the preset difference threshold are sampled using roulette wheel sampling; all candidate characters that meet the character replacement rules are used to generate the next guess character, thus obtaining the guessed password dataset.

[0068] Specifically, the target positions are sorted according to the probability of character transformation. The first k items with several items having similar probabilities within the threshold range are retained for the next generation. Character replacement is performed at each position to generate a new password. The starting character of the replacement content is sampled using roulette wheel sampling. All candidate characters that meet the conditions in the middle are used for the next generation. If no candidate characters meet the conditions, roulette wheel sampling is used to continue generation. This process is repeated to generate a large number of guessed passwords, resulting in a guessed password dataset.

[0069] First, the algorithm calculates the probability of a transformation (such as substitution, insertion, or deletion) at each character position based on some criterion (e.g., common cryptographic transformations, historical data). Then, the character positions are sorted according to these probabilities, prioritizing positions more likely to change. From these sorted positions, the top k positions are selected. Among these k positions, if the probability values ​​of some positions are within a specific threshold range and are close to each other, these positions are selected for subsequent character substitution operations. This step aims to filter out positions most likely to undergo transformation and with similar transformation probabilities to improve the accuracy of the guess. For the positions selected in the previous step, the algorithm performs a character substitution operation. The replaced character can be a character from a candidate character set generated based on some rules or model.

[0070] Roulette wheel selection is a probabilistic selection method used to select an element from a candidate set based on probability. During character replacement, the starting character is selected from the candidate character set using roulette wheel selection. For the intermediate character to be replaced, if a matching character exists in the candidate character set, these characters are retained for subsequent generation. If no matching intermediate character exists, roulette wheel selection continues to generate new candidate characters. By repeatedly performing this process, the algorithm can generate a large number of guessed passwords. These guessed passwords form a dataset that can be used for subsequent password cracking attempts or security assessments.

[0071] S14. Analyze the first mapping relationship between the target password and the guessed password dataset.

[0072] In this embodiment of the invention, the mapping relationship includes at least the coverage rate of password guessing. The first mapping relationship between the target password and the dataset of guessed passwords is analyzed. Specifically, the plaintext password set corresponding to the target password to be guessed is obtained; the coverage rate of the dataset of guessed passwords over the plaintext password set is calculated. The coverage rate is the proportion of passwords in the plaintext password set that appear in the dataset of guessed passwords. The plaintext password set can be a complete set of guessed passwords for the target password obtained according to existing techniques.

[0073] S15. Extract password guessing rules based on the first mapping relationship, and optimize the self-attention mechanism cryptographic language model based on the password guessing rules.

[0074] Higher coverage indicates more correctly guessed passwords, resulting in better performance of the self-attention mechanism-based cryptographic language model. New password guessing rules can be extracted based on the initial mapping between coverage, the target password, and the password guessing dataset. These rules can then be used to optimize the self-attention mechanism-based cryptographic language model, including parameter tuning.

[0075] The password guessing method provided by this invention involves: acquiring the target password to be guessed; guessing the target positions where character transformations might occur in the target password using a self-attention mechanism cryptographic language model; and replacing the characters at the target positions with multiple character substitution rules learned during the training of the self-attention mechanism cryptographic language model to obtain a password guessing dataset. The self-attention mechanism cryptographic language model is trained through the following steps: collecting multiple user password data and preprocessing the data to select user password data with a password length within a preset range and printable ASCII characters, as a sample user password dataset; selecting password pairs with a common substring from the sample user password dataset; and training a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model. Compared to existing rule-based models and tools that typically rely on experience and knowledge to select rules in practical password guessing applications, where the rules for password generation are complex and varied, the selection of rules directly affects the efficiency and success rate of password guessing. This solution uses cryptanalysis for password guessing and rule extraction. The guessed passwords obtained can effectively simulate the changes made by users to passwords, and can also effectively learn the character and structural distribution of passwords, improving the accuracy and coverage of password guessing. This helps security experts and password administrators better understand the weaknesses and potential risks of user passwords, thereby improving the security of the password system and preventing malicious attacks and unauthorized access.

[0076] The training process of a self-attention mechanism cryptographic language model is described below, combined with... Figure 4 The following diagram illustrates the architecture of a cryptographic language model with a self-attention mechanism:

[0077] The self-attention mechanism cryptographic language model consists of an input layer, an output layer, an embedding layer, and a backbone network. The input layer segments the input text cipher into words, the embedding layer maps the cipher into a fixed-dimensional vector representation, the backbone network learns generalized inter-character relationships through the self-attention module, and the output layer obtains the probability of the final character.

[0078] The embedding layer encodes the characteristic character sequence by the text embedding layer and the position embedding layer respectively. At the same time, it constructs a self-attention mask matrix for the password to extract features in depth and sums them to better represent the sequence.

[0079] The backbone network consists of several identical transformer blocks. Each unit block includes a multi-head self-attention layer and a feedforward neural network. The multi-head attention layer allows the model to focus on different parts at different positions when processing sequences. Multi-head attention is used to capture semantic and grammatical relations from different levels. The feedforward neural network focuses on different parts at different positions and performs non-linear mapping of local features at each position to capture complex patterns and representations.

[0080] Self-attention mechanisms do not rely on past hidden states to determine the correlation between previous tokens. Instead, they process the input sequence using overall positional information, thereby reducing gradient descent caused by long-term dependencies and providing a more robust and efficient modeling approach. The specific process is as follows:

[0081] 1) Given a set of input sequence representations (vectors) ,in It is the length of the sequence. In the model, a set of input sequences is a set of plaintext ciphers.

[0082] 2) Calculate the attention score using the following formula:

[0083] (Formula 1)

[0084] 3) Multiply the calculated attention score by the value matrix and perform a weighted summation to obtain the final self-attention output. The calculation formula is as follows:

[0085] (Formula 2)

[0086] In the above formula, It is a query matrix. ; It is a key matrix. ; It is a value matrix. ; It is a weight matrix; It is the dimension of the key; It is a self-attention mask matrix.

[0087] First, multiple user password data are collected and preprocessed to obtain a sample user password dataset with password lengths within a preset range and ASCII characters printable. Password pairs with common substrings are then selected from the sample user password dataset. Based on the password pairs, a generative pre-trained Transformer model is trained to obtain a self-attention mechanism cryptographic language model.

[0088] Specifically, publicly leaked password databases from different websites are selected as pre-training data for this model. A mixed dataset of publicly leaked passwords from websites such as CSDN, 17173, 7k7k, webhost, dodoniu, and Gmail can be used. The dataset is then preprocessed to clean passwords shorter than 6 but longer than 36 characters, as well as passwords containing characters other than ASCII printable characters, to create a sample user password dataset. The characteristics of the sample user password dataset are then statistically analyzed, including the distribution of password lengths and the proportion of password character components.

[0089] Furthermore, based on preset filtering conditions, all passwords in the sample user password dataset are compared to obtain password pairs with common substrings in the sample user password dataset. The preset filtering conditions include at least whether the characters in the password pairs are the same, whether the password pairs are substrings of each other, whether the password pairs are case-sensitive, whether the password pairs conform to Leet transformation, whether the password pairs are in reverse order, whether the password pairs conform to sequence keys, and whether the password pairs have a common string.

[0090] Iterate through the password pairs in the sample user password dataset, classify their transformation rules, and the classification process for transformation rules is as follows: Figure 3 As shown, password pairs with a common substring relationship are finally selected. The characteristics of the sample user password dataset are statistically analyzed, including the rule category, number of passwords, and proportion. The rule categories for password characters include three types: numbers, uppercase and lowercase letters, and special characters. To ensure the effectiveness of rule transformations between password pairs, a constraint is introduced on the common substring: the length of the common substring should be greater than 2 and greater than half the length of the shorter substring of the password pair. The dataset characteristics of the statistically analyzed password pairs include the frequency and corresponding proportion distribution of password pairs conforming to different transformation rules, retaining passwords in the set that consist only of printable ASCII characters.

[0091] In the model pre-training stage, the preprocessed large-scale cryptographic dataset is mapped into vectors, input into the network, and language knowledge from the large cryptographic corpus is encoded to establish a cryptographic generation model based on rule transformation.

[0092] The model constructs a set of passwords. Unsupervised distribution estimation, where each password can be represented as a sequence of tokens. Standard language model objects are used to maximize the likelihood function. Among them Indicate model parameters:

[0093]

[0094] The model focuses on character-level tokenization for each password during the input phase. After character-level segmentation, it is processed into a character sequence, in the form of... }, This indicates the password length. The tokenized character sequence is encoded into a text vector and a position vector by a text embedding layer and a position embedding layer, respectively.

[0095] The model constructs a self-attention mask matrix for each password so that during forward propagation, the first password... The password character can only be noticed on its left.

[0096] The cryptographic language model based on the self-attention mechanism in this embodiment of the invention is a multi-layer network based on the Transformer architecture. Since there is no input from the encoder, no cross-attention module is introduced. The password sequence is normalized and encoded into a context representation by the Transformer, which is then input into a linear classifier to calculate its distribution on the target token and predict the next password character.

[0097] To improve the model's learning ability and accurately capture the potential relationships between password characters, a multi-head self-attention operation is used to perform multiple independent computations, learning token associations from different perspectives. The results are then summed and fed forward to a position-level feedforward network in the same block.

[0098] During training, the model size can be selected and adjusted to balance computational cost and model performance. In this embodiment, the number of layers (i.e., the number of decoder blocks), the embedding layer dimension, the feedforward layer dimension, and the number of self-attention heads are adjusted and compared.

[0099] Through multiple rounds of iterative training (400,000 rounds in this embodiment, with a learning rate of 2e-5 during training), the network will learn the password distribution and password character correlation of the training data through a recurrent neural network based on a self-attention mechanism. To prevent the model from overfitting to small batches of data in the early stages, a linear warm-up strategy is adopted in this embodiment, and the warm-up ratio is set to 0.5.

[0100] During the fine-tuning phase, the model randomly samples password pairs that share common string relationships. This data is used as the fine-tuning dataset to fine-tune the model and learn the potential connections between the password pairs. Next, sampling is performed from the target corpus. For each password in the sampling space, the positions where it is likely to change are predicted, and new replacement content is generated at these positions based on characters that meet certain conditions, thus generating a new cluster of similar passwords.

[0101] This embodiment selects leaked passwords from the websites CSDN, 17173, 7k7k, webhost, dodoniu, and Gmail for specific experiments. After training with 100,000 leaked passwords (before cleaning) from different websites, test sets from different websites are paired. For any dataset within a group, similar guesses are generated, capable of cracking over 50% of the passwords in the matching dataset. Under the same conditions, existing techniques such as the rule-transformation-based Hashcat tool have lower cracking rates than this embodiment.

[0102] The results above demonstrate that the guessed passwords obtained through the rule extraction method based on cryptanalysis can effectively simulate the changes made by users to the password, and can also effectively learn the character and structural distribution of the password. The guessed passwords are of high quality, highly targeted, and have a large password space.

[0103] Based on the comprehensive experimental results, compared with existing technologies, the password dataset generated by this method, under the condition that the target's leaked password database is known, achieves the highest coverage in most tests. Furthermore, the guessed passwords generated by this method combine user password reuse habits with knowledge from large corpus cipher learning, enabling the generation of guessed passwords that more closely resemble general user behavior. In summary, this method employs a cryptanalysis-based rule extraction approach, which can obtain highly similar password clusters for user-known plaintext passwords, improving password generation quality and increasing password guessing efficiency.

[0104] The password guessing device provided by the present invention is described below. The password guessing device described below can be referred to in correspondence with the password guessing method described above.

[0105] Figure 5 This is a schematic diagram of the password guessing device provided by the present invention, specifically including:

[0106] The acquisition module 501 is used to acquire the target password to be guessed. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0107] The guessing module 502 is used to guess the target positions where character transformations may occur in the target cipher using a cryptographic language model with a self-attention mechanism. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0108] The replacement module 503 is used to replace characters at the target position with multiple character replacement rules learned during the training of the cryptographic language model based on the self-attention mechanism, thereby obtaining a guessed password dataset. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0109] The model training module 504 is used to collect multiple user password data and preprocess the multiple user password data to select user password data whose password length is within a preset range and whose ASCII code can be printed, as a sample user password dataset; to select password pairs with common substrings in the sample user password dataset; and to train a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model. For detailed explanations, please refer to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0110] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communications bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communications bus 840. The processor 810 can call logic instructions in the memory 830 to execute a password guessing method, which includes: obtaining a target password to be guessed; guessing the target position where character transformations may occur in the target password using a self-attention mechanism cryptographic language model; replacing the characters at the target position based on multiple character substitution rules learned during the training of the self-attention mechanism cryptographic language model, to obtain a password guessing dataset; wherein, the self-attention mechanism cryptographic language model is trained through the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, filtering out user password data whose password length is within a preset range and whose ASCII code can be printed, as a sample user password dataset; filtering password pairs with common substrings in the sample user password dataset; training a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model.

[0111] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0112] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the password guessing methods provided by the above methods. The method includes: obtaining a target password to be guessed; guessing the target position where the target password may undergo character transformations using a self-attention mechanism cryptographic language model; replacing the characters at the target position based on multiple character substitution rules learned during the training of the self-attention mechanism cryptographic language model to obtain a password guessing dataset; wherein the self-attention mechanism cryptographic language model is trained through the following steps: collecting multiple user password data and performing data preprocessing on the multiple user password data, filtering to obtain user password data with password length within a preset range and ASCII characters printable, as a sample user password dataset; filtering password pairs with common substrings in the sample user password dataset; and training a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model.

[0113] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the password guessing methods provided by the above methods. The method includes: obtaining a target password to be guessed; guessing the target position where character transformations may occur in the target password using a self-attention mechanism cryptographic language model; replacing characters at the target position based on multiple character substitution rules learned during training by the self-attention mechanism cryptographic language model to obtain a password guessing dataset; wherein the self-attention mechanism cryptographic language model is trained through the following steps: collecting multiple user password data and preprocessing the multiple user password data to filter out user password data with password lengths within a preset range and ASCII characters printable, as a sample user password dataset; filtering password pairs with common substrings in the sample user password dataset; and training a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model.

[0114] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A password guessing method, characterized in that, include: Obtain the target password to be guessed; The target location where character transformations may occur in the target cipher is guessed using a cryptographic language model with a self-attention mechanism; The cryptographic language model based on the self-attention mechanism learns multiple character substitution rules during training to replace characters at the target positions, thereby obtaining a password guessing dataset. The self-attention mechanism cryptographic language model is trained through the following steps: Collect multiple user password data and perform data preprocessing on the multiple user password data. Filter out user password data whose password length is within a preset range and whose ASCII code can be printed, and use this as a sample user password dataset. Filter password pairs with a common substring from the sample user password dataset; Each sample user password data in the sample user password dataset includes user account information and all passwords corresponding to the user account information. The filtering of password pairs with a common substring in the sample user password dataset includes: Based on preset filtering conditions, all passwords in the sample user password dataset are compared, and password pairs with common substrings are obtained from the sample user password dataset. The preset filtering conditions include at least whether the characters in the password pairs are the same, whether the password pairs are substrings of each other, whether the password pairs are case-sensitive, whether the password pairs conform to the Leet transform, whether the password pairs are in reverse order, whether the password pairs conform to the sequence key, and whether the password pairs have a common string. The generative pre-trained Transformer model is trained based on the cryptographic pair to obtain the cryptographic language model with the self-attention mechanism. The process of training a generative pre-trained Transformer model based on the cryptographic pair to obtain a self-attention mechanism cryptographic language model includes: The password pairs are input into a generative pre-trained Transformer model, which learns the second mapping relationship between the password pairs, the positions where character transformations occur between the password pairs, and the weights of each position where character transformations occur. The learned generative pre-trained Transformer model is used as the cryptographic language model for the self-attention mechanism.

2. The method according to claim 1, characterized in that, The method further includes: Analyze the first mapping relationship between the target password and the guessed password dataset; Based on the first mapping relationship, password guessing rules are extracted, and the password guessing rules are used to optimize the self-attention mechanism cryptographic language model.

3. The method according to claim 2, characterized in that, The process of obtaining the target password to be guessed and guessing the target positions where character transformations may occur in the target password using a self-attention mechanism cryptographic language model includes: The target password to be guessed is input into the cryptographic language model of the self-attention mechanism to guess multiple positions where character transformations may occur in the target password, as well as the weight distribution of each position; The probability of a character transformation occurring at each position is determined based on the weight distribution. Positions with a probability greater than a preset threshold are selected as target positions where character transformations may occur in the target password.

4. The method according to claim 3, characterized in that, The cryptographic language model based on the self-attention mechanism learns multiple character substitution rules during training to replace characters at the target positions, resulting in a password guessing dataset, including: The target positions are sorted according to the probability of character transformation, and multiple target positions with probability differences less than a preset difference threshold are retained; The starting characters at the target positions where the probability difference is less than a preset difference threshold are sampled using a roulette wheel. All candidate characters that meet the multiple character replacement rules are used in the next generation of guess characters to obtain the guessed password dataset.

5. The method according to claim 4, characterized in that, The first mapping relationship includes the coverage of password guessing; The analysis of the first mapping relationship between the target password and the guessed password dataset includes: Obtain the plaintext cipher set corresponding to the target cipher to be guessed; Calculate the coverage of the guessed cipher dataset to the plaintext cipher set, where the coverage is the proportion of ciphers in the plaintext cipher set that appear in the guessed cipher dataset.

6. A password guessing device, characterized in that, include: The acquisition module is used to acquire the target password to be guessed; The guessing module is used to guess the target position where character transformations may occur in the target cipher using a cryptographic language model with a self-attention mechanism; The replacement module is used to replace characters at the target position with multiple character replacement rules learned during the training of the cryptographic language model based on the self-attention mechanism, so as to obtain a guessed password dataset. The model training module is used to collect multiple user password data and perform data preprocessing on the multiple user password data, and filter out user password data whose password length is within a preset range and whose ASCII code can be printed, as a sample user password dataset; filter password pairs with common substrings in the sample user password dataset; each sample user password data in the sample user password dataset includes user account information and all passwords corresponding to the user account information. The step of filtering password pairs with common substrings in the sample user password dataset includes: comparing all passwords in the sample user password dataset based on preset filtering conditions to obtain password pairs with common substrings in the sample user password dataset; wherein, the preset filtering conditions include at least whether the characters in the password pairs are the same, whether the password pairs are substrings of each other, whether the password pairs are case-sensitive, whether the password pairs conform to Leet transform, whether the password pairs are in reverse order, whether the password pairs conform to sequence keys, and whether the password pairs have a common string; training a generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model; the step of training the generative pre-trained Transformer model based on the password pairs to obtain the self-attention mechanism cryptographic language model includes: inputting the password pairs into the generative pre-trained Transformer model, learning the second mapping relationship between the password pairs, the positions where character transformations occur between the password pairs, and the weights of each position where character transformations occur through the generative pre-trained Transformer model; and using the learned generative pre-trained Transformer model as the self-attention mechanism cryptographic language model.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the password guessing method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the password guessing method as described in any one of claims 1 to 5.

Images