A Security Analysis of Honeywords

By Z. Li, Deqing Zou, Shouhuai Xu, Xinyu Ou, Hai Jin, Sujuan Wang, Yuyi Zhong. 2018

1,132 citations recorded by the source corpus.

Honeywords are decoy passwords associated with each user account, and they contribute a promising approach to detecting password leakage. This approach was first proposed by Juels and Rivest at CCS’13, and has been covered by hundreds of medias and also adopted in various research domains. The idea of honeywords looks deceptively simple, but it is a deep and sophisticated challenge to automatically generate honeywords that are hard to differentiate from real passwords. In JuelsRivest’s work, four main honeyword-generation methods are suggested but only justified by heuristic security arguments. In this work, we for the first time develop a series of practical experiments using 10 large-scale datasets, a total of 104 million real-world passwords, to quantitatively evaluate the security that these four methods can provide. Our results reveal that they all fail to provide the expected security: real passwords can be distinguished with a success rate of 29.29%∼32.62% by our basic trawling-guessing attacker, but not the expected 5%, with just one guess (when each user account is associated with 19 honeywords as recommended). This figure reaches 34.21%∼49.02% under the advanced trawling-guessing attackers who make use of various state-of-the-art probabilistic password models. We further evaluate the security of Juels-Rivest’s methods under a targeted-guessing attacker who can exploit the victim’ personal information, and the results are even more alarming: 56.81%∼67.98%. Overall, our work resolves three open problems in honeyword research, as defined by Juels and Rivest.

Subfields: Information Systems, Software, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

In Privacy & Security

In Signal Processing

Citations in the corpus

Unified Pre-training for Program Understanding and Generation (2021, background): “, 2020), Bug Detection (Ray et al., 2016; Li et al., 2018b; Russell et al., 2018; Zhou et al., 2019; Chakraborty et al., 2020), Program Repair (Chen et al.”
DeepBugs: a learning approach to name-based bug detection (2018, methodology): “The VulDeePecker approach [Li et al. 2018] trains a neural network to determine whether a code snippet suffers from specific kinds of vulnerabilities.”
Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks (2019, methodology): “The recent works [13, 15, 14] treat source code as ﬂat natural language sequences, and explore the potential of natural language process techniques in vulnerability detection.”
NL2Type: Inferring JavaScript Function Types from Natural Language Information (2019, methodology): “Following common practice in large-scale machine learning, including on software [15], [16], [28]–[30], we divide these ﬁles into disjoint sets of training ﬁles (80”
SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities (2018, methodology): “In this experiment, we use BLSTM as in [11] and the SeVCs accommodating semantic information induced by data and control dependencies.”
DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection (2023, methodology): “The VulDeePecker [14] dataset focuses on only two CWEs.”
Vulnerability detection with fine-grained interpretations (2021, methodology): “For the method-level VD, our results show that IVDetect outperforms the existing ML/DL-based approaches [11, 19, 20, 27, 37] by 43%–84% and 105%–255% at the top 10 list for two ranking scores nDCG and MAP, respectively.”
A C/C++ Code Vulnerability Dataset with Code Changes and CVE Summaries (2020, methodology): “Recently, the detection of security vulnerabilities has been a crucial topic of interest to the research community [3, 4, 7, 10, 11].”
LineVul: A Transformer-based Line-Level Vulnerability Prediction (2022, methodology): “[43], VulDeePecker [33], and BoW+RF), and evaluated on both coarse-grained (i.”
Deep Learning Based Vulnerability Detection: Are We There Yet? (2020, methodology): “VulDeePecker [3] and SySeVR [4] uses Word2Vec to transform their symbolic tokens into vectors.”
Automated Vulnerability Detection in Source Code Using Deep Representation Learning (2018, methodology): “[13] used a recurrent neural network (RNN) trained on code snippets related to library/API function calls to detect two types of vulnerabilities related to the improper usage of those calls.”
Software Vulnerability Detection Using Deep Neural Networks: A Survey (2020, methodology): “A recent study [127] further extended [56] by incorporating the “code gadget” to contain not only the code sequences depicting the relations of data dependences but also the code ones revealing the relations of control dependences.”