中文语境下的口令分析方法

doi:10.11772/j.issn.1001-9081.2018109122

计算机应用 ›› 2019, Vol. 39 ›› Issue (6): 1713-1718.DOI: 10.11772/j.issn.1001-9081.2018109122

中文语境下的口令分析方法

曾剑平^1,2, 陈其乐¹, 吴承荣^1,2, 方熙^1,2

1. 复旦大学计算机科学技术学院, 上海 200433;
2. 网络信息安全审计与监控教育部工程研究中心(复旦大学), 上海 200433

收稿日期:2018-11-13 修回日期:2018-12-11 发布日期:2019-06-17 出版日期:2019-06-10
通讯作者: 曾剑平
作者简介:曾剑平(1973-),男,福建泉州人,副教授,博士,主要研究方向:大数据安全、互联网大数据技术;陈其乐(1995-),男,山东泰安人,主要研究方向:信息安全;吴承荣(1971-),男,上海人,副教授,博士,CCF会员,主要研究方向:信息安全;方熙(1996-),男,湖北鄂州人,硕士研究生,主要研究方向:网络安全。
基金资助:
国家重点研发计划项目（2016YFB0800101）。

Analysis method of passwords under Chinese context

ZENG Jianping^1,2, CHEN Qile¹, WU Chengrong^1,2, FANG Xi^1,2

1. School of Computer Science, Fudan University, Shanghai 200433, China;
2. Engineering Research Center of Cyber Security Auditing and Monitoring, Ministry of Education(Fudan University), Shanghai 200433, China

Received:2018-11-13 Revised:2018-12-11 Online:2019-06-17 Published:2019-06-10
Supported by:
This work is partially supported by the National Key R&D Program of China (2016YFB0800101).

摘要/Abstract

摘要： 针对目前口令语义分析挖掘主要针对英文口令，且局限于常见的单词或姓氏等口令单元的问题，在中文语境下，利用古诗、成语建立模式库，使用口令字符串的数据分析技术，提出了一种基于已知口令元的中文语境口令分析方法。首先，识别出已知口令元；然后，将其视作单个口令自由度；最后，计算给定攻击成功率下的自由度攻击成本，得出口令安全性的量化数值。设计实验对大量明文口令进行量化分析之后，可知在使用中文语境的口令中，80%的用户口令不具有高安全性，能够被字典攻击轻易攻破。

关键词: 口令分析, 口令安全性, 已知口令元, 口令自由度, 中文语境

Abstract: Concerning the problem that the current research on password semantics is mainly based on English datasets and restricted to some units like common words or surnames, by using data analysis technology based on password strings, a Chinese context password analysis method based on known-password elements was proposed with the pattern library based on Chinese poems and idioms in Chinese context. Firstly, the known-password element was identified. Then, it was considered as a single password degree of freedom. Finally, the freedom attack cost within a given attack success rate was calculated and the quantitative security of password was obtained. After quantitative analysis of large amounts of plaintext passwords by designed experiments, it is concluded that 80% of user passwords are low secure and can be easily broken by dictionary attacks in Chinese context.

Key words: password analysis, password security, known-password element, password degree of freedom, Chinese context

中图分类号:

TP309.2

曾剑平, 陈其乐, 吴承荣, 方熙. 中文语境下的口令分析方法[J]. 计算机应用, 2019, 39(6): 1713-1718.

ZENG Jianping, CHEN Qile, WU Chengrong, FANG Xi. Analysis method of passwords under Chinese context[J]. Journal of Computer Applications, 2019, 39(6): 1713-1718.

参考文献

[1] GULENKO I. Improving passwords:influence of emotions on security behavior[J]. Information Management & Computer Security, 2014, 22(2):167-178.
[2] SHEN C, YU T W, XU H D, et al. User practice in password security:an empirical study of real-life passwords in the wild[J]. Computers & Security, 2016, 61:130-141.
[3] WANG D, CHENG H, WANG P, et al. Zipf's law in passwords[J]. IEEE Transactions on Information Forensics and Security, 2017, 12(11):2776-2791.
[4] BROWN B J, CALLIS K. Computer password choice and personality traits among college students[R]. Cape Girardeau:Southeast Missouri State University, 2004.
[5] FLORENCIO D, HERLEY C. A large-scale study of Web password habits[C]//WWW 2007:Proceedings of the 200716th International Conference on World Wide Web. New York:ACM, 2007:657-666.
[6] LI Z G, HAN W L, XU W Y. A large-scale empirical analysis of Chinese Web passwords[C]//Proceedings of the 23rd USENIX conference on Security Symposium. Berkeley, CA:USENIX Association, 2014:559-574.
[7] 郭奕东,邱卫东,刘伯仲.基于属性拆分与数据挖掘的真实口令分析[J].计算机工程,2014,40(7):254-257.(GUO Y D, QIU W D, LIU B Z. Analysis of real password based on attributes resolution and data mining[J]. Computer Engineering, 2014, 40(7):254-257.)
[8] 高强,李啸,胡勇,等.基于社工信息的口令生成与安全性分析[J].通信技术,2017,50(7):1511-1516.(GAO Q, LI X, HU Y, et al. Password generation and security analysis based on social engineering[J]. Communications Technology,2017, 50(7):1511-1516.)
[9] 刘功申,邱卫东,孟魁,等.基于真实数据挖掘的口令脆弱性评估及恢复[J].计算机学报,2016,39(3):454-467.(LIU G S, QIU W D, MENG K, et al. Password vulnerability assessment and recovery based on rules mined from large-scale real data[J]. Chinese Journal of Computers, 2016, 39(3):454-467.)
[10] ZENG J P, DUAN J J, WU C R. Empirical study on lexical sentiment in passwords from Chinese websites[J]. Computers & Security, 2019, 80:200-210.
[11] NARAYANAN A, SHMATIKOV V. Fast dictionary attacks on passwords using time-space tradeoff[C]//CCS 2005:Proceedings of 201512th ACM Conference on Computer and Communications Security. New York:ACM, 2005:364-372.
[12] VERAS R, COLLINS C, THORPE J. On the semantic patterns of passwords and their security impact[C]//NDSS 2014:Proceedings of the 2014 Network and Distributed System Security Symposium. San Diego, CA:Internet Society, 2014:3-9.
[13] LI Y, WANG H N, SUN K. Personal information in passwords and its security implications[J]. IEEE Transactions on Information Forensics and Security, 2017, 12(10):2320-2333.
[14] 卢致旭,邱卫东,廖凌.基于数据挖掘技术的字典生成方法[J].信息安全与通信保密,2011,9(11):63-65.(LU Z X, QIU W D, LIAO L. Generation of password dictionary based on data mining technology[J]. China Information Security, 2011, 9(11):63-65.)
[15] 邹静,林东岱,郝春辉.一种基于结构划分概率的口令攻击方法[J].计算机学报,2014(5):1206-1215.(ZOU J, LIN D D, HAO C H. A password cracking method based on structure division probability[J]. Chinese Journal of Computers, 2014(5):1206-1215.)
[16] HITAJ B, GASTI P, ATENIESE G, et al. PassGAN:a deep learning approach for password guessing[EB/OL].[2018-09-16]. https://arxiv.org/pdf/1709.00440.pdf.
[17] MALONE D, MAHER K. Investigating the distribution of password choices[C]//WWW 2012:Proceedings of the 21st International Conference on World Wide Web. New York:ACM, 2012:301-310.

中文语境下的口令分析方法

Analysis method of passwords under Chinese context

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	赵振皓, 张仕斌, 万武南, 张金全, 秦智. 基于信誉值和强盲签名算法的委托权益证明共识算法[J]. 《计算机应用》唯一官方网站, 2024, 44(12): 3717-3722.
[2]	张宏扬张淑芬谷铮. 面向个性化与公平性的联邦学习算法fedPF[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.
[3]	彭海洋计卫星刘法旺. 基于区块链的自动驾驶仿真测试数据存证模型[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.
[4]	颜新月, 杨淑群, 高永彬. 基于证据增强与多特征融合的文档级关系抽取[J]. 《计算机应用》唯一官方网站, 2024, 44(11): 3379-3385.
[5]	陈学斌, 屈昌盛. 面向联邦学习的后门攻击与防御综述[J]. 《计算机应用》唯一官方网站, 2024, 44(11): 3459-3469.
[6]	林翔, 金彪, 尤玮婧, 姚志强, 熊金波. 基于脆弱指纹的深度神经网络模型完整性验证框架[J]. 《计算机应用》唯一官方网站, 2024, 44(11): 3479-3486.
[7]	张帅华, 张淑芬, 周明川, 徐超, 陈学斌. 基于半监督联邦学习的恶意流量检测模型[J]. 《计算机应用》唯一官方网站, 2024, 44(11): 3487-3494.
[8]	杜晓玉, 刘帅起, 韩志杰, 霍振祥, 王玉璟. 以患者为中心基于IPFS和区块链的医疗信息共享方案[J]. 《计算机应用》唯一官方网站, 2024, 44(10): 3122-3133.
[9]	张欢, 王静宇, 刘立新, 姜晓宇. 双重授权的多组织协同数据共享方案[J]. 《计算机应用》唯一官方网站, 2024, 44(10): 3307-3314.
[10]	陈学斌, 单丽洋, 郭如敏. 基于差分隐私的直方图发布方法综述[J]. 《计算机应用》唯一官方网站, 2024, 44(10): 3114-3121.
[11]	李道全徐正陈思慧刘嘉宇. 融合变分自编码器与自适应增强卷积神经网络的网络流量分类模型[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.
[12]	马海峰蔡杰伟薛庆水杨家海韩静卢子譞. 基于格的后量子无证书公共审计方案[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.
[13]	王利娥林彩怡李永东傅星珵李先贤. 基于区块链的数字内容版权保护和公平追踪方案[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.
[14]	任志强陈学斌. 基于历史模型更新的自适应防御机制FedAud[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.
[15]	陈学斌屈昌盛. 面向联邦学习的后门攻击与防御综述[J]. 《计算机应用》唯一官方网站, 0, (): 0-0.