Search-based Ordered Password Generation of Autoregressive Neural Networks

TL;DR

This paper introduces SOPG, a search-based ordered password generation method for autoregressive neural networks, significantly improving password guessing efficiency and effectiveness over existing models.

Contribution

The paper proposes SOPG, a novel search-based ordered password generation technique that enhances the efficiency and success rate of neural network-based password guessing.

Findings

SOPG generates non-repeating passwords in descending probability order.

SOPG requires fewer inferences to reach the same cover rate as random sampling.

SOPGesGPT outperforms existing models in effective and cover rates, achieving 35.06% cover rate.

Abstract

Passwords are the most widely used method of authentication and password guessing is the essential part of password cracking and password security research. The progress of deep learning technology provides a promising way to improve the efficiency of password guessing. However, current research on neural network password guessing methods mostly focuses on model structure and has overlooked the generation method. Due to the randomness of sampling, not only the generated passwords have a large number of duplicates, but also the order in which passwords generated is random, leading to inefficient password attacks. In this paper, we propose SOPG, a search-based ordered password generation method, which enables the password guessing model based on autoregressive neural network to generate passwords in approximately descending order of probability. Experiment on comparison of SOPG and Random sampling shows passwords generated by SOPG do not repeat, and when they reach the same cover rate, SOPG requires fewer inferences and far fewer generated passwords than Random sampling, which brings great efficiency improvement to subsequent password attacks. We build SOPGesGPT, a password guessing model based on GPT, using SOPG to generate passwords. Compared with the most influential models OMEN, FLA, PassGAN, VAEPass and the latest model PassGPT in one-site test, experiments show that SOPGesGPT is far ahead in terms of both effective rate and cover rate. As to cover rate that everyone recognizes, SOPGesGPT reaches 35.06%, which is 254%, 298%, 421%, 380%, 81% higher than OMEN, FLA, PassGAN, VAEPass, and PassGPT respectively.