Improving Password Guessing via Representation Learning

TL;DR

This paper presents a deep generative representation learning approach to improve password guessing by enabling flexible, biased password generation and dynamic adaptation to target password distributions.

Contribution

It introduces a novel framework for conditional password guessing and an EM-inspired method for adaptive password distribution modeling.

Findings

Enables password generation with arbitrary biases.

Allows dynamic adaptation to specific password sets.

Improves password guessing effectiveness.

Abstract

Learning useful representations from unstructured data is one of the core challenges, as well as a driving force, of modern data-driven approaches. Deep learning has demonstrated the broad advantages of learning and harnessing such representations. In this paper, we introduce a deep generative model representation learning approach for password guessing. We show that an abstract password representation naturally offers compelling and versatile properties that can be used to open new directions in the extensively studied, and yet presently active, password guessing field. These properties can establish novel password generation techniques that are neither feasible nor practical with the existing probabilistic and non-probabilistic approaches. Based on these properties, we introduce:(1) A general framework for conditional password guessing that can generate passwords with arbitrary biases; and (2) an Expectation Maximization-inspired framework that can dynamically adapt the estimated password distribution to match the distribution of the attacked password set.