Adaptive Password Guessing Framework Using Various Datasets

Abstract

Password guessing attack is a significant threat to account security. Understanding this attack is crucial for identifying the vulnerabilities of current password systems and for developing more effective methods to protect user accounts. Adaptive password guessing techniques can dynamically adjust their strategies based on cracked passwords, resulting in improved performance under varying password distributions. However, existing adaptive password guessing models are typically trained on a single password dataset and attempt to crack a target website through dynamic adjustments. In recent years, the number of leaked password datasets has increased significantly. To fully leverage the diversity of various datasets and accurately assess the threat of password guessing, we propose an adaptive password guessing framework that employs a transformer architecture capable of learning multiple password distributions from various datasets and generate password guesses adaptively for the target. Through experiments involving 29 real-world leaked password datasets, we demonstrate that our framework achieves an average improvement of 44.63% over the state-of-the-art adaptive password guessing models.