A data intelligence-driven directional password guessing method and system

Abstract

The application discloses a kind of direction password guessing method and system based on data intelligent driving, belongs to password guessing technical field, including: input representation layer module, condition generation model module and output layer and decoding strategy module;Input representation layer module is used to provide semantic input;Condition generation model module is based on Transformer architecture, combines pointer replication mechanism and editing predictor submodule, models user historical password reuse and individualized modification, generates candidate password;Output layer and decoding strategy module are used to output the candidate password.The application proposes a directional password guessing model that can combine data intelligent analysis and user feature learning mechanism, enabling efficient, personalized password generation and prediction, improving the accuracy and adaptability of password security research.

Description

Technical Field

[0001] This invention relates to the field of password guessing technology, and more specifically, to a targeted password guessing method and system based on data intelligence. Background Technology

[0002] Currently, passwords remain the most common means of identity verification in network systems, account authentication, and data protection. However, due to the tendency for users to simplify passwords and the predictable patterns in password setting, password guessing and cracking have become an important area of ​​research in cybersecurity. Existing password guessing techniques can be mainly divided into the following categories: (1) Password guessing methods based on rules and dictionaries: Traditional methods collect a large number of leaked password samples to build a password dictionary or rule base, and then generate candidate passwords according to preset rules (such as character replacement, number appending, case conversion, etc.). These methods are simple to implement and computationally efficient, but they rely on fixed rules, have poor generalization ability, and cannot adapt to the differentiated password characteristics of specific user groups. For example, the prior art with publication number CN112149388A provides "A method for identifying word deformation in passwords and generating guessing rules", which discloses a scheme for generating passwords using rule combinations, but it is limited to static rule combinations.

[0003] (2) Password generation methods based on statistical models: Some studies introduce probabilistic statistical models, such as Markov models and PCFG (probabilistic context-free grammars), to learn the character distribution and structural patterns of passwords. These methods can improve the rationality of the generated passwords to some extent, but they still cannot utilize user profiles or contextual data for targeted generation. For example, in the "Password Guessing Method" published in CN109829289A, the generation process relies solely on the probability distribution of password characters and has no ability to learn from the characteristics of specific groups of people.

[0004] (3) Intelligent Password Generation Model Based on Deep Learning: In recent years, deep learning technology has been introduced into password guessing tasks. For example, RNN, GAN, or Transformer models are used to learn from leaked password sets to generate password sets that are closer to the real distribution. Representative research on these methods includes "A Privacy-Preserving Computation Security System Based on Domestic Cryptographic Algorithms" (publication number CN119128944A). These methods can automatically extract complex features, but they are mostly general models that only start from the features of password text and lack targeted modeling for specific users, resulting in a limited hit rate.

[0005] In summary, although existing technologies in the field of password guessing have evolved from rule-based static generation to model-based intelligent generation, they still have the following shortcomings: (a) Lack of mechanisms to incorporate user behavior data, social attributes, or historical information into the model; (b) The model cannot dynamically adjust the generation strategy based on the characteristics of the target object; (c) Generation efficiency and hit rate remain low in targeted attack scenarios.

[0006] To address the problems of poor targeting, insufficient feature utilization, and low generation efficiency in existing password guessing technologies, there is an urgent need to develop new technical solutions. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a data-driven targeted password guessing method and system. It proposes a targeted password guessing model that combines data intelligence analysis and user feature learning mechanism, which can achieve efficient and personalized password generation and prediction, and improve the accuracy and adaptability of password security research.

[0008] The objective of this invention is achieved through the following solution: A data intelligence-driven targeted password guessing system includes: an input representation layer module, a condition generation model module, and an output layer and decoding strategy module; The input representation layer module is used to provide semantic input; The condition generation model module is based on the Transformer architecture and combines a pointer copying mechanism with an edit prediction submodule to model the reuse and personalized modification of users' historical passwords and generate candidate passwords. The output layer and decoding strategy module are used to output the candidate passwords.

[0009] Furthermore, the input representation layer module specifically executes the following process: first, it receives text information from the target user; then, it encodes the text information at the character level or word level, and maps it into a high-dimensional vector representation through the embedding layer to form password embedding, personal information embedding, and context embedding, thereby providing semantic input for subsequent condition generation.

[0010] Furthermore, the text information includes a set of personal information. and its historical password sequence .

[0011] Furthermore, in the condition generation model module, the modeling of user historical password reuse and personalized modification based on the Transformer architecture, combined with the pointer copying mechanism and the edit prediction submodule, specifically includes the following process: During the encoding process, a conditional attention module is introduced on the basis of multi-head self-attention, so that the model can dynamically focus on the user features or historical fragments most relevant to the current generated content during the encoding process; by weighted fusion of the vector representation of user personal information and historical passwords, the conditional context can be used to explicitly control the generated results. During the decoding process, the model dynamically switches between generation mode and copy mode; generation mode samples characters or subwords from a fixed vocabulary; copy mode directly copies fragments from the input sequence; and, the type of editing operation is predicted through an independent prediction branch; when the model selects copy mode, it performs the corresponding modification operation based on the prediction result on the copied content.

[0012] Furthermore, in the output layer and decoding strategy module, during the generation stage, multiple candidate passwords are output using a beam search or Top-k sampling strategy; and the generation results are filtered and reordered according to the target website's strategy rules, finally outputting the optimal candidate password that meets the strategy constraints.

[0013] Furthermore, it also includes a training and policy optimization module, which employs multi-objective joint optimization during model training, with the loss function defined as:

[0014] in: To calculate the password generation loss, cross-entropy is used to calculate the difference between the generated sequence and the actual password. The copy selection loss is used to supervise the pointer network's decision between generation and copying; The loss is used to predict editing patterns and train the editing module to learn common modification patterns. These are the weighting coefficients.

[0015] Furthermore, the Adam optimizer is used in the optimization process of the training and policy optimization modules. A learning rate warm-up strategy and label smoothing techniques are employed to improve training stability and generalization ability.

[0016] A data-driven, intelligence-based targeted password guessing method includes the following steps: Provide input semantics; The construction condition generation model module, based on the Transformer architecture, combines the pointer copying mechanism and the edit prediction submodule to model the reuse and personalized modification of users' historical passwords and generate candidate passwords; Finally, the candidate password is output.

[0017] Furthermore, the method based on the Transformer architecture, combined with a pointer copying mechanism and an edit prediction submodule, models the reuse and personalized modification of user historical passwords to generate candidate passwords, specifically including the following sub-steps: During the encoding process, a conditional attention module is introduced on the basis of multi-head self-attention, so that the model can dynamically focus on the user features or historical fragments most relevant to the current generated content during the encoding process; by weighted fusion of vector representations of user personal information and historical passwords, the conditional context can be used to explicitly control the generated results. During the decoding process, the model dynamically switches between generation mode and copy mode; generation mode samples characters or subwords from a fixed vocabulary; copy mode directly copies fragments from the input sequence; the type of editing operation is predicted through independent prediction branches; when the model selects copy mode, it performs the corresponding modification operation based on the copied content according to the prediction results.

[0018] The beneficial effects of this invention include: (1) This invention can enhance personalization and targeted generation capabilities: by introducing a conditional attention mechanism and a pointer copying network, it can fully utilize users' personal information (such as name, birthday, email prefix, etc.) and their historical password sequences to achieve personalized password generation for specific users. Compared with traditional methods that rely on statistical distribution or manual rules, it can explicitly model the nonlinear relationship between "user features and password structure", significantly improving the relevance and hit rate of generated passwords.

[0019] (2) This invention can accurately simulate user modification behavior, and the generated results are closer to real habits: It innovatively designs an editing prediction module, which can automatically predict and execute operations such as "replace, insert, delete, and keep unchanged", thereby simulating the user's minor modification behavior when updating passwords. Compared with traditional methods that rely solely on simple concatenation or probability transformation, it can more realistically restore the human behavior pattern of "historical passwords + simple transformations", making the distribution of generated passwords closer to the real user password set.

[0020] (3) This invention enables multi-objective joint optimization, significantly improving generation quality and model stability: by introducing three types of supervision signals—password generation loss, copy selection loss, and edit prediction loss—joint optimization of generation accuracy, copy decision, and modification strategy is achieved. This design not only improves the training stability of the model but also exhibits higher accuracy and diversity in actual generation, avoiding the overfitting problem common in deep models.

[0021] (4) This invention has strong cross-domain generalization ability: Experimental results show that this invention maintains excellent performance on real password datasets from multiple different sources (such as RockYou, CSDN, and 000Webhost). This indicates that the model learns general behavioral features at the user level, rather than statistical patterns of specific datasets, and has good cross-site transfer and generalization ability, making it suitable for password security analysis and strategy design in different business systems.

[0022] (5) This invention is highly practical and scalable: the overall framework can be seamlessly integrated with existing password security systems, password strength assessment modules, and security defense tools. By adjusting the input interface, it can be adapted to various information sources (such as social media data, registration information, historical leakage databases, etc.), and can be combined with the policy constraint module to generate candidate results that conform to the password rules of specific websites. This method can be used for password strength assessment and password policy optimization, as well as for penetration testing and risk modeling within security agencies or enterprises. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a block diagram of the overall module structure of an embodiment of the present invention; Figure 2 This is a joint decoding diagram of conditional attention and pointer replication in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the calculation of the multi-objective loss function in an embodiment of the present invention. Detailed Implementation

[0025] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.

[0026] This invention solves at least the following technical problems: (1) Lack of targeted feature modeling: Existing password generation models based on rules or neural networks are mostly generalized designs that can only learn the overall password distribution and cannot build personalized feature models for specific target users.

[0027] (2) Problem of insufficient utilization of data intelligence: Traditional password generation algorithms usually rely on character statistics or fixed training samples, failing to fully explore the implicit semantic relationships and feature associations between data.

[0028] (3) Problems with insufficient model generation efficiency and hit rate: The existing model generates a large number of candidate passwords with low efficiency, resulting in high computational cost and low hit rate in practical applications.

[0029] (4) Model generalization and adaptation issues: Existing technologies have difficulty maintaining stable performance in different population groups or different language environments.

[0030] To address the aforementioned issues, this invention proposes a model that utilizes data features such as user profiles, social behavior, and language habits to achieve targeted password generation. Leveraging a data-driven intelligence mechanism, it improves the model's ability to capture complex semantic and behavioral features through multi-dimensional data fusion and feature enhancement learning. By constructing a dynamic generation strategy and a probability ranking mechanism, it achieves adaptive optimization of the candidate set, effectively improving the hit rate and inference efficiency in targeted scenarios. A framework based on multi-task learning and transfer learning is designed, enabling the model to automatically adjust its generation strategy according to data features, improving cross-domain generalization capabilities. Specifically, this invention constructs a data-driven targeted password guessing model that integrates user profile information and possesses adaptive learning capabilities, significantly improving the accuracy and generation quality of password prediction for specific target groups while ensuring computational efficiency. Further, the invention proposes a personalized targeted password generation scheme based on deep neural networks, which automatically generates high-probability candidate passwords that meet the target system's policy requirements given the user's personal information and historical password data, thereby improving the accuracy and coverage of targeted password generation.

[0031] More specifically, in a preferred embodiment, as a first aspect of the present invention, a data-driven intelligent targeted password guessing system is provided, comprising: an input representation layer module, a conditional generation model module, an output layer and decoding strategy module, and a training and strategy optimization module. The overall structure is as follows: Figure 1 As shown, the core is the condition generation model module, which is based on the Transformer architecture and combines a pointer copying mechanism with an edit prediction submodule to realize the reuse and personalized modification modeling of users' historical passwords.

[0032] In the input presentation layer module, the system first receives a set of personal information from the target user. (Including name, date of birth, email prefix, etc.) and its historical password sequence The input representation layer encodes the above text information at the character level or word level, and maps it into a high-dimensional vector representation through the embedding layer, forming password embedding, personal information embedding, and context embedding, providing semantic input for subsequent condition generation.

[0033] The conditional generation model module employs an improved Transformer encoder-decoder structure, such as... Figure 2 As shown, its key improved technical features are as follows: Conditional Attention: Building upon multi-head self-attention, a conditional attention module is introduced, enabling the model to dynamically focus on user features or historical fragments most relevant to the currently generated content during the encoding process. This mechanism achieves explicit control of the generated result by weighted fusion of vector representations of user personal information and historical passwords, thus enabling the conditional context to regulate the generated result.

[0034] Pointer-Generator Mechanism: During the decoding phase, the model dynamically switches between generation and copying modes. Generation mode samples characters or subwords from a fixed vocabulary; copying mode directly copies fragments from the input sequence (historical passwords or personal information). This mechanism allows the model to simulate the behavior of real users directly reusing existing information when constructing new passwords, improving the relevance and interpretability of the generated results.

[0035] Edit Prediction Module: During the decoding process, the system predicts the type of editing operation (replace, insert, delete, or leave unchanged) through an independent prediction branch. When the model selects the copy mode, the edit prediction module performs the corresponding modification operation based on the prediction result, thereby achieving the generation method of "historical password + simple transformation". This module effectively enhances the model's ability to fit real user modification habits.

[0036] The training and optimization strategy module employs multi-objective joint optimization during model training, such as... Figure 3 As shown, the loss function is defined as:

[0037] in: To calculate the password generation loss, cross-entropy is used to calculate the difference between the generated sequence and the actual password. The copy selection loss is used to supervise the pointer network's decision between generation and copying; The loss is used to predict editing patterns and train the editing module to learn common modification patterns. represents the weight coefficients. During the optimization process, the Adam optimizer is used, along with a learning rate warm-up strategy and label smoothing techniques to improve training stability and generalization ability.

[0038] The output layer and decoding strategy module, during the generation phase, employs either beam search or Top-k sampling strategies to output multiple candidate passwords. The generated results can be filtered and reordered according to the target website's policy rules (such as password length, character combination requirements, prohibited words, etc.), ultimately outputting the optimal candidate that meets the policy constraints.

[0039] In summary, this invention proposes a data-driven, intelligent-based targeted password guessing model that can intelligently learn and efficiently predict password features of specific users or target groups. It significantly improves targeted password generation performance on multiple real datasets, outperforming traditional Markov, PCFG, TarGuess, and deep generative models (such as PassGAN and LSTM) in metrics such as Hit@k and Guess Number Distribution. This embodiment significantly improves the targeting, interpretability, and cross-domain generalization ability of generated passwords by introducing pointer copying and edit prediction mechanisms, making it suitable for scenarios such as password security assessment, targeted attack simulation, and intelligent defense strategy optimization. Compared with existing Markov models, PCFG models, TarGuess series methods, and deep generative models (such as PassGAN and LSTM), it demonstrates significant progress.

[0040] As a second aspect of the present invention, a data-driven targeted password guessing method is provided, comprising the following steps: Provide input semantics; The construction of a conditional generation model module, based on the Transformer architecture, combines a pointer copying mechanism with an edit prediction submodule to model the reuse and personalized modification of user historical passwords, generating candidate passwords; specifically including the following sub-steps: During the encoding process, a conditional attention module is introduced on the basis of multi-head self-attention, so that the model can dynamically focus on the user features or historical fragments most relevant to the current generated content during the encoding process; by weighted fusion of vector representations of user personal information and historical passwords, the conditional context can be used to explicitly control the generated results. During the decoding process, the model dynamically switches between generation mode and copy mode; generation mode samples characters or subwords from a fixed vocabulary; copy mode directly copies fragments from the input sequence; the type of editing operation is predicted through independent prediction branches; when the model selects copy mode, it performs the corresponding modification operation based on the copied content according to the prediction results.

[0041] Finally, the candidate password is output.

[0042] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0043] According to one aspect of the present invention, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.

[0044] In another aspect, embodiments of the present invention also provide a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

Claims

1. A data-driven intelligent targeted password guessing system, characterized in that, include: The module consists of an input representation layer, a conditional generation model, and an output layer and decoding strategy. The input representation layer module is used to provide semantic input; The condition generation model module is based on the Transformer architecture and combines a pointer copying mechanism with an edit prediction submodule to model the reuse and personalized modification of users' historical passwords and generate candidate passwords. The output layer and decoding strategy module are used to output the candidate passwords.

2. The data-driven intelligent targeted password guessing system according to claim 1, characterized in that, The input representation layer module specifically executes the following process: First, it receives text information from the target user; then, it encodes the text information at the character level or word level, and maps it into a high-dimensional vector representation through the embedding layer to form password embedding, personal information embedding, and context embedding, thereby providing semantic input for subsequent condition generation.

3. The data-driven intelligent targeted password guessing system according to claim 2, characterized in that, The text information includes a collection of personal information. and its historical password sequence .

4. The data-driven intelligent targeted password guessing system according to claim 3, characterized in that, In the condition generation model module, the modeling of user historical password reuse and personalized modification based on the Transformer architecture, combined with the pointer copying mechanism and the edit prediction submodule, specifically includes the following process: During the encoding process, a conditional attention module is introduced on the basis of multi-head self-attention, so that the model can dynamically focus on the user features or historical fragments most relevant to the current generated content during the encoding process; by weighted fusion of the vector representation of user personal information and historical passwords, the conditional context can be used to explicitly control the generated results. During the decoding process, the model dynamically switches between generation mode and copy mode; The generation mode samples characters or subwords from a fixed vocabulary; the copy mode directly copies fragments from the input sequence; and the type of editing operation is predicted through an independent prediction branch; when the model selects the copy mode, the corresponding modification operation is performed on the copied content based on the prediction result.

5. The data-driven intelligent targeted password guessing system according to claim 1, characterized in that, In the output layer and decoding strategy module, during the generation stage, multiple candidate passwords are output using a beam search or Top-k sampling strategy; and the generation results are filtered and reordered according to the target website's policy rules, finally outputting the optimal candidate password that meets the policy constraints.

6. The data-driven intelligent targeted password guessing system according to claim 1, characterized in that, It also includes a training and policy optimization module, which employs multi-objective joint optimization during model training, with the loss function defined as: in: To calculate the password generation loss, cross-entropy is used to calculate the difference between the generated sequence and the actual password. The copy selection loss is used to supervise the pointer network's decision between generation and copying; The loss is used to predict editing patterns and train the editing module to learn common modification patterns. These are the weighting coefficients.

7. The data-driven intelligent targeted password guessing system according to claim 6, characterized in that, During the optimization of the training and policy optimization modules, the Adam optimizer was used. A learning rate warm-up strategy and label smoothing techniques were employed to improve training stability and generalization ability.

8. A targeted password guessing method based on data intelligence, characterized in that, Includes the following steps: Provide input semantics; The construction condition generation model module, based on the Transformer architecture, combines the pointer copying mechanism and the edit prediction submodule to model the reuse and personalized modification of users' historical passwords and generate candidate passwords; Finally, the candidate password is output.

9. The data-driven intelligent targeted password guessing system according to claim 8, characterized in that, The method, based on the Transformer architecture and combining a pointer copying mechanism with an edit prediction submodule, models the reuse and personalized modification of user historical passwords to generate candidate passwords. This process includes the following sub-steps: During the encoding process, a conditional attention module is introduced on the basis of multi-head self-attention, so that the model can dynamically focus on the user features or historical fragments most relevant to the current generated content during the encoding process; by weighted fusion of vector representations of user personal information and historical passwords, the conditional context can be used to explicitly control the generated results. During the decoding process, the model dynamically switches between generation mode and copy mode; The generation mode samples characters or subwords from a fixed vocabulary; the copy mode directly copies fragments from the input sequence. The model predicts the type of editing operation through an independent prediction branch; when the model selects the copy mode, it performs the corresponding modification operation based on the copied content according to the prediction results.

Images