Modified Password Guessing Methods Based on TarGuess-I

Abstract EN

TarGuess−I is a leading online targeted password guessing model using users’ personally identifiable information (PII) proposed at ACM CCS 2016 by Wang et al.

It has attracted widespread attention in password security owing to its superior guessing performance.

Yet, after analyzing the users’ vulnerable behaviors of using popular passwords and constructing passwords with users’ PII, we find that this model does not take into account popular passwords, keyboard patterns, and the special strings.

The special strings are the strings related to users but do not appear in the users’ demographic information.

Thus, we propose TarGuess−I+KPX, a modified password guessing model with three semantic methods, including (1) identifying popular passwords by generating top-300 lists from similar websites, (2) recognizing keyboard patterns by relative position, and (3) catching the special strings by extracting continuous characters from user-generated PII.

We conduct a series of evaluations on six large-scale real-world leaked password datasets.

The experimental results show that our modified model outperforms TarGuess−I by 2.62% within 100 guesses.