Password security evaluation method based on conditional variational autoencoder and multi-center sampling

Abstract

The present application relates to password security data processing technical field, the present application discloses a password security evaluation method based on conditional variational autoencoder and multi-center sampling, including obtaining password sample and carrying out probability context-free grammar analysis, obtain password structure mode, then based on password sample constructs high-frequency short string word table and forms enhanced word segmentation sequence, then the enhanced word segmentation sequence and password structure mode input conditional variational autoencoder, obtain latent style variable, and generate adaptive layer normalization parameter loading to the decoder each layer, again according to password structure mode to the latent style variable is layered, determines multiple high-density style cluster center and corresponding cluster weight, and carries out local continuous sampling around corresponding high-density style cluster center, obtains sampling latent style variable, finally generates candidate password set and outputs password security evaluation result, so as to reduce password style drift interference and enhance multi-peak style coverage, ensure that weak password set stable hit.

Description

Technical Field

[0001] This invention relates to the field of password security data processing technology, and more specifically, to a password security assessment method based on conditional variational autoencoders and multi-center sampling. Background Technology

[0002] Network password security assessment typically uses authorized password samples or authentication logs as processing objects. It detects weak password risks in the identity authentication process through a candidate password set. This type of assessment process is constrained by computing resources, generation latency, and candidate set size. Existing technologies mostly use structural pattern constraints, statistical distribution modeling, sequence generation control, and candidate result screening to generate passwords to be verified. Its applicability usually depends on the premise that the password structure changes gradually, the sample style distribution is concentrated, and the length of the generated sequence is limited.

[0003] In real-world network authentication scenarios, user passwords exhibit variations in character combination habits and discrete structural patterns, among other unstable factors. These factors make it difficult for statistical distribution modeling and sequence generation control to consistently maintain password styles, and cause candidate passwords to concentrate in a few high-frequency style regions. Consequently, the stability of weak password set hits decreases. Therefore, the technical problem that needs to be solved is: how to ensure stable hits of weak password sets while reducing password style drift interference and enhancing multi-peak style coverage.

[0004] In view of this, the present invention proposes a password security assessment method based on conditional variational autoencoder and multi-center sampling to solve the above problems. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, this invention provides a password security assessment method based on conditional variational autoencoders and multi-center sampling.

[0006] To achieve the above objectives, the present invention provides the following technical solution: Firstly, a password security assessment method based on conditional variational autoencoders and multi-center sampling is provided, including: Obtain password samples, perform probabilistic context-free grammar parsing on the password samples to obtain password structure patterns, construct a high-frequency short string vocabulary based on the password samples, and obtain enhanced word segmentation sequences based on the high-frequency short string vocabulary; The enhanced word segmentation sequence and password structure pattern are input into the conditional variational autoencoder to obtain latent style variables. Adaptive layer normalization parameters are generated based on the latent style variables and then loaded into each layer of the decoder of the conditional variational autoencoder. The latent style variables are hierarchically analyzed according to the password structure pattern, and multiple high-density style cluster centers and corresponding cluster weights are determined. Based on the cluster weights, local continuous sampling is performed around the corresponding high-density style cluster centers to obtain sampled latent style variables. The sampled latent style variables are input into each layer of the decoder to obtain candidate lexical sequences. The candidate lexical sequences are then subjected to structural hard constraints and deduplication to obtain a candidate password set. Based on the candidate password set, the password security assessment result is obtained.

[0007] In some embodiments, a high-frequency short string vocabulary is constructed based on password samples, including: Perform a sliding window traversal on the password samples to obtain candidate short strings. Obtain the parent string that contains the candidate short string and has a length greater than the candidate short string. Record the prefix position, middle position, and suffix position of the candidate short string in the parent string. The positional distribution is formed based on the prefix position, middle position, and suffix position; the source distribution is formed based on the parent string and the frequency of the parent string. The frequency of occurrence of candidate short strings is corrected based on the positional entropy corresponding to the positional distribution and the parent string source entropy corresponding to the source distribution, thus obtaining a high-frequency short string vocabulary.

[0008] In some embodiments, an enhanced word segmentation sequence is obtained based on a high-frequency short string vocabulary, including: The character gaps in the password sample are used as nodes, and the high-frequency short strings in the high-frequency short string vocabulary that are consistent with the continuous character segments of the password sample are used as directed edges between nodes. The edge weight is determined based on the square of the length of the high-frequency short string corresponding to the directed edge; The global optimal path covering all characters of the password sample is determined based on the edge weights, and the enhanced word segmentation sequence is obtained by backtracking along the global optimal path.

[0009] In some embodiments, the method for generating adaptive layer normalization parameters based on latent style variables includes: The latent style variables are input into the parameter mapping network corresponding to each layer of the decoder of the conditional variational autoencoder; The normalized scaling parameters of the corresponding decoder layer are output through the parameter mapping network; The normalized bias parameters of the corresponding decoder layer are output through the parameter mapping network; The normalized scaling parameter and normalized bias parameter corresponding to the same decoder layer are used as the adaptive layer normalization parameters of that decoder layer.

[0010] In some embodiments, local continuous sampling is performed around the corresponding high-density style cluster center based on cluster weights to obtain sampled latent style variables, including: Select the target style cluster center from multiple high-density style cluster centers according to the cluster weight, and obtain the intra-cluster posterior mean vector corresponding to the target style cluster center; The local sampling radius corresponding to the target style cluster center is determined based on the intra-cluster posterior mean vector. Construct a local continuous sampling region around the center of the target style cluster according to the local sampling radius; Sampled latent style variables are obtained by sampling from local continuous sampling regions.

[0011] In some embodiments, latent style variables are sampled and input into each layer of the decoder to obtain a sequence of candidate lexical units, including: Sample latent style variables are input into each layer of the decoder, which is loaded with adaptive layer normalization parameters; Based on the stepwise decoding of the sampled latent style variables by each layer of the decoder, the probability distribution of candidate lexical units corresponding to each decoding step is obtained. Candidate words are selected based on the probability distribution of candidate words in the current decoding step; Candidate words are combined according to the output order of each decoding step to obtain a candidate word sequence.

[0012] In some embodiments, structural hard constraints are applied to the candidate lexical sequence, including: The password structure pattern is parsed using a finite state automaton to obtain the remaining character type requirements; Get the number of letters, numbers, and symbols corresponding to each candidate word in the candidate word sequence; The remaining character type needs to be updated based on the number of letters, numbers, and symbols. Based on the updated remaining character type requirements, the probability distribution of candidate words in the corresponding decoding step in the candidate word sequence is dynamically masked. The candidate lexical sequence is modified based on the dynamic masking results until it meets the password structure pattern, thus completing the structural hard constraint on the candidate lexical sequence.

[0013] In some embodiments, the candidate word sequence is deduplicated to obtain a candidate password set, including: Concatenate the candidate word sequence that satisfies the password structure pattern to form the candidate password; Input the candidate passwords into the global Bloom filter to obtain the member query results corresponding to the candidate passwords; When the member query result is no record, the candidate password is written to the global Bloom filter; When the member query result is already recorded, discard the candidate passwords and obtain the candidate password set based on the candidate passwords written to the global Bloom filter.

[0014] In some embodiments, obtaining password security assessment results based on the candidate password set includes: Obtain the test set password set, match the candidate password set with the test set password set, and count the number of times the candidate password set matches the test set password set. The hit rate is calculated based on the number of passwords that are hit and the total number of passwords in the test set. The password security assessment result is obtained based on the hit rate.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention acquires password samples and performs probabilistic context-free grammar parsing to obtain password structure patterns. Then, based on the password samples, a high-frequency short string vocabulary is constructed, forming an enhanced word segmentation sequence. This ensures that the password structure and lexical style are jointly preserved during the input stage. Subsequently, the enhanced word segmentation sequence and password structure patterns are input into a conditional variational autoencoder to obtain latent style variables. Adaptive layer normalization parameters are generated based on these latent style variables and loaded into each layer of the decoder, ensuring that the candidate generation process is continuously constrained by the password style. Furthermore, the latent style variables are layered according to the password structure patterns to determine multiple high-density style cluster centers and their corresponding cluster weights. Local continuous sampling is performed around the corresponding high-density style cluster centers to obtain sampled latent style variables, preventing candidate passwords from concentrating in a few high-frequency style regions. Finally, the sampled latent style variables are input into each layer of the decoder to generate candidate lexical sequences. After structural hard constraints and deduplication, a candidate password set is obtained. This reduces password style drift interference while enhancing multi-peak style coverage and ensuring stable hits on weak password sets. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the password security assessment method based on conditional variational autoencoder and multi-center sampling in this invention. Figure 2 This is a schematic diagram of the password security assessment system based on conditional variational autoencoder and multi-center sampling in this invention; Figure 3 This is a schematic diagram of the multi-stream style encoder structure in this invention; Figure 4 This is a schematic diagram of the enhanced word segmentation sequence generation in this invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. In the following detailed description, many specific details are set forth to provide a thorough understanding of the exemplary embodiments described. However, it will be apparent to those skilled in the art that the described embodiments may be practiced without some or all of these specific details. In other exemplary embodiments, well-known structures have not been described in detail to avoid unnecessarily obscuring the concepts of this disclosure. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention. Furthermore, the various aspects described in the embodiments may be combined arbitrarily without conflict.

[0018] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0019] Example 1 Figure 1 This disclosure illustrates a password security assessment method based on conditional variational autoencoders and multi-center sampling, provided in at least one embodiment, including: S10: Obtain password samples, perform probabilistic context-free grammar parsing on the password samples to obtain password structure patterns, construct a high-frequency short string vocabulary based on the password samples, and obtain enhanced word segmentation sequences based on the high-frequency short string vocabulary. In this embodiment, the password sample is a password text used for network security assessment. Probabilistic context-free grammar parsing is used to decompose the password sample into letter fragments, number fragments, and symbol fragments, and form a password structure pattern according to the character type and continuous length of each fragment. The password structure pattern is used to describe the topological combination form of the password sample. For example, the password structure pattern corresponding to the password sample "admin123" is "L5N3", where L5 represents 5 consecutive letters and N3 represents 3 consecutive numbers. Another example is that the password sample "admin!23" can be abstracted as "L5S1N2", where S1 represents 1 consecutive symbol. This password structure pattern provides structural constraints for the generation of subsequent candidate passwords.

[0020] A high-frequency short string vocabulary list was constructed based on password samples, including: Perform a sliding window traversal on the password samples to obtain candidate short strings. Obtain the parent string that contains the candidate short string and has a length greater than the candidate short string. Record the prefix position, middle position, and suffix position of the candidate short string in the parent string. The positional distribution is formed based on the prefix position, middle position, and suffix position; the source distribution is formed based on the parent string and the frequency of the parent string. The frequency of occurrence of candidate short strings is corrected based on the positional entropy corresponding to the positional distribution and the parent string source entropy corresponding to the source distribution, thus obtaining a high-frequency short string vocabulary.

[0021] Furthermore, candidate short strings are obtained by sliding the password samples within a given window length. The parent string refers to a long string that contains candidate short strings and is longer than the candidate short strings. The prefix position, middle position, and suffix position are used to record the topological interval of the candidate short string in the parent string. The source distribution is used to record which parent strings the candidate short string comes from and the frequency of the corresponding parent strings. This can distinguish between short strings used independently and nested short strings attached to long strings. For example, the short string "ing" is located at the suffix position in "doing" and at the prefix position in "ingerland". Records at different positions will be included in the position distribution.

[0022] It should be noted that the position entropy can be calculated using the following formula: ; in, Indicates candidate short strings position entropy, Indicates the prefix position, middle position, or suffix position. Indicates candidate short strings Appearing in location frequency, Indicates candidate short strings The total frequency of occurrence at each location, Indicates the prefix position. Indicates the middle position. Indicates the position of the suffix.

[0023] It should be noted that the source entropy of the parent string can be calculated using the following formula: ; in, Indicates candidate short strings The entropy of the parent string source Indicates candidate short strings The set of parent string sources, This represents the parent string in the set from which the parent string originates. Indicates the parent string frequency, This represents the total frequency of the parent string's source set.

[0024] In this embodiment, positional entropy is used to characterize the dispersion of candidate short strings in different positions, and parent string source entropy is used to characterize the dispersion of candidate short strings from different parent strings. When a candidate short string appears in a fixed position for a long time and mainly depends on a few parent strings, positional entropy and parent string source entropy will reflect the dependence of the candidate short string. When the candidate short string is distributed in different positions and different parent strings, positional entropy and parent string source entropy will reflect the independent combination ability of the candidate short string. This processing can reduce vocabulary redundancy caused by retaining parasitic short strings based solely on their frequency of occurrence.

[0025] Furthermore, the redundancy frequency of candidate short strings as nested short strings can be calculated using the following formula: ; in, Indicates candidate short strings Redundancy frequency reduction Indicates candidate short strings The set of parent string sources, This represents the parent string in the set from which the parent string originates. Indicates the parent string frequency, Indicates the diversity protection coefficient. Indicates candidate short strings The independence score.

[0026] It should be noted that the correction frequency of the candidate short string can be calculated using the following formula: ; in, Indicates candidate short strings The frequency of correction, Indicates candidate short strings The original frequency of occurrence, Indicates candidate short strings Redundancy frequency reduction Represents small positive numbers. This represents a function that takes the larger value.

[0027] For example, when the candidate short string "ove" mainly depends on the parent string "love", the independent semantic value of the candidate short string "ove" is weak, and the redundancy frequency reduction will weaken the correction frequency of the candidate short string "ove". However, when the candidate short string "pass" exists not only in the parent string "password" but can also participate in other combinations as an independent short string, the source distribution of the candidate short string "pass" is more dispersed, and the correction frequency can retain the independent word-formation ability of the candidate short string "pass". The high-frequency short string vocabulary obtained in this way has low nesting redundancy.

[0028] Enhanced word segmentation sequences are obtained based on a high-frequency short string vocabulary, including: The character gaps in the password sample are used as nodes, and the high-frequency short strings in the high-frequency short string vocabulary that are consistent with the continuous character segments of the password sample are used as directed edges between nodes. The edge weight is determined based on the square of the length of the high-frequency short string corresponding to the directed edge; The global optimal path covering all characters of the password sample is determined based on the edge weights, and the enhanced word segmentation sequence is obtained by backtracking along the global optimal path.

[0029] In this embodiment, the enhanced word segmentation sequence is a word sequence obtained by performing global path selection on the password sample based on the high-frequency short string word list. The character gaps are used as nodes to represent the positions in the password sample that are allowed to be segmented. The directed edges represent high-frequency short strings in the high-frequency short string word list that can cover continuous character segments between adjacent character gaps. The edge weights are determined by the square of the length of the high-frequency short string, so that longer and complete habitual short strings have a stronger tendency to be preserved in path selection, avoiding local greedy word segmentation from destroying the integrity of the phrase.

[0030] It should be noted that if the password sample is represented as It can construct directed acyclic graphs. , where the set of nodes Indicates the position of the character gap, when the substring When it exists in a high-frequency short string vocabulary, at the node To node When a directed edge is added between two points, the weight of that directed edge can be expressed as: ; in, Represents a directed edge edge weights, This represents the starting node of a directed edge. Indicates the terminating node of a directed edge. This indicates the length of the high-frequency short string covered by the directed edge.

[0031] Furthermore, the globally optimal path can be obtained recursively using the following formula: ; in, Indicates the location reached. The optimal cumulative score at that time Indicates position Previous candidate segmentation positions, Indicates the location reached. The optimal cumulative score at that time Indicates from position Arrive at the location The score of the current segment. Indicates from position Arrive at the location The corresponding consecutive character segments, Represents the set of candidate short strings. This indicates taking the maximum value among all valid segmentation positions.

[0032] For example, for the password character fragment "teamo", a locally greedy approach easily yields a segmentation result of "team" plus "o". However, when there are high-frequency short string words in the high-frequency short string vocabulary that can cover different consecutive character fragments, multiple candidate paths can be formed in the same directed acyclic graph, and the globally optimal path covering all characters of the password sample can be obtained recursively based on edge weights. For example, ... Figure 3 As shown, when the password sample is "administrator", the character gaps between adjacent characters in the password sample can be used as nodes, and the high-frequency short strings in the high-frequency short string vocabulary that are consistent with the continuous character segments can be used as directed edges between nodes. Among them, the short string "admin" covers nodes 0 to 5, the short string "istrator" covers nodes 5 to 13, the short string "trator" covers nodes 7 to 13, and the short string "ator" covers nodes 9 to 13. Thus, multiple candidate segmentation paths are formed in the same password sample. The path cost covering all characters is compared based on the edge weights corresponding to the directed edges, and the enhanced word segmentation sequence is obtained by backtracking according to the selected global optimal path.

[0033] Understandably, by combining a high-frequency short string vocabulary and an enhanced word segmentation sequence, the content of the input conditional variational autoencoder is no longer limited to single-character sequences, but includes high-frequency short strings with independent combinatory capabilities. The high-frequency short string vocabulary reduces redundancy caused by nested short strings, and the enhanced word segmentation sequence reduces fragment destruction caused by word segmentation ambiguity. In the context of network password security assessment, this can reduce password style drift interference and provide more stable lexical input for subsequent learning of potential style variables.

[0034] S20: Input the enhanced word segmentation sequence and password structure pattern into the conditional variational autoencoder to obtain latent style variables, generate adaptive layer normalization parameters based on the latent style variables, and load the adaptive layer normalization parameters into each layer of the decoder of the conditional variational autoencoder. In this embodiment, the conditional variational autoencoder is used to learn the implicit style in the enhanced word segmentation sequence under the constraint of the password structure pattern. The enhanced word segmentation sequence provides lexical input in the form of characters or high-frequency short strings, and the password structure pattern provides the topological structure information of the password sample. After both are input together, the conditional variational autoencoder obtains the latent style variable through the encoder. The latent style variable is used to represent the implicit preferences in the user's password that are difficult to enumerate directly, such as pure Pinyin sequence, keyboard path sequence, special mixed writing, and other style tendencies. In this way, the explicit structure constraint and the implicit style expression are processed separately.

[0035] Furthermore, such as Figure 4 As shown, the encoder of the conditional variational autoencoder can adopt a multi-stream style encoder. The semantic stream uses a 6-layer Transformer encoder to extract the deep semantic representation of the original password text. The structural stream uses a 3-layer Transformer encoder to parse the topological structural features of the password structure pattern. The statistical stream accesses the projection representation of sample-level statistical features, which include character type ratio, character diversity, length features, date pattern matching markers, keyboard path scores, Leet replacement ratio, first and last character habits, and character type switching frequency. This allows the latent style variables to simultaneously include text semantics, structural layout, and statistical preferences.

[0036] It should be noted that sample-level statistical features can be represented as 32-dimensional statistical features. The feature projection network projects these 32-dimensional statistical features into 64-dimensional features, and then concatenates them with the embedding representation of the password structure pattern to obtain the global context. Specifically, this can be expressed as follows: ; in, Represents the global context. This represents the parameter matrix in the feature projection network. Representing sample-level statistical characteristics, This represents the bias in the feature projection network. Indicates password structure pattern The semicolon indicates that the projected statistical features are concatenated with the embedded representation of the password structure pattern.

[0037] Furthermore, after obtaining features from the semantic, structural, and statistical streams, the multi-stream style encoder can use the statistical features as the query and the semantic and structural features as the key and value. It can then aggregate the global context vector through multi-head attention pooling. The global context vector is then passed through two independent linear projection layers to obtain the mean and log-variance of the variational posterior distribution. Subsequently, latent style variables are obtained through reparameterization, enabling the random sampling process to participate in the training and generation of the conditional variational autoencoder.

[0038] It should be noted that latent style variables can be obtained using the following formula: ; in, Represents latent style variables, The parameter representing the mean of the variational posterior distribution is denoted as . This represents the log-variance of the variational posterior distribution. The standard deviation is expressed in the form of the logarithm of the variance. Indicates the distribution from the standard normal distribution The noise vector obtained from sampling, This represents element-wise multiplication. Represents the identity matrix.

[0039] Methods for generating adaptive layer normalization parameters based on latent style variables include: The latent style variables are input into the parameter mapping network corresponding to each layer of the decoder of the conditional variational autoencoder; The normalized scaling parameters of the corresponding decoder layer are output through the parameter mapping network; The normalized bias parameters of the corresponding decoder layer are output through the parameter mapping network; The normalized scaling parameter and normalized bias parameter corresponding to the same decoder layer are used as the adaptive layer normalization parameters of that decoder layer.

[0040] In this embodiment, the adaptive layer normalization parameters include normalization scaling parameters and normalization bias parameters. The parameter mapping network is used to map latent style variables from the style space to the parameter space of the decoder layer. The decoder of the conditional variational autoencoder can be a 14-layer Transformer decoder. The latent style variables are not simply concatenated at the beginning of the input sequence as initial lexical units, but are mapped to the normalization scaling parameters and normalization bias parameters of each decoder layer, so that the latent style variables can act on the multi-layer representation process of the decoder.

[0041] It should be noted that the first The adaptive layer normalization process of the layer decoder can be expressed by the following formula: ; in, Indicates the first Layer decoder in latent style variables Adaptive layer normalization results under modulation Indicates the first Input features of the layer decoder Represents latent style variables, Indicates the latent style variables The generated first Layer normalization scaling parameters, Indicates the latent style variables The generated first Layer normalized bias parameters, Indicates the first The mean of the layer input features, Indicates the first The standard deviation of the layer input features This indicates element-wise multiplication.

[0042] For example, under the same password structure pattern, when the latent style variable corresponds to a pure Pinyin sequence, the normalization scaling parameters and normalization bias parameters loaded by each decoder layer will guide the decoding process to maintain Pinyin-like word combinations. When the latent style variable corresponds to a keyboard path sequence, the normalization scaling parameters and normalization bias parameters loaded by each decoder layer will guide the decoding process to maintain keyboard path-like word combinations. At the same time, the password structure pattern still restricts the arrangement of letters, numbers, and symbols, thereby reducing style drift caused by simply concatenating style information at the input end and enhancing the coverage capability under different password style patterns.

[0043] S30: Based on the password structure pattern, the latent style variables are hierarchically divided to determine multiple high-density style cluster centers and corresponding cluster weights. Based on the cluster weights, local continuous sampling is performed around the corresponding high-density style cluster centers to obtain sampled latent style variables. In this embodiment, the password structure pattern is used to hierarchically classify the latent style variables, so that password styles under different character type structures are processed in their respective layers. This avoids interference between different structure patterns such as pure numeric short passwords, mixed alphanumeric passwords, and mixed alphanumeric passwords in the same latent space. After training, the encoder maps each password sample to a posterior mean vector and bins the posterior mean vectors according to the password structure pattern. Clustering is performed in the bin corresponding to each password structure pattern, thereby obtaining multiple high-density style cluster centers and corresponding cluster weights related to the password structure pattern.

[0044] In this embodiment, after the enhanced word segmentation sequence and password structure pattern are input conditional variational autoencoder, the encoder generates latent style variables. The latent style variables are used to represent implicit preferences in the user's password that are difficult to enumerate directly, such as pinyin sequence, keyboard path sequence or special character mixed writing style. The latent style variables not only retain password style information, but also process them separately from the password structure pattern constraints, so that the generation process maintains diverse style coverage while satisfying the structural constraints.

[0045] Furthermore, to achieve multi-peak style coverage, the latent style variables are layered according to the password structure pattern. Each layer corresponds to different character type combinations (such as pure numbers, mixed alphanumeric characters, mixed alphanumeric characters and symbols, etc.). Within each layer, the posterior mean vector output by the encoder is clustered to obtain the high-density style cluster centers and their cluster weights. The cluster weights reflect the proportion of the style in the corresponding password structure pattern. Subsequently, a local continuous sampling region is constructed around each high-density style cluster center, and sampling is prioritized according to the cluster weights to obtain the sampled latent style variables. This allows the sampling points to prioritize the coverage of common password style regions for users, while retaining fine-grained variations within the clusters and avoiding sampling from falling into low-probability style regions.

[0046] After sampling latent style variables and inputting them into each layer of the decoder, the decoder generates a corresponding candidate lexical probability distribution at each step. The decoder is loaded with adaptive layer normalization parameters generated by the latent style variables, so that the output of each layer is modulated by the latent style variables, guiding the generated lexical sequence to be close to the cluster center style while maintaining the password structure pattern constraint. Specifically, when the latent style variable is close to the center of the Pinyin style cluster, the decoder tends to generate Pinyin-type lexical units; when it is close to the center of the keyboard path style cluster, the decoder tends to generate keyboard path-type lexical units. Through hierarchical sampling and local continuous sampling, the latent style variables gradually guide the generation of candidate lexical units in the multi-layer representation of the decoder, forming a lexical sequence that conforms to the password structure constraint and covers a multi-peak style.

[0047] Furthermore, high-density style cluster centers are used to represent a relatively concentrated user style base under the same password structure pattern, and cluster weights are used to represent the proportion of the corresponding style appearing under that password structure pattern. If the set of style prototype centers corresponding to a certain password structure pattern is represented as... Then each style prototype center It can correspond to cluster weights Cluster weights can be expressed using the following formula: ; in, Indicates password structure pattern Next Cluster weights at the center of each style prototype This indicates the number of samples within the cluster corresponding to the prototype center of this style. Indicates password structure pattern The number of samples below Indicates password structure pattern Next A style prototype center.

[0048] Based on cluster weights, local continuous sampling is performed around the corresponding high-density style cluster centers to obtain sampled latent style variables, including: Select the target style cluster center from multiple high-density style cluster centers according to the cluster weight, and obtain the intra-cluster posterior mean vector corresponding to the target style cluster center; The local sampling radius corresponding to the target style cluster center is determined based on the intra-cluster posterior mean vector. Construct a local continuous sampling region around the center of the target style cluster according to the local sampling radius; Sampled latent style variables are obtained by sampling from local continuous sampling regions.

[0049] In this embodiment, the target style cluster center is not arbitrarily selected directly from the standard normal distribution, but is selected from multiple high-density style cluster centers according to the cluster weight. This allows the sampling process to prioritize covering more common style regions under the same password structure pattern. The intra-cluster posterior mean vector comes from the encoder's posterior mean mapping of the training samples, which can reflect the distribution position of samples within the same style cluster in the latent space. Determining the local sampling range corresponding to the target style cluster center based on the intra-cluster posterior mean vector can make the sampling points expand around the real data clusters, rather than falling into low-probability regions between different style clusters.

[0050] It should be noted that local continuous sampling can be represented by the following formula: ; in, This indicates sampling of latent style variables. Indicates the center of the target style cluster. Indicates the temperature of the disturbance. Indicates the distribution from the standard normal distribution The standard white noise obtained from sampling, Represents the identity matrix.

[0051] Furthermore, when the disturbance temperature When the sampled latent style variables are closer to 0, they are closer to the center of the target style cluster, and the decoder tends to generate more typical password samples within that style cluster. When the perturbation temperature... As the sampling points increase, they gradually spread outwards from the center of the target style cluster. The decoder can generate fine-grained variation samples while maintaining the overall style. For example, it can cover common pinyin combinations and less common pinyin pairings in the pinyin style cluster, and cover different key position continuous combinations in the keyboard path style cluster. This reduces the low probability generation caused by single-center sampling in the multi-peak style distribution.

[0052] The sampled latent style variables are input into each layer of the decoder to obtain a sequence of candidate lexical units, including: Sample latent style variables are input into each layer of the decoder, which is loaded with adaptive layer normalization parameters; Based on the stepwise decoding of the sampled latent style variables by each layer of the decoder, the probability distribution of candidate lexical units corresponding to each decoding step is obtained. Candidate words are selected based on the probability distribution of candidate words in the current decoding step; Candidate words are combined according to the output order of each decoding step to obtain a candidate word sequence.

[0053] In this embodiment, after the latent style variables are sampled and fed into each layer of the decoder which has been loaded with adaptive layer normalization parameters, the decoder outputs a candidate word probability distribution at each decoding step. The candidate word can be a character or a short string word from a high-frequency short string vocabulary. The candidate word probability distribution is used to represent the probability of each candidate word being selected in the current decoding step. The candidate words are selected sequentially according to the output order of the decoding steps, and the candidate words are combined to obtain a candidate word sequence. This candidate word sequence is used as the input for subsequent structural hard constraints and deduplication processing.

[0054] For example, when the password structure pattern is an alphanumeric combination, the sampling latent style variable can carry either a pinyin style or a keyboard path style. The adaptive layer normalization parameters loaded in each layer of the decoder will cause the probability distribution of candidate lexical units to change with the sampling latent style variable. When the sampling latent style variable is close to the center of the pinyin style cluster, the candidate lexical unit sequence is more likely to contain pinyin-type lexical units. When the sampling latent style variable is close to the center of the keyboard path style cluster, the candidate lexical unit sequence is more likely to contain keyboard path-type lexical units. At the same time, the password structure pattern still restricts the character type and number in the subsequent structural hard constraints.

[0055] Understandably, by stratifying according to password structure patterns and performing local continuous sampling around the centers of multiple high-density style clusters, the sampling of potential style variables can cover the high-density areas in the multi-peak user password style distribution. Compared to sampling directly from a single standard normal distribution, this process reduces the occurrence of sampling points falling into low-probability areas between style clusters, making the candidate word sequence closer to the common style base in real password samples, and providing more effective generation input for the stable hit of subsequent candidate password sets.

[0056] S40: Input the sampled latent style variables into each layer of the decoder to obtain candidate lexical sequences, and perform structural hard constraints and deduplication on the candidate lexical sequences to obtain a candidate password set. Based on the candidate password set, obtain the password security assessment result.

[0057] In this embodiment, the candidate word sequence is a combination of words output by the decoder step by step according to the sampled latent style variables. The candidate word can be a single character or a short string word from the high-frequency short string vocabulary. Since the candidate word sequence is obtained by a probability generation process, the candidate word sequence may deviate from the password structure pattern in terms of the number of character types. Therefore, it is necessary to use structural hard constraints to make the candidate word sequence meet the target password structure pattern, and reduce duplicate candidate passwords in the large-scale generation process by deduplication. Then, the password security assessment result is obtained based on the matching result between the candidate password set and the test set password set.

[0058] Apply hard structural constraints to candidate lexical sequences, including: The password structure pattern is parsed using a finite state automaton to obtain the remaining character type requirements; Get the number of letters, numbers, and symbols corresponding to each candidate word in the candidate word sequence; The remaining character type needs to be updated based on the number of letters, numbers, and symbols. Based on the updated remaining character type requirements, the probability distribution of candidate words in the corresponding decoding step in the candidate word sequence is dynamically masked. The candidate lexical sequence is modified based on the dynamic masking results until it meets the password structure pattern, thus completing the structural hard constraint on the candidate lexical sequence.

[0059] In this embodiment, the finite state automaton uses the remaining character type requirement as the state. The remaining character type requirement is obtained by parsing the password structure pattern. For example, the password structure pattern "L4N4" can be parsed as still requiring 4 letters and 4 numbers. When the decoder outputs the probability distribution of candidate words in each decoding step, the finite state automaton determines whether the candidate words will consume the current remaining character type requirement based on the number of letters, numbers and symbols contained in the candidate words, and updates the remaining character type requirement accordingly.

[0060] Furthermore, dynamic masking is used to filter candidate words that do not meet the requirements of the remaining character types in the corresponding decoding step. When a candidate word causes the number of letters, numbers, or symbols to exceed the password structure pattern requirements, the probability of that candidate word in the candidate word probability distribution is set to an unselectable state. When the requirements of the remaining character types have not all been reduced to zero, the terminating symbol remains unselectable. When the requirements of the remaining character types are all reduced to zero, the terminating symbol is allowed to be selected. This makes the candidate word sequence subject to the password structure pattern during the decoding process.

[0061] For example, when the password structure pattern is "L4N4", the finite state automaton initially records the remaining character type requirements as 4 letters and 4 numbers. When the candidate word selected in the current decoding step contains letters, the letter requirement in the remaining character type requirements decreases accordingly. When the candidate word contains numbers, the number requirement in the remaining character type requirements decreases accordingly. If the character type contained in a candidate word would violate the remaining character type requirements of "L4N4", then that candidate word would be dynamically masked and excluded from the candidate word probability distribution.

[0062] The candidate word sequence is deduplicated to obtain a candidate password set, including: Concatenate the candidate word sequence that satisfies the password structure pattern to form the candidate password; Input the candidate passwords into the global Bloom filter to obtain the member query results corresponding to the candidate passwords; When the member query result is no record, the candidate password is written to the global Bloom filter; When the member query result is already recorded, discard the candidate passwords and obtain the candidate password set based on the candidate passwords written to the global Bloom filter.

[0063] In this embodiment, the global Bloom filter includes a bit array of length m and k independent hash functions. For a candidate password x, the global Bloom filter calculates the bit array position corresponding to the candidate password x using the k hash functions respectively. The bit array position can be represented as: ; in, Indicates the first Each hash function is used to select passwords. The hash result, This indicates the length of the bit array in the global Bloom filter. This represents the modulo operation. Indicates the index of the hash function.

[0064] It should be noted that when the member query result corresponding to the candidate password is not recorded, it means that the candidate password has not appeared in the global Bloom filter. The candidate password is written into the global Bloom filter and added to the candidate password set. When the member query result is recorded, it means that the candidate password may have appeared in the global Bloom filter. The candidate password is discarded and the subsequent resampling or subsequent generation process is triggered. Since the global Bloom filter does not need to save the complete string set, it can reduce the storage pressure when generating large-scale candidate passwords.

[0065] Furthermore, the member query results of the global Bloom filter have controllable misjudgments, that is, some candidate passwords that have not appeared before may be judged as recorded and discarded. However, this process will not introduce duplicate candidate passwords into the candidate password set. In large-scale generation scenarios, the discarded candidate passwords can be supplemented to make up the generation scale through subsequent sampling. Therefore, deduplication can enable more computing resources to be used to explore the unrecorded candidate password space and reduce the interference of duplicate candidate passwords on the password security assessment results.

[0066] The password security assessment results are obtained based on the candidate password set, including: Obtain the test set password set, match the candidate password set with the test set password set, and count the number of times the candidate password set matches the test set password set. The hit rate is calculated based on the number of passwords that are hit and the total number of passwords in the test set. The password security assessment result is obtained based on the hit rate.

[0067] In this embodiment, the password security assessment result can be represented by the hit rate. The hit rate is the proportion of the number of passwords in the candidate password set that match the test password set to the total number of passwords in the test password set. The higher the hit rate, the stronger the coverage of weak passwords in the test password set by the candidate password set. Based on this hit rate, the weak password identification capability of the candidate password set in authorized network security assessment can be evaluated, and the coverage of password style and password structure by the candidate password generation process can be reflected.

[0068] For example, in one dataset construction method, the RockYou dataset, after character set filtering, length filtering, and deduplication, was reduced from the original 14,344,391 entries to 13,265,184 entries, with a retention rate of 92.5%. It was then divided into training, validation, and test sets in a 7:1:2 ratio, with candidate password generation sizes of 10... 6 10 7 and 10 8 At that time, the candidate password set can be matched with the test set password set, and the hit rate under different generation scales can be calculated.

[0069] Furthermore, on the RockYou test set, different models showed differences in performance within 10... 6 10 7 and 10 8 The hit rate at different generation scales can be used as a basis for comparing password security assessment results. Among them, PassHfCVAE has a hit rate of 10. 6 The hit rate at the generated scale was 1.31%, and at 10... 7 The hit rate at the generated scale was 9.20%, and at 10... 8 The hit rate at the generated scale was 35.34%, which is used to illustrate the hit rate of the candidate password set on the test set password set under large-scale generation conditions.

[0070] Understandably, the structural hard constraints make the candidate word sequence satisfy the password structure pattern, the global Bloom filter reduces duplicates in the candidate password set, and the hit rate evaluation maps the candidate password set to the test set password set. Together, these three factors enable the password security evaluation result to reflect the comprehensive performance of the candidate password set in terms of structural legality, generation deduplication, and weak password hits, thereby ensuring the stable hit of the weak password set.

[0071] Example 2 Please see Figure 2 As shown, based on the same inventive concept, this embodiment discloses a password security assessment system based on conditional variational autoencoder and multi-center sampling. For details not covered in this embodiment, please refer to the relevant sections of Embodiment 1. The system includes: Sample parsing module: used to obtain password samples, perform probabilistic context-free grammar parsing on the password samples to obtain password structure patterns, construct a high-frequency short string word list based on the password samples, and obtain enhanced word segmentation sequences based on the high-frequency short string word list; Style encoding module: It is used to input the enhanced word segmentation sequence and password structure pattern into the conditional variational autoencoder to obtain latent style variables, generate adaptive layer normalization parameters based on the latent style variables, and load the adaptive layer normalization parameters into each layer of the decoder of the conditional variational autoencoder. The hierarchical sampling module is used to hierarchically classify latent style variables according to the password structure pattern, determine multiple high-density style cluster centers and corresponding cluster weights, and perform local continuous sampling around the corresponding high-density style cluster centers based on the cluster weights to obtain sampled latent style variables. Evaluation generation module: It is used to input the sampled latent style variables into each layer of the decoder to obtain candidate word sequences, and to perform structural hard constraints and deduplication on the candidate word sequences to obtain a candidate password set. Based on the candidate password set, the password security evaluation result is obtained.

[0072] The detailed description above, in conjunction with the accompanying drawings, describes examples but does not represent all examples that can be implemented or fall within the scope of the claims. The terms “example” and “exemplary” are used in this specification to mean “serving as an example, instance or illustration” and do not mean “superior to or better than other examples”.

[0073] Throughout this specification, the phrase "an embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment of the invention. Therefore, the use of these phrases may refer to more than one embodiment. Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0074] It should also be noted that these embodiments may be described as processes depicted as flowcharts, structural diagrams, or block diagrams. Although a flowchart may describe the operations as sequential processes, many of these operations can be performed in parallel or concurrently, and the order of these operations may be rearranged.

Claims

1. A password security assessment method based on conditional variational autoencoder and multi-center sampling, characterized in that, include: Obtain password samples, perform probabilistic context-free grammar parsing on the password samples to obtain password structure patterns, construct a high-frequency short string vocabulary based on the password samples, and obtain enhanced word segmentation sequences based on the high-frequency short string vocabulary; The enhanced word segmentation sequence and password structure pattern are input into the conditional variational autoencoder to obtain latent style variables. Adaptive layer normalization parameters are generated based on the latent style variables and then loaded into each layer of the decoder of the conditional variational autoencoder. The latent style variables are hierarchically analyzed according to the password structure pattern, and multiple high-density style cluster centers and corresponding cluster weights are determined. Based on the cluster weights, local continuous sampling is performed around the corresponding high-density style cluster centers to obtain sampled latent style variables. The latent style variables are sampled and input into each layer of the decoder to obtain candidate word sequences. The candidate word sequences are then subjected to structural hard constraints and deduplication to obtain a candidate password set. The password security assessment result is obtained based on the candidate password set. Methods for generating adaptive layer normalization parameters based on latent style variables include: The latent style variables are input into the parameter mapping network corresponding to each layer of the decoder of the conditional variational autoencoder; The normalized scaling parameters of the corresponding decoder layer are output through the parameter mapping network; The normalized bias parameters of the corresponding decoder layer are output through the parameter mapping network; The normalized scaling parameter and normalized bias parameter corresponding to the same decoder layer are used as the adaptive layer normalization parameters of that decoder layer; Based on cluster weights, local continuous sampling is performed around the corresponding high-density style cluster centers to obtain sampled latent style variables, including: Select the target style cluster center from multiple high-density style cluster centers according to the cluster weight, and obtain the intra-cluster posterior mean vector corresponding to the target style cluster center; The local sampling radius corresponding to the target style cluster center is determined based on the intra-cluster posterior mean vector. Construct a local continuous sampling region around the center of the target style cluster according to the local sampling radius; Sampled latent style variables are obtained by sampling from local continuous sampling regions.

2. The password security assessment method based on conditional variational autoencoder and multi-center sampling according to claim 1, characterized in that, A high-frequency short string vocabulary list was constructed based on password samples, including: Perform a sliding window traversal on the password samples to obtain candidate short strings. Obtain the parent string that contains the candidate short string and has a length greater than the candidate short string. Record the prefix position, middle position, and suffix position of the candidate short string in the parent string. The positional distribution is formed based on the prefix position, middle position, and suffix position; the source distribution is formed based on the parent string and the frequency of the parent string. The frequency of occurrence of candidate short strings is corrected based on the positional entropy corresponding to the positional distribution and the parent string source entropy corresponding to the source distribution, thus obtaining a high-frequency short string vocabulary.

3. The password security assessment method based on conditional variational autoencoder and multi-center sampling according to claim 2, characterized in that, Enhanced word segmentation sequences are obtained based on a high-frequency short string vocabulary, including: The character gaps in the password sample are used as nodes, and the high-frequency short strings in the high-frequency short string vocabulary that are consistent with the continuous character segments of the password sample are used as directed edges between nodes. The edge weight is determined based on the square of the length of the high-frequency short string corresponding to the directed edge; The global optimal path covering all characters of the password sample is determined based on the edge weights, and the enhanced word segmentation sequence is obtained by backtracking along the global optimal path.

4. The password security assessment method based on conditional variational autoencoder and multi-center sampling according to claim 1, characterized in that, The sampled latent style variables are input into each layer of the decoder to obtain a sequence of candidate lexical units, including: Sample latent style variables are input into each layer of the decoder, which is loaded with adaptive layer normalization parameters; Based on the stepwise decoding of the sampled latent style variables by each layer of the decoder, the probability distribution of candidate lexical units corresponding to each decoding step is obtained. Candidate words are selected based on the probability distribution of candidate words in the current decoding step; Candidate words are combined according to the output order of each decoding step to obtain a candidate word sequence.

5. The password security assessment method based on conditional variational autoencoder and multi-center sampling according to claim 1, characterized in that, Apply hard structural constraints to candidate lexical sequences, including: The password structure pattern is parsed using a finite state automaton to obtain the remaining character type requirements; Get the number of letters, numbers, and symbols corresponding to each candidate word in the candidate word sequence; The remaining character type needs to be updated based on the number of letters, numbers, and symbols. Based on the updated remaining character type requirements, the probability distribution of candidate words in the corresponding decoding step in the candidate word sequence is dynamically masked. The candidate lexical sequence is modified based on the dynamic masking results until it meets the password structure pattern, thus completing the structural hard constraint on the candidate lexical sequence.

6. The password security assessment method based on conditional variational autoencoder and multi-center sampling according to claim 5, characterized in that, The candidate word sequence is deduplicated to obtain a candidate password set, including: Concatenate the candidate word sequence that satisfies the password structure pattern to form the candidate password; Input the candidate passwords into the global Bloom filter to obtain the member query results corresponding to the candidate passwords; When the member query result is no record, the candidate password is written to the global Bloom filter; When the member query result is already recorded, discard the candidate passwords and obtain the candidate password set based on the candidate passwords written to the global Bloom filter.

7. The password security assessment method based on conditional variational autoencoder and multi-center sampling according to claim 6, characterized in that, The password security assessment results are obtained based on the candidate password set, including: Obtain the test set password set, match the candidate password set with the test set password set, and count the number of times the candidate password set matches the test set password set. The hit rate is calculated based on the number of passwords that are hit and the total number of passwords in the test set. The password security assessment result is obtained based on the hit rate.

Images