基于攻击算法的海量真实用户口令数据分析  

Analysis of Large-scale Real User Password Data Based on Cracking Algorithms

作　　者：谢志杰 张旻 李振汉 王红军 XIE Zhi-jie;ZHANG Min;LI Zhen-han;WANG Hong-jun(College of Electronic Engineering,National University of Defense Technology,Hefei 230037,China;Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation,Hefei 230037,China)

机构地区：[1]国防科技大学电子对抗学院,合肥230037 [2]网络空间安全态势感知与评估安徽省重点实验室,合肥230037

出　　处：《计算机科学》2020年第11期48-54,共7页Computer Science

基　　金：国家自然科学基金(61971473);安徽省自然科学基金项目(1908085QF291)。

摘　　要：口令认证是现今主要的身份认证方式,已广泛应用于金融、军事和网络等领域。文中从攻击者的角度对口令的安全性展开研究,利用海量真实的用户数据对口令的一般特征进行统计分析,基于概率上下文无关文法(Probabilistic Context-Free Grammars,PCFG)口令猜测算法、TarGuess-I定向口令猜测模型的口令脆弱性分析,发现了用户在选择生成口令时存在易被攻击者发现并被利用的脆弱行为,如偏好使用简单结构口令、基于模式设计口令、基于语义生成口令以及偏好使用姓名和用户名等个人信息生成口令等,总结了这些脆弱行为的特征,为避免用户设置脆弱口令以及设计口令强度评估方法提供了依据。Password authentication is the main authentication method nowadays.It is widely used in various fields,such as finance,military and internet.In this paper,password security is studied from the perspective of an attacker.Large-scale real user data is used for statistical analyses of password general characteristics,and for password vulnerability analyses based on Probabilistic Context-Free Grammars(PCFG)password guessing algorithm and TarGuess-I targeted password guessing model.Through the above analyses,it is found in users’passwords that there are vulnerable behaviors that can be easily discovered and exploited by attackers,such as choosing simple structure passwords,generating passwords based on patterns,password containing semantics and passwords containing personal information(i.e.,name and user name).These vulnerable behavior characteristics are summarized to provide a basis for reminding users to avoid setting weak passwords and studying the method of password strength meter.

关 键 词：口令安全 口令猜测 脆弱行为 用户信息 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]