A Reinforcement Learning-based Sequence Generation Algorithm for Password Guessing
Zheng Chen, Xuliang Zhang · GLOBECOM 2022 - 2022 IEEE Global Communications Conference · 2022
Human-generated passwords are naturally rich in structure, making them vulnerable to guessing attacks. Recently, people have employed strong deep neural networks to model and generate human-generated passwords, showing its great potential for efficient password guessing. However, the research on password guessing decoding algorithms, which is the other essential part of the sequence generation task, remains barely explored. In this paper, we provide an in-depth analysis of the two most widely used classes of sequence decoding algorithms, i.e., Beam Search and Sampling, and find out that a dynamically adjusted Temperature Sampling could be the most suitable one for massive password generation. However, it takes a lot of knowledge and practice even for a human expert to control the temperature parameters appropriately. Thus, we provide a Reinforcement learning-based Dynamic Temperature Sampling algorithm for massive password generation. We first train a Transformer-based password language model in an auto-regressive fashion. Next, we generate the passwords using Temperature Sampling in a batched manner. A neural Q-network is trained to adjust the temperature parameter automatically for each generation batch. A lower temperature value at the start batches allows the most common passwords to be generated rapidly. Then the temperature is gradually increased to generate more non-repetitive long-tail passwords. Experimental results demonstrate that our proposed method far outperforms baseline methods in terms of both generation speed and hit rate.