Password guessing method, device, storage medium, and program product

Abstract

Embodiments of the present application provide a password guessing method and device, a storage medium and a program product. The method comprises: training a generative model using a general password dataset to construct a latent space, the generative model comprising an encoder and a decoder, and having the ability to map passwords to latent space vectors and to decode latent space vectors back to passwords; mapping target domain password samples to the latent space using a variational autoencoder to obtain latent space vectors; continuously sampling the latent space vectors in the latent space by a mixed sampling strategy to determine target latent space vectors; the mixed sampling strategy is used to balance semantic coherence and generation diversity; and inputting the target latent space vectors into the decoder to obtain a password guessing candidate set. Under the realistic constraint of few target domain password samples, the efficient use of cross-domain knowledge is realized through a continuous latent space sampling framework, and a password guessing candidate set with high hit rate, high semantic relevance and high coverage diversity is generated.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a password guessing method, device, storage medium, and program product. Background Technology

[0002] Password authentication is one of the most widely used identity verification methods in internet services due to its simple deployment and low cost. However, password guessing attacks continue to threaten the security of this mechanism, with attackers attempting to compromise user accounts by generating candidate strings that match real user passwords. To address this threat, academia and industry have developed various password guessing methods.

[0003] In practical applications, common password guessing methods often involve discrete or simple interpolation during sampling, failing to achieve structured, continuous, and semantically controllable exploration in the latent space. In some schemes combining password guessing with specific model architectures (such as Generative Adversarial Networks (GANs) and Transformers), there may be a problem of strong coupling between password guessing and the model, resulting in a lack of generality. Furthermore, in deep learning-based generative model schemes, existing generative models struggle to learn effective domain distribution features when the target domain has very few samples (usually less than 1000), leading to either over-generalization and a lack of specificity in the generated guessed passwords, or severe overfitting and loss of diversity. Adapting to new domains by directly fine-tuning pre-trained models can easily damage the model's original generalization ability when samples are scarce, causing "catastrophic forgetting." Summary of the Invention

[0004] This application provides a password guessing method, device, storage medium, and program product to improve the accuracy and practicality of password guessing in small samples.

[0005] In a first aspect, embodiments of this application provide a password guessing method, the method comprising: A generative model is trained using a general password dataset to construct a latent space. The generative model includes an encoder and a decoder, and has the ability to map passwords to latent space vectors and decode latent space vectors back to passwords. The encoder is used to map the target domain password sample to the latent space to obtain the latent space vector; In the latent space, the latent space vector is continuously sampled using a hybrid sampling strategy to determine the target latent space vector; the hybrid sampling strategy is used to balance semantic coherence and generative diversity. The target latent space vector is input into the decoder to obtain the password guessing candidate set.

[0006] Secondly, embodiments of this application provide a password guessing device, the device comprising: The latent space construction module is used to train the generative model using a general password dataset to construct a latent space. The generative model includes an encoder and a decoder, and has the ability to map passwords to latent space vectors and decode latent space vectors back to passwords. The latent space vector determination module is used to map the target domain password sample to the latent space using the encoder to obtain the latent space vector. The target latent space vector determination module is used to continuously sample the latent space vector in the latent space using a hybrid sampling strategy to determine the target latent space vector; the hybrid sampling strategy is used to balance semantic coherence and generative diversity. The password guessing candidate set determination module is used to input the target latent space vector into the decoder to decode and obtain the password guessing candidate set.

[0007] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a communication interface; wherein, the memory stores a computer program, and when the computer program is executed by the processor, the processor can at least implement the password guessing method as described in the first aspect.

[0008] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor of an electronic device, enables the processor to at least implement the password guessing method as described in the first aspect.

[0009] Fifthly, embodiments of this application provide a computer program product, including: a computer program or instructions, which, when executed by a processor of an electronic device, enable the processor to at least implement the password guessing method as described in the first aspect.

[0010] The solution provided in this application proposes a sampling framework decoupled from the underlying generative model. This framework enables continuous sampling of the latent space vectors corresponding to password samples in the target domain. It is independent of the internal details of any specific generative model architecture; as long as the generative model can provide an encoding mapping from passwords to continuous latent space vectors and reverse decoding capabilities, this sampling framework can be directly applied. This plug-and-play characteristic allows the solution to be widely compatible with various existing and future password generation models, greatly expanding its application scope. Specifically, this solution encodes small samples of target domain passwords into a pre-trained, structured latent space and performs mixed continuous sampling directly within this space. This allows for efficient utilization of cross-domain knowledge and zero-transfer under the realistic constraint of having very few target domain password samples, generating a password guessing candidate set with high hit rate, high semantic relevance, and high coverage diversity. This approach not only has extremely low training overhead but also fundamentally solves the overfitting problem, enabling the model to simultaneously maintain the breadth of general knowledge and the depth of target domain characteristics. The hybrid sampling strategy balances semantic coherence and generation diversity, resolving the fundamental contradiction between development and exploration in generation tasks. This ensures that generated candidate passwords closely adhere to the semantic and structural features of the target sample while actively exploring regions far removed from known samples. This effectively generates candidate passwords with varied structures and novel character combinations, significantly enhancing generation diversity, particularly in its coverage of long-tail password patterns, which represent a relatively small but crucial segment of the real world. In summary, this embodiment achieves substantial improvements over existing technologies in multiple dimensions, including password guessing accuracy, sample utilization efficiency, generation quality, overfitting resistance, and system compatibility, providing a powerful and practical new solution for password security analysis under small sample conditions. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart illustrating a password guessing method provided in this application embodiment; Figure 2 A system architecture diagram of a password guessing method provided in this application embodiment; Figure 3 A schematic diagram of neighborhood sampling for a password guessing method provided in an embodiment of this application; Figure 4 An extended Brownian bridge sampling diagram of a password guessing method provided in this application embodiment; Figure 5 A schematic diagram of the structure of a password guessing device provided in an embodiment of this application; Figure 6 To and Figure 5 The illustrated embodiment provides a schematic diagram of the electronic device corresponding to the password guessing device. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0014] It should be noted that, in the cases involving user information in the embodiments of this application, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse. In addition, the various models involved in this application (including but not limited to language models or large models) comply with relevant laws and standards.

[0015] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0016] Existing password guessing methods mainly include traditional probability and rule models and deep learning generative models.

[0017] For traditional probabilistic and rule-based models, such as Probabilistic Context-Free Grammar (PCFG) and Markov chain-based models, these methods rely on manual rules or local statistical features to generate passwords. For example, PCFG decomposes passwords into fragments such as letters, numbers, and symbols, and learns the probability distribution of fragment combinations based on training data. Although these models are effective for small-scale, high-frequency password generation, they heavily rely on domain-specific manual rules, making it difficult to capture long-range dependencies and complex structures in passwords. Especially in scenarios where target samples are scarce, their generation performance significantly decreases because they cannot learn effective features from limited data.

[0018] For deep learning generative models: In recent years, deep learning models such as Generative Adversarial Networks (GANs), Variational Autoencoders (VAEs), and Transformers have been introduced into password generation tasks. For example, PassGAN uses adversarial training to learn password distributions without explicit rules; Transformer models long-range character dependencies through self-attention mechanisms. These methods perform well on large-scale general datasets (such as RockYou), but face two major challenges in practical applications: data sparsity and difficulty in cross-domain transfer. Regarding data sparsity, the number of available samples in the target domain in real-world scenarios is extremely small (usually only a few hundred), making it difficult for models to capture domain-specific distributions. Regarding difficulty in cross-domain transfer, password usage patterns vary significantly with different groups and scenarios (e.g., programmers prefer code snippets, and medical personnel often use medical terminology), making it difficult for models trained on general data to be directly transferred to specific domains. In addition, existing deep models often employ fine-tuning strategies in small-sample scenarios, that is, updating parameters with a small amount of target data based on the pre-trained model. However, experiments show that this method is prone to overfitting, which means that the model memorizes samples on the target data but loses its ability to generalize to the overall distribution, and the guessing accuracy actually decreases.

[0019] In terms of generation strategies, existing methods mostly employ discrete sampling or simple linear interpolation, lacking a sampling mechanism that preserves structure and semantics in a continuous latent space. Although text enhancement techniques (such as synonym replacement and back translation) exist in the field of natural language processing, these methods often destroy the semantic and structural integrity of passwords when directly applied to them, and cannot model the high-dimensional long-tail distribution unique to passwords.

[0020] Therefore, the core bottleneck in current password guessing research is how to achieve cross-domain knowledge transfer and generate password candidates with semantic coherence, structural rationality, and distribution diversity under conditions of a very small number of target samples (i.e., small sample size). Existing methods have significant shortcomings in terms of sampling continuity, long-tail coverage, and small sample adaptability, and a novel generation scheme is urgently needed to address these challenges.

[0021] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0022] The password guessing method provided in this application can be executed by an electronic device, which can be a terminal device such as a PC, laptop, or smartphone, or a server. The server can be a physical server containing an independent host, a virtual server, a cloud server, or a server cluster.

[0023] Figure 1 A flowchart of a password guessing method provided in an embodiment of this application is shown below. Figure 1 As shown, it may include the following steps: 101. Use a general password dataset to train the generative model to construct the latent space. The generative model includes an encoder and a decoder. The generative model has the ability to map passwords to latent space vectors and decode latent space vectors back to passwords.

[0024] 102. Use the encoder to map the target domain password sample to the latent space to obtain the latent space vector.

[0025] 103. In the latent space, the latent space vector is continuously sampled using a hybrid sampling strategy to determine the target latent space vector; the hybrid sampling strategy is used to balance semantic coherence and generative diversity.

[0026] 104. Input the target latent space vector into the decoder to obtain the password guessing candidate set.

[0027] The password guessing scheme provided in this embodiment is based on the Continuous Sampling in Latent Space (CSLS) small-sample password guessing framework. The core idea of ​​this framework is to construct a structured semantic latent space using a generative model pre-trained on a large-scale public password dataset; to encode a very small number of target domain password samples (i.e., small samples) into this latent space to form local clusters; and to generate a large number of password candidates that are both semantically related to the target domain and have sufficient diversity by performing continuous and controllable sampling operations within this latent space.

[0028] The password guessing framework provided in this application utilizes the geometric structure of the latent space for knowledge transfer and sample generation, avoiding direct fine-tuning of the model on small samples. Specifically, the scheme provided in this application requires little or no updating of the model parameters during the generation of a candidate set of password guesses based on a small number of target domain password samples. On the one hand, the password guessing scheme provided in this application effectively solves the problems of overgeneralization, lack of specificity, overfitting, and loss of diversity in password guessing in small sample scenarios, ensuring that the generated guessed passwords are semantically relevant to the target domain while maintaining reasonable variability. On the other hand, it solves the catastrophic forgetting caused by direct fine-tuning of pre-trained models in existing schemes. Through an adaptation mechanism that does not update or minimally updates model parameters, it achieves knowledge transfer from a general domain to a specific domain, avoiding performance degradation caused by fine-tuning and overcoming the overfitting and performance decline problems caused by direct fine-tuning in cross-domain transfer.

[0029] Optionally, the generative model in this application can be any model capable of providing an encoder that maps a password to a continuous latent space and a decoder that reconstructs the password from the latent space. In other words, as long as the model has the ability to map a password to a latent space vector and decode the latent space vector back to the password, it can be used as the generative model in the embodiments of this application.

[0030] Optionally, the generative model includes, but is not limited to, variational autoencoders (VAEs), generative adversarial networks (GANs), or Transformers.

[0031] It is worth noting that in the small-sample password guessing framework provided in this solution, the CSLS sampling framework is decoupled from the specific architecture of the generative model. Therefore, the CSLS sampling framework in this embodiment is applicable to any model that satisfies the generative model definition in this solution.

[0032] For example, the CSLS sampling framework provided in the embodiments of this application can be applied to Figure 2 The example illustrates a variational autoencoder (VAE). For instance, the sampling framework described above can also be applied to GAN models (such as PassGAN), specifically utilizing the latent space of its generator's input. Furthermore, the sampling framework can also be applied to Transformer-based autoregressive models, using their penultimate layer features as latent representations. In summary, the independence of the CSLS sampling framework from the generative model makes the sampling module in this scheme a general-purpose, plug-in module that can improve the few-shot performance of various generative models.

[0033] The following combination Figure 2 For this Figure 1 The password guessing method provided in the illustrated embodiment will be explained in detail.

[0034] 101. Use a general password dataset to train the generative model to construct the latent space. The generative model includes an encoder and a decoder. The generative model has the ability to map passwords to latent space vectors and decode latent space vectors back to passwords.

[0035] Figure 2 This is a system architecture diagram of a password guessing method provided in an embodiment of this application. For ease of understanding, Figure 2 The example used is a variational autoencoder (VAE) as the generative model. Here, D_public is the general password dataset, i.e., the public dataset; D_target is the target domain dataset composed of password samples; and D_guessing is the password guessing candidate set.

[0036] Here, D_target1000 indicates that the target domain dataset contains 1000 target domain password samples. It's understandable that the number of target domain password samples in the target domain dataset can be customized; for example, besides 1000, it could also be 100, 500, 1200, etc.

[0037] As an alternative method for constructing the latent space, the training objective can be set as maximizing the Evidence Lower Bound (ELBO). Then, the generative model can be trained using a common password dataset according to the training objective to construct the latent space.

[0038] like Figure 2 As shown, the structure of a variational autoencoder (VAE) is divided into an encoder and an encoder. and decoder .

[0039] Optionally, the encoder It can be a bidirectional Long Short-Term Memory (LSTM) network, with the input being a password character sequence x, such as nhe4498 or yjl724 in D_public, and the output being latent variables. The posterior distribution parameters (i.e., mean) and variance Optionally, the decoder It can also be an LSTM network used to store latent variables. Reconstruct it into a password character sequence.

[0040] During the training of the Variational Autoencoder (VAE), the training samples are several password character sequences x contained in the D_public general password dataset. The training objective is to maximize the lower bound of evidence. The training objective function (i.e., the loss function) corresponding to the training process is... as follows: in, The reconstruction loss is used to ensure decoding accuracy, that is, to ensure that the input password character sequence can be accurately reconstructed from the latent variable z; The KL divergence is used to constrain the posterior distribution of the encoder output. Approximately a standard normal distribution This guides the hidden space to become more regular, continuous, and smooth. This is a balancing coefficient used to adjust the weights of reconstruction quality and latent space regularization. , and These are the mean and variance of the encoder output. It is standard normal noise.

[0041] It should be understood that the process of training a variational autoencoder (VAE) using the D_public general password dataset (e.g., RockYou, containing tens of millions of passwords) according to the training objective is essentially a process of constructing the latent space. Through learning from massive amounts of general passwords, the VAE gradually establishes a "semantic-structural" mapping relationship in the high-dimensional latent space: similar passwords (such as "password123" and "passw0rd123") are mapped to similar latent vector regions; different categories of passwords (such as pure numeric sequences, English word variations, and compound passwords containing special symbols) form natural clusters in the latent space. Simultaneously, the KL divergence term forces the entire latent space to tend towards a standard normal distribution, making any point... Both can generate reasonable new passwords through the decoder, realizing the generalization and generation capabilities of the latent space.

[0042] The dimension of the latent space is denoted as . It can be customized, for example, 128.

[0043] Optionally, during the training of the variational autoencoder (VAE) using the D_public general password dataset (e.g., RockYou, containing tens of millions of passwords) according to the training objective, the Adam optimizer can be used with a learning rate of [missing information]. The batch size is 256, and the training takes about 30 rounds. In response to the completion of the training of the variational autoencoder (VAE), a pre-trained VAE is obtained. This pre-trained VAE can learn a smooth, continuous, and sampleable latent space representation, which is the latent space to be constructed in the embodiments of this application.

[0044] 102. Use the encoder to map the target domain password sample to the latent space to obtain the latent space vector.

[0045] like Figure 2 As shown, after obtaining the trained variational autoencoder (VAE), D_target1000 is... Target domain password sample Input the trained variational autoencoder (VAE) to utilize the encoder within the VAE to process the target domain password sample. One-to-one mapping to vectors in the latent space yields latent space vectors (i.e., latent vectors).

[0046] Specifically, the latent space vector can be obtained using the following formula: in, It is a latent space vector; This is the set of password samples for the target domain, namely D_target1000.

[0047] In practical applications, the latent space vector obtained through encoder mapping in a variational autoencoder (VAE) is... In the latent space, multiple compact clusters will form. These clusters reflect the password setting habits (such as preference for using names, birthdays, or common words) and structural patterns (such as words + numbers, or keyboard movement) of the target user group. Therefore, they can serve as anchors in the subsequent sampling process to guide the generation of new passwords that conform to the behavioral characteristics of the target users.

[0048] 103. In the latent space, the latent space vector is continuously sampled using a hybrid sampling strategy to determine the target latent space vector; the hybrid sampling strategy is used to balance semantic coherence and generative diversity.

[0049] Existing deep learning methods typically employ a strategy of fine-tuning all parameters of a pre-trained model when dealing with samples from small domains. This can easily lead to the model forgetting prior knowledge learned on large-scale general data and overfitting a limited number of samples, thereby impairing its generalization ability.

[0050] This embodiment completely avoids updating model parameters in the target domain. Instead, it encodes small-domain samples into a pre-trained, structured latent space and performs intelligent sampling directly in that space, achieving "zero-time" knowledge transfer. This method not only has extremely low training overhead but also fundamentally eliminates overfitting, enabling the model to simultaneously maintain the breadth of general knowledge and the depth of target domain characteristics.

[0051] Optionally, this embodiment proposes a hybrid sampling strategy that can both perform fine mining around the password samples in the target domain to develop known high-probability regions, and also conduct guided exploration into more distant regions in the latent space to discover long-tail, low-frequency password patterns. This maximizes the diversity of generation while maintaining semantic relevance, and realizes a continuous latent space sampling mechanism that can balance local development and global exploration.

[0052] In one alternative embodiment, a hybrid sampling strategy is used, including Local Neighborhood Sampling (LNS) and Extended Brownian Bridge Sampling (EBBS).

[0053] Local neighborhood sampling is used to characterize semantic coherence, that is, to ensure that the collected samples are in the latent space region around the target domain password samples; extended Brownian bridge sampling is used to characterize generative diversity, that is, to ensure that the collected samples cover a more distant region in the latent space.

[0054] In the specific implementation process, the latent space vector is continuously sampled in the latent space using a hybrid sampling strategy to determine the target latent space vector, including: The first latent space vector is obtained by continuously sampling the latent space vector through local neighborhood sampling. In the latent space, the latent space vector is continuously sampled by extended Brownian bridge sampling to obtain the second latent space vector; The target latent space vector is determined based on the first latent space vector and the second latent space vector.

[0055] Alternatively, as a method to obtain the first latent space vector through local neighborhood sampling, each latent space vector can be sampled separately. Define a hypersphere neighborhood with a given radius R centered at the center. In this context, the dimension of the hypersphere neighborhood is the same as the dimension of the latent space, both being... Optionally, the radius R of the hypersphere can be set custom, for example, to 0.5. It can be understood that the radius R is a hyperparameter that controls the sampling range.

[0056] Then, uniform sampling is performed within the hypersphere's neighborhood based on randomly generated direction vectors to determine the local neighborhood vector. This is done using a latent space vector. For example, in the case of latent space vectors The hypersphere neighborhood with center R and radius R The local neighborhood vector is determined by uniformly sampling based on randomly generated direction vectors, which can be expressed by the following formula: in, The sampled local neighborhood vector, It is a randomly generated direction vector; It is a hyperparameter that controls the sampling range, and it can usually be set to 0.5 in experiments.

[0057] Finally, the cosine similarity or decoding reconstruction entropy between the local neighborhood vectors and the latent space vectors is calculated to filter out redundant samples. That is, local neighborhood vectors with a cosine similarity less than a set similarity threshold or a decoding reconstruction entropy greater than a set reconstruction entropy threshold are filtered out, and the remaining local neighborhood vectors after filtering are used as the first latent space vectors. .

[0058] Figure 3 This is a schematic diagram of neighborhood sampling for a password guessing method provided in an embodiment of this application.

[0059] In this scheme, local neighborhood sampling follows the assumption of local compactness, meaning that passwords with similar semantics and structure are close to each other in the latent space. Therefore, through local neighborhood sampling, the latent space region around the target domain password sample can be finely mined, generating password variants that are highly semantically related and structurally similar to the target domain password sample. In other words, the password corresponding to the first latent space vector can effectively maintain the password style of the target domain.

[0060] Optionally, as a method to obtain the second latent space vector through extended Brownian bridge sampling, the starting point and ending point of the extended Brownian bridge path corresponding to the extended Brownian bridge sampling can be determined first. The starting point of the extended Brownian bridge path is a random point in the latent space vector, and the ending point is a random point in the latent space. Then, sampling is performed at multiple time points along the extended Brownian bridge path between the starting point and the ending point to obtain the second latent space vector.

[0061] For ease of understanding, the basic Brown bridge will be described first in this embodiment.

[0062] A basic Brown bridge It is a random sampling process with fixed ends, in time Based on a given starting point and the end point Its distribution is as follows: in, Basic Brown Bridge; For time; For the maximum time.

[0063] Because the starting and ending points of a basic Brownian bridge are fixed and lack randomness, its sampling paths are limited by preset boundaries, making it difficult to flexibly adapt to the diverse password-setting habits of the target user group. For example, in password generation tasks (password guessing is a type of password generation task), if only a basic Brownian bridge is used to connect the latent vectors of two known target passwords, all sampling paths must precisely pass through these two points, resulting in generated candidate passwords concentrated in a specific area and lacking the ability to explore new structures. Furthermore, it cannot effectively model the uncertainty of target users in password selection (such as slight changes in preferences, spelling errors, etc.).

[0064] To this end, this application extends the basic Brownian bridge by proposing an extended Brownian bridge sampling method. By introducing random start and random end points, the sampling path also becomes random at the endpoints, thereby enabling broader latent space exploration and higher generation diversity.

[0065] In this embodiment of the application, the extended Brown bridge is described. In time Its distribution is as follows: in, To extend the starting point of the Brown Bridge route, To extend the endpoint of the Brown Bridge route; For time; For the maximum time; It is a small positive hyperparameter used to control the uncertainty of the endpoints.

[0066] Optionally, the starting point of the extended Brownian bridge path is a random point in the latent space vector, and the ending point of the extended Brownian bridge path is a random point in the latent space. Alternatively, the starting point and the ending point of the extended Brownian bridge path can also be two randomly selected points in the latent space (they can be small sample encoded points or random points).

[0067] After determining the starting and ending points of the extended Brownian bridge path corresponding to the extended Brownian bridge sampling, further, along the extended Brownian bridge path between the starting and ending points, at multiple time points... By sampling, a sequence of points can be obtained along a continuous random path that starts at the beginning of the extended Brown Bridge path and ends at the end of the extended Brown Bridge path. Then, the point sequence obtained above... Determined as the second latent space vector .

[0068] Figure 4 This diagram illustrates an extended Brownian bridge sampling method for a password guessing method provided in this application. The starting point in the diagram is the starting point of the extended Brownian bridge path, and the ending point is the ending point of the extended Brownian bridge path.

[0069] In this scheme, extended Brownian bridge sampling can break through the limitation of a single neighborhood. By constructing random paths in the latent space to connect different regions, sampling on the path can generate passwords that are structurally between two starting points and ending points but also have randomness. This effectively promotes diversity and helps to discover long-tail password patterns, exploring more extensive and rarer password patterns.

[0070] In this embodiment, local neighborhood sampling and extended Brownian bridge sampling are used in combination. To ensure that the final sampling result can accurately represent password semantics while also exploring broader and rarer password models, the sampling ratios corresponding to local neighborhood sampling and extended Brownian bridge sampling can be preset. For example, a first latent space vector is set to be obtained by sampling the latent space vector in the latent space through local neighborhood sampling. In the target latent space vector China occupies the largest proportion The second latent space vector is defined as obtained by sampling the latent space vector in the latent space through extended Brownian bridge sampling. In the target latent space vector China accounts for the second largest proportion ( The sum of the first and second ratios is equal to one. The first and second ratios can be customized, for example, both the first and second ratios are 50%, or the first ratio is 80% and the second ratio is 20%, etc.

[0071] In specific implementation, optionally, the target latent space vector is determined based on the first latent space vector and the second latent space vector, including: A vector of a first proportion is sampled from the first latent space vector to obtain the sampling result of the first latent space vector; The second proportion of vectors is sampled from the second latent space vector to obtain the sampling result of the second latent space vector; The sampling results of the first latent space vector and the sampling results of the second latent space vector are used as the target latent space vector.

[0072] Optionally, when collecting vectors of a first proportion from the first latent space vectors and vectors of a second proportion from the second latent space vectors, the collection method can be random collection.

[0073] Optionally, using the sampling results of the first latent space vector and the sampling results of the second latent space vector as the target latent space vector includes: using the union of the first latent space vector and the second latent space vector as the target latent space vector.

[0074] This embodiment resolves the fundamental contradiction between development and exploration in the generation task by employing a hybrid sampling strategy of local neighborhood sampling and extended Brownian bridge sampling. Local neighborhood sampling ensures that the generated candidate passwords closely revolve around the semantic and structural features of the target sample (such as the proportion of similar character types and length distribution), maintaining high domain relevance and semantic rationality. Simultaneously, extended Brownian bridge sampling constructs random paths in a high-dimensional latent space, actively exploring regions far from known samples, effectively generating candidate passwords with varied structures and novel character combinations. This significantly enhances the diversity of generation, particularly its ability to cover long-tail password patterns, which account for a relatively low percentage but are crucial in the real world.

[0075] 104. Input the target latent space vector into the decoder to obtain the password guessing candidate set.

[0076] Accept Figure 2 In the example, when obtaining the target latent space vector Subsequently, the target latent space vector can be further... Input the decoder in the variational autoencoder (VAE) to decode the password guessing strings corresponding to each vector in the target latent space vector. To form the password guessing candidate set D_guessing: The above describes the password guessing method provided in the embodiments of this application. In summary, the implementation process of the embodiments of this application mainly includes four stages: 1) Cross-domain latent space construction: A large-scale general password dataset (such as RockYou) is used to train the generative model (e.g., variational autoencoder) to construct a smooth, structured high-dimensional latent space. 2) Target domain small sample encoding: A small number of password samples (e.g., 100, 500, 1000) from the target domain are mapped into the latent space through the encoder in the generative model trained in step 1, forming a set of latent vectors. 3) Continuous sampling of the latent space: In the latent space, using the above latent vectors as base points, two complementary continuous sampling strategies are executed—local neighborhood sampling and extended Brownian bridge sampling—to generate new latent vectors (i.e., target latent space vectors). 4) Password decoding and candidate generation: The sampled new latent vectors are input into the decoder to reconstruct specific password strings, forming the final password guessing candidate set.

[0077] This embodiment achieves efficient cross-domain password generation using a very small number of target samples (small samples), and avoids directly fine-tuning the model on small samples. Instead, it utilizes the geometric structure of the latent space for knowledge transfer and sample generation. Experiments show that, using only 100 target domain password samples (100-shot), this embodiment achieves a hit rate (Hit@10^8) of 11.27% when generating 10^8 candidate passwords. This is an improvement of 2.99 percentage points compared to the strongest baseline model (Transformer) with a hit rate of 8.28% under zero-shot conditions. More importantly, the small-shot gain ratio (FGR) proposed in this embodiment reaches 16422, which means that on average, each newly added target domain password sample can bring more than 16,000 additional hits to the guessing results, fully demonstrating the extremely high efficiency of this embodiment in utilizing small-sample information. Traditional fine-tuning methods generally result in performance degradation under the same conditions. For example, PassGAN's hit rate plummeted from 7.89% to 3.90% after 100-shot fine-tuning.

[0078] In summary, the solution provided in this application proposes a sampling framework decoupled from the underlying generative model. This framework enables continuous sampling of the latent space vectors corresponding to password samples in the target domain. It is independent of the internal details of any specific generative model architecture; as long as the generative model can provide an encoding mapping from passwords to continuous latent space vectors and reverse decoding capabilities, this sampling framework can be directly applied. This plug-and-play characteristic allows the solution to be widely compatible with various existing and future password generation models, greatly expanding its application scope. Specifically, this solution encodes small samples of target domain passwords into a pre-trained, structured latent space and performs mixed continuous sampling directly within this space. This allows for efficient utilization of cross-domain knowledge and zero-transfer under the realistic constraint of having very few target domain password samples, generating a password guessing candidate set with high hit rate, high semantic relevance, and high coverage diversity. This approach not only has extremely low training overhead but also fundamentally solves the overfitting problem, enabling the model to simultaneously maintain the breadth of general knowledge and the depth of target domain characteristics. The hybrid sampling strategy balances semantic coherence and generation diversity, resolving the fundamental contradiction between development and exploration in generation tasks. This ensures that generated candidate passwords closely adhere to the semantic and structural features of the target sample while actively exploring regions far removed from known samples. This effectively generates candidate passwords with varied structures and novel character combinations, significantly enhancing generation diversity, particularly in its coverage of long-tail password patterns, which represent a relatively small but crucial segment of the real world. In summary, this embodiment achieves substantial improvements over existing technologies in multiple dimensions, including password guessing accuracy, sample utilization efficiency, generation quality, overfitting resistance, and system compatibility, providing a powerful and practical new solution for password security analysis under small sample conditions.

[0079] The following describes in detail one or more embodiments of the password guessing apparatus of this application. Those skilled in the art will understand that these apparatuses can all be configured using commercially available hardware components through the steps taught in this solution.

[0080] Figure 5 This is a schematic diagram of the structure of a password guessing device provided in an embodiment of this application, as shown below. Figure 5 As shown, the device includes: a latent space construction module 11, a latent space vector determination module 12, a target latent space vector determination module 13, and a password guessing candidate set determination module.

[0081] Latent space construction module 11 is used to train the generative model using a general password dataset to construct a latent space. The generative model includes an encoder and a decoder. The generative model has the ability to map a password to a latent space vector and to decode the latent space vector back to a password. The latent space vector determination module 12 is used to map the target domain password sample to the latent space using a variational autoencoder to obtain the latent space vector. The target latent space vector determination module 13 is used to continuously sample the latent space vector in the latent space using a hybrid sampling strategy to determine the target latent space vector; the hybrid sampling strategy is used to balance semantic coherence and generation diversity. The password guessing candidate set determination module 14 is used to input the target latent space vector into the decoder to decode and obtain the password guessing candidate set.

[0082] Figure 5 The device shown can perform the steps described in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0083] In one possible design, the above Figure 5 The password guessing device shown can be implemented as an electronic device, such as... Figure 6 As shown, the electronic device may include: a memory 21, a processor 22, and a communication interface 23. The memory 21 stores a computer program, which, when executed by the processor 22, enables the processor 22 to at least implement the password guessing method provided in the foregoing embodiments.

[0084] The aforementioned memory 21 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0085] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments. The computer-readable storage medium includes volatile or non-volatile components, or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium. Accordingly, this application also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, cause the processor to implement the steps in the above method embodiments. It should be understood that each step or combination of steps in the above method flow can be implemented by the computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above method embodiments.

[0086] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0087] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. This application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0088] Finally, it should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0089] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A password guessing method, characterized in that, include: A generative model is trained using a general password dataset to construct a latent space. The generative model includes an encoder and a decoder, and has the ability to map passwords to latent space vectors and decode latent space vectors back to passwords. The encoder is used to map the target domain password sample to the latent space to obtain the latent space vector; In the latent space, the latent space vector is continuously sampled using a hybrid sampling strategy to determine the target latent space vector; the hybrid sampling strategy is used to balance semantic coherence and generative diversity. The target latent space vector is input into the decoder to decode and obtain a password guessing candidate set.

2. The password guessing method according to claim 1, characterized in that, The step of training the generative model using a common password dataset to construct the latent space includes: The training objective is to maximize the lower bound of evidence; According to the training objective, the generative model is trained using a common password dataset to construct the latent space.

3. The password guessing method according to claim 1, characterized in that, The latent space vectors form multiple compact cluster regions in the latent space, and the cluster regions contain the password setting habits and structural patterns of the target domain user group.

4. The password guessing method according to claim 1, characterized in that, The hybrid sampling strategy includes: local neighborhood sampling and extended Brownian bridge sampling; the local neighborhood sampling is used to characterize semantic coherence, and the extended Brownian bridge sampling is used to characterize generative diversity; the step of continuously sampling the latent space vector in the latent space using the hybrid sampling strategy to determine the target latent space vector includes: The first latent space vector is obtained by continuously sampling the latent space vector through local neighborhood sampling. In the latent space, the latent space vector is continuously sampled by extended Brownian bridge sampling to obtain a second latent space vector; The target latent space vector is determined based on the first latent space vector and the second latent space vector.

5. The password guessing method according to claim 4, characterized in that, The step of continuously sampling the latent space vector in the latent space through local neighborhood sampling to obtain the first latent space vector includes: For each of the latent space vectors, a hypersphere neighborhood with a set radius is defined, and the dimension of the hypersphere neighborhood is the same as the dimension of the latent space. Within the neighborhood of the hypersphere, a local neighborhood vector is determined by uniformly sampling based on a randomly generated direction vector. Calculate the cosine similarity or decoding reconstruction entropy between the local neighborhood vector and the latent space vector to filter out redundant samples and determine the first latent space vector; The step of continuously sampling the latent space vector in the latent space through extended Brownian bridge sampling to obtain the second latent space vector includes: Determine the starting point and ending point of the extended Brownian bridge path corresponding to the extended Brownian bridge sampling. The starting point of the extended Brownian bridge path is a random one in the latent space vector, and the ending point of the extended Brownian bridge path is a random point in the latent space. The second latent space vector is obtained by sampling along the extended Brown Bridge path between the starting point and the ending point of the extended Brown Bridge path at multiple time points.

6. The password guessing method according to claim 4, characterized in that, The step of determining the target latent space vector based on the first latent space vector and the second latent space vector includes: A vector of a first proportion is sampled from the first latent space vector to obtain the sampling result of the first latent space vector; A second proportion of vector is sampled from the second latent space vector to obtain the sampling result of the second latent space vector; the first proportion and the second proportion are added together to equal one; The sampling results of the first latent space vector and the sampling results of the second latent space vector are used as the target latent space vector.

7. The password guessing method according to any one of claims 1 to 6, characterized in that, The generative models include: variational autoencoders, generative adversarial networks, or Transformers.

8. An electronic device, characterized in that, include: The device includes a memory, a processor, and a communication interface; wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the password guessing method as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor of an electronic device, causes the processor to perform the password guessing method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, include: A computer program or instruction that, when executed by a processor of an electronic device, causes the processor to perform the password guessing method as described in any one of claims 1 to 7.

Images