Password Cracking Using Probabilistic Context-Free Grammars

By Matt Weir, Sudhir Aggarwal, Breno de Medeiros, Bill Glodek. IEEE Symposium on Security and Privacy, 2009

575 citations recorded by the source corpus.

Subfields: Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/4681a0116597fd0804b07e8176b8761e4f569743

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

Cracking Classifiers for Evasion: A Case Study on the Google's Phishing Pages Filter (2016, unknown): “The dictionary attack [42][43][57] is a more intelligent variant of a straight brute force approach.”
Privacy in the Internet of Things for Smart Healthcare (2018, methodology): “In the classification and tagging stage, the extended PCFG algorithm [14] is used to classify the collected personal information into the letter segment L , the digit segment D , and the special character segment S .”
Zipf’s Law in Passwords (2017, unknown): “[30] suggested a novel technique for automatically deriving word-mangling rules.”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, methodology): “present a novel password-cracking technique that uses the text structure from training data while applying mangling rules to the text itself [25].”
Guessing human-chosen secrets (2012, methodology): “Current approaches1 to estimating the strength of an individual password include using entropy estimation formulas [58, 321, 273], estimating the probability of the password in an model distribution [77, 310, 62] or estimating order in which the password would be guessed by cracking software [168].”
Password Strength: An Empirical Analysis (2010, methodology): “space versus number of cracked passwords for guessing techniques including dictionary attacks, brute force, dictionary mangling, probabilistic context-free grammars [7], and”
Testing metrics for password creation policies by attacking large sets of revealed passwords (2010, methodology): “One potential solution to this problem is to take the grammar we described in a previous paper [18] and use it to evaluate the probability of user selected passwords.”
Gen: a general-purpose probabilistic programming system with programmable inference (2019, methodology): “Recurse is used to implement recursive computation patterns including probabilistic context free grammars, which are a common building block of probabilistic models [11, 18, 22, 46].”
Honeywords: making password-cracking detectable (2013, methodology): “[6] propose an interesting approach (based on [41]) to chaffing-with-a-passwordmodel in which honeywords are generated using the same syntax as the password.”
A Study of Probabilistic Password Models (2014, methodology): “In this paper, we considered 3 instantiations of PCFGW : the first uses the dictionary used in [25]; the second uses the OpenWall dictionary; and the third generates the dictionary from the training set.”
Targeted Online Password Guessing: An Underestimated Threat (2016, methodology): “9 shows that, within 10 (cid:24) 10 3 guesses, our TarGuess-I outperforms Persona-PCFG [17] by 37.11% (cid:24) 73.33%, and outperforms the three trawling online guessing algorithms [5,18,27] by at least 412% (cid:24) 740%.”
PassGAN: A Deep Learning Approach for Password Guessing (2017, methodology): “nerate password guesses by Narayanan et al. [64]. Their approach uses manually defined password rules, such as which portion of the generated passwords is composed of letters and numbers. Weir et al. [92] subsequently improved this technique with Probabilistic Context-Free Grammars (PCFGs). With PCF”
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (2016, methodology): “We compare our implementation of neural networks to stateof-the-art password-guessing models, including widely studied Markov models [65] and probabilistic contextfree grammars [59, 93], as well as software tools using mangled dictionary entries [74, 83].”
A Security Analysis of Honeywords (2018, unknown): “[30] for a presentation of an interesting alternative model for passwords, based on probabilistic context-free grammars” [19].”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, background): “We neither further propagate the data, nor does our work call significantly greater attention to the data sets, which have been used in several scientific studies [4, 9, 18, 38, 39].”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, background): “[11] automatically generates mangling rules from a large training set of known passwords.”