摘要
口令猜解是口令安全研究的重要方向之一。基于生成式对抗网络(Generative Adversarial Network,GAN)的口令猜解是近几年提出的一种新方法,其通过判别器对生成口令的评判结果来指导生成器的更新,进而生成口令猜测集。然而由于判别器对生成器的指导不足,现有的基于GAN的口令猜解模型的猜解效率较低。针对这个问题,提出了一种基于强化学习Actor-Critic算法改进的GAN口令猜解模型AC-Pass。AC-Pass模型通过Critic网络和判别器输出的奖赏共同指导Actor网络每一时间步生成策略的更新,实现了对口令序列生成过程的强化指导。将AC-Pass模型应用到RockYou,LinkedIn和CSDN口令集进行实验,并与PCFG模型、已有基于GAN的口令猜解模型PassGAN和seqGAN进行比较。实验结果表明,无论是同源测试集还是异源测试集,AC-Pass模型在9×10^(8)猜测集上的口令破解率均高于PassGAN和seqGAN;且当测试集与训练集之间的口令空间分布差异较大时,AC-Pass表现出了优于PCFG的口令猜解性能;另外,AC-Pass模型有较大的口令输出空间,其破解率随着口令猜测集的增大而提高。
Password guessing is an important research direction in password security.Password guessing based on generative adversarial network(GAN)is a new method proposed in recent years,which guides the update of the generator according to evaluation results on passwords generated by the discriminator.Consequently,password guessing sets can be generated with trained GANs.However,the existing GAN-based password guessing models have low efficiency due to inadequate guidance of the discriminator to the generator.To solve this problem,an improved GAN password guessing model AC-Pass based on reinforcement learning Actor-Critic algorithm is proposed.The AC-Pass model guides the update of the generation strategy of the Actor network at each time step through the output rewards of the discriminator and the Critic network,and realizes the reinforce guidance of password sequence generation process.The proposed AC-Pass model is implemented on RockYou,LinkedIn and CSDN data sets and compared with PCFG model and the existing GANs-based password guessing models such as PassGAN and seqGAN.Results on homologous testing sets and heterologous testing sets indicate that password cracking rate of AC-Pass model on the guessing set is higher than that of PassGAN and seqGAN.Moreover,AC-Pass shows better guessing performance than PCFG when the password spatial distribution between the testing set and the training set is significant.In addition,the AC-Pass model has a large password output space.As the size of password guessing set increases,the cracking rate continues to rise.
作者
李小玲
吴昊天
周涛
鲁辉
LI Xiaoling;WU Haotian;ZHOU Tao;LU Hui(School of Computer Science and Engineering,South China University of Technology,Guangzhou 510006,China;Cyberspace Institute of Advanced Technology,Guangzhou University,Guangzhou 510006,China)
出处
《计算机科学》
CSCD
北大核心
2023年第1期334-341,共8页
Computer Science
基金
广东省重点领域研发计划(2019B010137004)
广东省自然科学基金面上项目(2021A1515011798)。
