Hybrid Password Cracking Method Combining Neural Network Model and Hashcat

Abstract

The present invention discloses a hybrid password cracking method combining a neural network model and Hashcat. The method of the present invention includes pre-training a general neural network model based on a password data set, fine-tuning the general model with short passwords and long passwords respectively to construct two exclusive models applicable to short passwords and long passwords; using the exclusive models to generate long and short password data, the long password data is used as the dictionary for dictionary attack, and the short password data is mapped into masks according to the mask rules of Hashcat to generate a mask list; for the target password hash value to be cracked, the target password hash value is cracked through the Hashcat mask attack mode in combination with the mask list, and the target password hash value is cracked through the Hashcat dictionary attack mode in combination with the dictionary, and the cracked password is returned. The purpose of the present invention is to combine a neural network model and Hashcat to achieve password cracking so as to improve the cracking success rate and optimize the utilization of computing resources.

Description

Technical Field

[0001] The present invention belongs to the technical field of password security, and specifically relates to a hybrid password cracking method combining a neural network model and Hashcat. Background Art

[0002] Text passwords have the advantages of low deployment cost, easy recovery, simple use, easy memorization, no need for complex hardware support, and extremely low deployment cost. Therefore, text passwords are still widely used for identity authentication in network communication and Internet applications. However, the security of text passwords is facing unprecedented challenges. In recent years, database leakage incidents have occurred frequently. These real password data make data-driven password guessing based on mathematical probability models possible, seriously threatening the security of user passwords. In the context of frequent data leakage incidents, security researchers use password cracking tools such as Hashcat to deeply analyze users' password habits and help improve password policies. They provide various attack modes, such as dictionary attack, rule attack, mask attack, and combination attack. Users can flexibly select the most suitable attack strategy according to specific security requirements and the characteristics of the target hash. Although each user has different preferences for choosing passwords, through the analysis of a large number of user password datasets, researchers have found that these datasets often have certain statistical characteristics and laws. These laws may be reflected in aspects such as password length distribution, character type distribution, and common character combinations. Based on these statistical characteristics, researchers have proposed various password guessing models, such as those based on probabilistic context-free grammar (PCFG) and Markov models. The PCFG model defines the syntax structure of passwords, decomposes passwords into different syntax units, and estimates the probability distribution of each unit according to training data. The Markov model predicts the possibility of the next character by analyzing the transition probability between characters. These models can capture the generation laws of passwords to a certain extent, generate possible password guessing sets, and provide powerful tools for password strength evaluation and security research. However, this statistical probability-based password guessing model relies on prior knowledge, is affected by the quality of training set data, and lacks generalization.

[0003] With the rapid development of machine learning and deep learning technologies, these technologies have been applied by researchers to password guessing. Password guessing models such as FLA (fast, lean, and accurate) based on recurrent neural networks, PassGAN based on Generative Adversarial Network (GAN), and PassGPT based on Large Language Model (LLM) have been proposed. Similar to the Markov model, FLA also predicts the next character through n-order strings. The difference is that after training, FLA automatically assigns a small (non-zero) probability to each character in the character table as the prediction result of the input n-order string, which greatly improves the generalization of the model. PassGAN distinguishes between real leaked password datasets and fake passwords generated by the generator, and learns the data distribution of the real password dataset through multiple feedbacks to generate passwords similar to the user's password habits. PassGPT uses the database and text generation capabilities of the large language model to fine-tune GPT2 with the password dataset to generate passwords and achieve password guessing. By training on a large-scale password dataset, these models can learn the complex dependencies and patterns between characters in passwords, thus generating higher-quality password guessing sets. Compared with traditional models, deep learning-based models can usually better capture the semantic and structural features of passwords, improving the accuracy and coverage of guessing. These models can generate possible password guessing sets based on known password datasets to evaluate password strength or assist in security research. However, the speed of generating dictionaries by these password guessing methods is much lower than the computing speed of Hashcat using GPU resources to crack hash values, resulting in limited cracking efficiency, which poses challenges to improving the efficiency of password guessing. Summary of the Invention

[0004] Technical problem to be solved by the present invention: In view of the above problems of the prior art, a hybrid password cracking method combining a neural network model and Hashcat is provided. The present invention aims to combine a neural network model and Hashcat to achieve password cracking to improve the cracking success rate and optimize the utilization of computing resources.

[0005] To solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0006] A hybrid password cracking method combining a neural network model and Hashcat, comprising the following steps:

[0007] Sx101, cleaning the password dataset to remove invalid or abnormal data and extracting available real passwords;

[0008] S102. Split the password dataset after data cleaning into a short password dataset and a long password dataset;

[0009] S103. Use the entire password dataset to initially train a neural network model to learn common password patterns and probability distributions to obtain a general neural network model for generating passwords. Freeze the parameters of the lower-layer neurons of the general neural network model, and separately fine-tune and train the parameters of the upper layer of the general neural network model using the short password dataset and the long password dataset, thereby obtaining two exclusive models suitable for short passwords and long passwords;

[0010] S104. Use the exclusive model for long passwords to generate real password data for long passwords and add them to the dictionary; use the exclusive model for short passwords to generate real password data for short passwords. Map the real passwords of short passwords to masks according to the mask rules of Hashcat, count the probabilities of the masks, and sort them in descending order to obtain a mask list;

[0011] S105. For the target password hash value to be cracked, crack the target password hash value through the Hashcat mask attack mode in combination with the mask list, and crack the target password hash value through the Hashcat dictionary attack mode in combination with the dictionary, and return the cracked password.

[0012] Optionally, the data cleaning in step S101 includes: removing duplicate passwords, deleting passwords with incorrect number of digits, passwords containing invalid characters, and deleting some or all of the non-printable ASCII codes.

[0013] Optionally, the splitting of the password dataset after data cleaning into a short password dataset and a long password dataset in step S102 includes: traversing each password in the password dataset after data cleaning, and combining the preset length threshold L, dividing passwords with a length less than or equal to the length threshold L into the short password dataset, and dividing passwords with a length greater than the length threshold L into the long password dataset, and finally splitting the password dataset after data cleaning into a short password dataset and a long password dataset.

[0014] Optionally, when generating long passwords or short passwords in step S104, it includes generating a password dataset according to the scale, and after generating each scale of password dataset, determining whether the generation is completed:

[0015] S201. Initialize the current scale, use the exclusive short password neural network model that has completed training and fine-tuning in this round to generate a dataset composed of real passwords of the current scale, map the real passwords to masks according to the mask rules of Hashcat, and sort them in descending order;

[0016] S202. Increase the current generated password scale to obtain a new current scale;

[0017] S203. Use the exclusive short passphrase neural network model that has completed training and fine-tuning in this round to generate a dataset consisting of new real passphrases of the current scale, map the real passphrases to masks according to the mask rules of Hashcat, and sort them in descending order.

[0018] S204. Calculate the mask coincidence rate between the mask lists of the new current scale and the previous scale according to the following formula:

[0019] C = |A ∩ B| / N;

[0020] Where, C represents the mask coincidence rate, A is the set of masks extracted from the dataset of the current scale with a probability greater than a specific threshold T, B is the set of masks extracted from the dataset of the previous scale with a probability greater than a specific threshold T, |A ∩ B| represents the number of common elements in the two sets, N is the number of masks in A with a probability greater than a specific threshold T, and the value range of the mask coincidence rate is [0, 1].

[0021] S205. Determine whether the mask coincidence rate is greater than the preset threshold R. If it is greater than the preset threshold R, it is determined that the generation of passphrases of the current scale is completed, and the process ends and exits; otherwise, jump to step S202.

[0022] Optionally, when using the exclusive model for long passphrases to generate real passphrase data for long passphrases and adding them to the dictionary in step S104, the length of the real passphrases for generating long passphrases is [L, L max , where L is the preset length threshold, and L max is the maximum value of the passphrase length.

[0023] Optionally, when using the exclusive model for short passphrases to generate real passphrase data for short passphrases in step S104, the length of the real passphrases for generating short passphrases is [L min , L], where L is the preset length threshold, and L min [[ID=ID=28]]is the minimum value of the passphrase length.

[0024] Optionally, the preset length threshold is taken as 10.

[0025] Optionally, the maximum value of the passphrase length is 32.

[0026] Optionally, the minimum value of the passphrase length is 6.

[0027] Optionally, when cracking the target passphrase hash value through the Hashcat mask attack mode in combination with the mask list in step S105, it includes preferentially using the masks with higher probabilities and exceeding the preset threshold in the mask list to crack the target passphrase hash value.

[0028] The present invention combines a deep learning model with the Hashcat mask attack mode to propose an efficient password cracking method. Compared with the prior art, the present invention mainly has the following beneficial effects:

[0029] 1. The present invention adopts a phased training strategy. First, a general model is trained on the complete data set to learn the password pattern and probability distribution. Then, the lower-layer parameters are frozen, and the upper-layer parameters are fine-tuned with short passwords and long passwords respectively to adapt to different-length password data sets obtained by users, improve the adaptability to short passwords and long passwords, and adapt to the sparsity of long passwords, thereby enhancing the cracking success rate. After generating short passwords that conform to statistical characteristics, the present invention maps them to mask expressions recognizable by Hashcat and adopts a mask probability sorting algorithm to preferentially test high-frequency patterns, making the cracking process more targeted. This method can not only reproduce the patterns in the password set but also generalize passwords that do not exist in the existing password set but have similar structures, expand the searchable space, and improve the Hashcat cracking efficiency.

[0030] 2. To make full use of the learning ability of the neural network model, the present invention further designs a mask coincidence rate evaluation mechanism to dynamically monitor the change trend of the mask distribution by calculating the coincidence degree of high-probability masks under different generated password scales. When the coincidence rate tends to be stable (i.e., greater than the specified threshold R), it is determined that the model has fully learned the password distribution, and the calculation can be optimized based on the stable mask set, reducing the waste of GPU resources. At the same time, it ensures the representativeness and diversity of the generated masks, improving the cracking efficiency. The present invention has significant advantages in both enhancing the generalization ability and fully exploring the model's feature learning ability for passwords, providing a new solution for efficient password security analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is a basic process schematic diagram of the method of the embodiment of the present invention.

[0032] Figure 2 is a detailed process schematic diagram of the method of the embodiment of the present invention.

[0033] Figure 3 is a process schematic diagram of data cleaning and data splitting in the embodiment of the present invention.

[0034] Figure 4 is a process schematic diagram of model construction in the embodiment of the present invention.

[0035] Figure 5 is a process schematic diagram of Hashcat cracking in the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0036] To make the objectives, technical solutions and advantages of the present invention clearer and more definite, the present invention will be further described in detail below in conjunction with specific embodiments. It should be noted that the embodiments described herein are only used to illustrate the content of the present invention and are not intended to limit it.

[0037] As Figure 1 and Figure 2 shown, the hybrid password cracking method of this embodiment combining a neural network model and Hashcat includes the following steps:

[0038] S101, data cleaning:

[0039] Perform data cleaning on the password dataset to remove invalid or abnormal data and extract available real passwords;

[0040] S102, data splitting:

[0041] Split the password dataset after data cleaning into a short password dataset and a long password dataset;

[0042] S103, model construction:

[0043] Use the entire password dataset to perform initial training on the neural network model to learn the general password patterns and probability distributions to obtain a general neural network model for generating passwords. Freeze the lower-layer neuron parameters of the general neural network model, and use the short password dataset and the long password dataset to perform fine-tuning training on the higher-layer parameters of the general neural network model respectively, so as to obtain two exclusive models applicable to short passwords and long passwords;

[0044] S104, model application:

[0045] Use the exclusive model for long passwords to generate real password data for long passwords and add them to the dictionary; use the exclusive model for short passwords to generate real password data for short passwords, map the real passwords of short passwords to masks according to the mask rules of Hashcat, count the probabilities of the masks and sort them in descending order according to the probabilities of the masks to obtain a mask list; according to the mask rules of Hashcat, map lowercase letters to " ", uppercase letters to " ", numbers to " ", and special characters to " ". Assume that there is a real password of 6 digits, then the generated mask is six " "; after mapping to masks, count the probability (appearance frequency) of each mask. The password distribution usually follows a power-law distribution, that is, a small number of high-frequency masks cover a large number of passwords. Count the appearance probability of each mask and sort them in descending order according to the probability;

[0046] S105, Hashcat cracking:

[0047] For the target password hash value to be cracked, use the Hashcat mask attack mode to crack the target password hash value in combination with the mask list, and use the Hashcat dictionary attack mode to crack the target password hash value in combination with the dictionary, and return the cracked password.

[0048] In step S101 of this embodiment, data cleaning includes: removing duplicate passwords, deleting passwords with incorrect number of digits, passwords containing invalid characters, and deleting some or all of the non-printable ASCII codes. Specifically, as Figure 3 shown, the specific steps included in data cleaning in step S101 of this embodiment include: loading the original password data set; removing duplicates: deleting duplicate passwords; filtering invalid passwords, including: deleting passwords with incorrect number of digits, passwords containing invalid characters, and deleting non-printable ASCII codes.

[0049] In step S102 of this embodiment, splitting the password data set after data cleaning into a short password data set and a long password data set includes: traversing each password in the password data set after data cleaning, and combining with the preset length threshold L, dividing passwords with a length less than or equal to the length threshold L into the short password data set, and dividing passwords with a length greater than the length threshold L into the long password data set, and finally splitting the password data set after data cleaning into a short password data set and a long password data set. The preset length threshold L can be selected according to actual needs. For example, as an optional implementation method, as Figure 3 shown, in this embodiment, the default value of the preset length threshold L is 10. Divide passwords with a length less than or equal to 10 into the short password data set, and divide passwords with a length greater than 10 into the long password data set. Finally, split the password data set after data cleaning into a short password data set and a long password data set. Taking the Rockyou data set leaked in 2009 as an example, this data set contains 32.6 million passwords. Combining Figure 3 with data cleaning, first, after performing a duplicate removal operation on the original Rockyou data set, the remaining data is 14.34 million passwords. Second, filter invalid data. Considering the current website password rules, delete passwords with less than 6 digits or more than 32 digits, remove invalid characters in the passwords, and delete non-printable ASCII codes. After filtering, 13.99 million passwords remain. Finally, count the password lengths. Here, taking the length boundary set to 10 as an example, separate the data sets of passwords with less than or equal to 10 digits and passwords with more than 10 digits. The short password data set has 11,603,337 rows, accounting for 82.90%, and the long password data set has 2,394,106 rows, accounting for 17.10%.

[0050] Figure 4This is a schematic diagram of the process for model construction in this embodiment. It should be noted that the neural network model in this embodiment can adopt the required neural network model according to needs, and both can achieve the training and generation of real passwords. As an optional implementation method, this embodiment constructs a neural network model with the existing PassGAN model, which can be extended to other password guessing models based on neural networks, and is not intended to limit the present invention. Load the entire Rockyou password dataset and construct a PassGAN model, where both the generator and the discriminator are composed of 5-layer residual networks (each layer with a dimension of 128). Through the adversarial training of the generator-discriminator, the generator learns the distribution of the training data, and the discriminator distinguishes real passwords from generated passwords. After iterative training, a general password generation model is obtained. After training is completed, freeze the low-level parameters and retain their learning ability on the complete dataset. Use short passwords to fine-tune the high-level neurons to obtain a short password model. Here, taking the length setting of L = 10 as an example, call the short password model to generate short passwords, with a minimum length of 6 characters and a maximum length of 10 characters.

[0051] When generating long passwords or short passwords in step S104 of this embodiment, it includes generating a password dataset according to the scale, and after generating each scale of the password dataset, determining whether the generation is completed:

[0052] S201, initialize the current scale, use the exclusive short password neural network model that has completed training and fine-tuning in this round to generate a dataset composed of real passwords of the current scale, map the real passwords to masks according to the mask rules of Hashcat and sort them in descending order;

[0053] S202, increase the current generated password scale to obtain a new current scale;

[0054] S203, use the exclusive short password neural network model that has completed training and fine-tuning in this round to generate a dataset composed of real passwords of the new current scale, map the real passwords to masks according to the mask rules of Hashcat and sort them in descending order;

[0055] S204, calculate the mask coincidence rate between the new current scale and the mask list of the previous scale according to the following formula:

[0056] C = |A ∩ B| / N;

[0057] Among them, C represents the mask coincidence rate. A is the set of masks extracted from the current-scale dataset with probabilities greater than a specific threshold T. B is the set of masks extracted from the previous-scale dataset with probabilities greater than a specific threshold T. |A∩B| represents the number of common elements in the two sets. N is the number of masks in A with probabilities greater than a specific threshold T. The value range of the mask coincidence rate is [0,1]. To evaluate the similarity of mask sets of different password datasets, in this embodiment, the mask coincidence rate is calculated to achieve this. The mask coincidence rate is an index to measure the similarity degree of masks mapped by passwords of two different orders of magnitude, and its definition is: extract the set of masks A with probabilities greater than a specific threshold (T, default is 0.0001) from the first dataset, and select the first N masks of the same number from the second dataset to form the set B, and calculate the ratio of the size of their intersection to N;

[0058] S205. Determine whether the mask coincidence rate is greater than the preset threshold R. If it is greater than the preset threshold R, it is determined that the password generation of the current scale is completed, and the process ends and exits; otherwise, jump to step S202 to continue the iteration.

[0059] By the above method, compare the mask sets generated under different password scales (such as , , etc.), and observe the change trend of the mask coincidence rate. When the mask coincidence rate tends to be stable (greater than a certain threshold R, default is 95%), it is determined that the password distribution is stable, and the password feature learning ability of the neural network model has been fully exploited. In this embodiment, to evaluate the stability of the mask distribution of different password scale datasets, select the high-frequency masks with probabilities greater than 0.01%, and calculate their coincidence rates in the mask sets generated by passwords of different orders of magnitude. If the coincidence rate tends to be stable (greater than the given threshold 95%), it indicates that the neural network model has learned the password distribution characteristics more fully. At this time, a smaller-scale mask set can be used for optimization calculation to reduce the calculation overhead; otherwise, a larger-scale password data needs to be generated and remapped into a mask mode to further optimize the calculation.

[0060] For long passwords, freeze the parameters of the lower-layer neurons that have been trained in the general neural network model, and fine-tune the parameters of the upper layer with the long-password dataset to learn the characteristics and distribution of long passwords, and call the fine-tuned exclusive model to generate long passwords. When using the exclusive model of long passwords to generate the real password data of long passwords and add them to the dictionary in step S104 of this embodiment, the length of the real password for generating long passwords is [L, L max , where L is the preset length threshold, and L max is the maximum value of the password length. Among them, the maximum value L max of the password length can be taken according to actual needs. For example, as an optional implementation method, in this embodiment, the maximum value L maxIs 32.

[0061] For short passwords, freeze the parameters of the lower-layer neurons that have been trained in the general neural network model, and fine-tune the parameters of the upper layer with the short password dataset to learn the features and distributions of short passwords, and call the fine-tuned exclusive model to generate short passwords. When generating the real password data of the short password using the exclusive model of the short password in step S104 of this embodiment, the length of the real password for generating the short password is [L min , L], where L is a preset length threshold, and L min Is the minimum value of the password length. Among them, the minimum value L of the password length min Can be set according to actual needs. For example, as an optional implementation, the minimum value L of the password length in this embodiment min Is 6.

[0062] Figure 5 Is the flow diagram of the Hashcat cracking in this embodiment. Refer to Figure 5 , in the password cracking process of the target password hash value (hash value) to be cracked in step S105 of this embodiment, the short password uses a mask attack, and the long password uses a dictionary attack. The two use a parallel cracking strategy, and the two modes are executed in parallel, and all the cracked passwords are returned to the user. When cracking the target password hash value through the Hashcat mask attack mode in combination with the mask list in step S105, it includes preferentially using the masks with higher probabilities and exceeding the preset threshold in the mask list to crack the target password hash value.

[0063] Suppose there is a set of password pattern sets , where each pattern represents a password structure (such as a combination pattern of numbers, lowercase letters, uppercase letters, etc.). Each pattern The probability of occurrence in the generated password is , then define the cracking efficiency Of the pattern As:

[0064] ;

[0065] Among them, Is the probability of occurrence of the pattern, Is the number of possible passwords included in this pattern, Is the average time required to crack this pattern. The optimization goal is to maximize the number of cracked passwords within a limited time , and the formula is expressed as:

[0066] ;

[0067] Satisfy the constraint condition: , where is the number of patterns we can attempt within time For long passwords, since it takes a long time to crack masks with more than 10 digits using the mask pattern, the dictionary pattern is selected for cracking. Finally, all the successfully cracked passwords are returned.

[0068] To verify the hybrid password cracking method combining the neural network model and Hashcat in this embodiment, this embodiment takes the PassGAN model training on the Rockyou dataset as an example. The scale of the passwords generated by the PassGAN model is , among the comparison results of mask coincidence rates with a frequency greater than 0.01%, and The coincidence rate of the two mask sets mapped by the generated passwords is 100% after being sorted in descending order, exceeding the set threshold of 95%. Take The mask sets mapped by the generated passwords with a probability greater than 0.01% are used to crack the hash values (password hash values). The coverage rate is 76.19% at 4 hours 44 minutes and 58 seconds. However, the coverage rate of only The generated passwords is only 15.09%. It can be seen that the scheme coverage rate of the hybrid password cracking method combining the neural network model and Hashcat in this embodiment is increased by 61.1%, improving the cracking efficiency of Hashcat, and its resource usage can be reduced through the mask coincidence rate.

[0069] The above are only the preferred embodiments of the present invention. The protection scope of the present invention is not limited to the above embodiments. All technical solutions within the idea of the present invention belong to the protection scope of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A hybrid password cracking method combining a neural network model and Hashcat, characterized in that: The steps include: S101, performing data cleaning on the password dataset to remove invalid or abnormal data and extract usable real passwords; S102, dividing the password data set after data cleaning into a short password data set and a long password data set; S103: Initially train the neural network model using the entire password dataset to learn common password patterns and probability distributions to obtain a universal neural network model for generating passwords. The low-level neuron parameters of the universal neural network model are frozen, and the high-level parameters of the universal neural network model are fine-tuned using the short password dataset and the long password dataset, respectively, to obtain two specialized models suitable for short and long passwords. S104, generating a long password using a dedicated model for long passwords and adding the long password to a dictionary; Generate short passwords using a dedicated model for short passwords. Map the short passwords to masks based on Hashcat's masking rules. Count the mask probabilities and sort them in descending order to obtain a mask list. S105 , for the target password hash value to be cracked, the target password hash value is cracked by using the Hashcat mask attack mode in combination with the mask list, and the target password hash value is cracked by using the Hashcat dictionary attack mode in combination with the dictionary, and a successfully cracked password is returned.

2. The hybrid password cracking method combining a neural network model and Hashcat according to claim 1, characterized in that: The data cleaning in step S101 includes: deleting duplicate passwords, deleting passwords that do not meet the required number of digits, deleting passwords containing invalid characters, and deleting part or all of the unprintable ASCII codes.

3. The hybrid password cracking method combining a neural network model and Hashcat according to claim 1, characterized in that: In step S102, the cleaned password data set is divided into a short password data set and a long password data set, which includes: traversing each password in the cleaned password data set, combining a preset length threshold L, classifying passwords with a length less than or equal to the length threshold L into the short password data set, and classifying passwords with a length greater than the length threshold L into the long password data set, and finally dividing the cleaned password data set into the short password data set and the long password data set.

4. The hybrid password cracking method combining a neural network model and Hashcat according to claim 1, characterized in that: When generating a long password or a short password in step S104, the process includes generating a password data set according to the scale, and determining whether the generation is complete after generating a password data set of each scale: S201: Initialize the current scale and use the dedicated short password neural network model that has been trained and fine-tuned in this round to generate a dataset consisting of real passwords of the current scale. Map the real passwords into masks according to the masking rules of Hashcat and sort them in descending order. S202, increasing the current generated password size to obtain a new current size; S203: Use the trained and fine-tuned dedicated short password neural network model to generate a new dataset of real passwords of the current scale. Map the real passwords to masks according to Hashcat's masking rules and sort them in descending order. S204: Calculate the mask overlap ratio between the mask lists of the new current scale and the previous scale according to the following formula: C=|A∩B| / N; Where C represents the mask overlap rate, A is the set of masks extracted from the current-scale dataset with a probability greater than a specific threshold T, B is the set of masks extracted from the previous-scale dataset with a probability greater than a specific threshold T, |A∩B| represents the number of common elements in the two sets, N is the number of masks in A with a probability greater than a specific threshold T, and the range of the mask overlap rate is [0,1]. S205, determining whether the mask overlap rate is greater than a preset threshold R. If so, determining that the password generation for the current scale is complete, and terminating and exiting; Otherwise, jump to step S202.

5. The hybrid password cracking method combining a neural network model and Hashcat according to claim 3, characterized in that: In step S104, when the long password exclusive model is used to generate the real password data of the long password and add it to the dictionary, the length of the real password generated is [L, L max ], where L is the preset length threshold, L max The maximum password length.

6. The hybrid password cracking method combining a neural network model and Hashcat according to claim 5, characterized in that: In step S104, when the short password exclusive model is used to generate the real password of the short password, the length of the real password generated by the short password is [L min ,L], where L is the preset length threshold, L min The minimum password length.

7. The hybrid password cracking method combining a neural network model and Hashcat according to claim 6, characterized in that: The preset length threshold is 10.

8. The hybrid password cracking method combining a neural network model and Hashcat according to claim 7, characterized in that: The maximum password length is 32.

9. The hybrid password cracking method combining a neural network model and Hashcat according to claim 8, characterized in that: The minimum password length is 6.

10. The hybrid password cracking method combining a neural network model and Hashcat according to claim 1, characterized in that: In step S105 , when cracking the target password hash value using the Hashcat mask attack mode in combination with the mask list, the mask in the mask list with a higher probability and exceeding a preset threshold is preferentially used to crack the target password hash value.

Images