To Learn Better Character Embeddings in Generative Models for Password Attack

Abstract

Variational Autoencoder (VAE) has been used as password generative model for trawling attack in multiple works. Its sample distribution can be easily changed by controling the mean and variance of the prior distribution, which makes it natively suitable for dynamic attack scenario. Combining transformer blocks with VAE can achieve better performance since attention mechanisms can handle sequence data better. But such design is unstable for password generation tasks. The encoder-decoder model tends to degrade into decoder-only model due to the KL vanishing problem, making it hard to train. To handle this problem, we performed an in-depth analysis and proposed a new transformer-based VAE model specifically designed for password generation. It out-performs former encoder-decoder generative model by 4%–15% in cracking rate. Moreover, we make an improvement to dynamic attack by using a 3-period strategy, with which our method becomes competitive with probabilistic ordered attack models such as PCFG [11] and FLA [8].