PassGAN: A Deep Learning Approach for Password Guessing

Hitaj, Briland; Gasti, Paolo; Ateniese, Giuseppe; Pérez-Cruz, Fernando

doi:10.48550/arxiv.1709.00440

Cited by 6 publications

(6 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors further investigate the use of GANs for password guessing. In [505], they design PassGAN, which learns the distribution of a set of leaked passwords. Once trained on a dataset, PassGAN is able to match over 46% of passwords in a different testing set, without user intervention or cryptography knowledge.…”

Section: H Deep Learning Driven Network Securitymentioning

confidence: 99%

Deep Learning in Mobile and Wireless Networking: A Survey

Zhang

Patras

Haddadi

2019

IEEE Commun. Surv. Tutorials

1,335

838

View full text Add to dashboard Cite

The rapid uptake of mobile devices and the rising popularity of mobile applications and services pose unprecedented demands on mobile and wireless networking infrastructure. Upcoming 5G systems are evolving to support exploding mobile traffic volumes, real-time extraction of fine-grained analytics, and agile management of network resources, so as to maximize user experience. Fulfilling these tasks is challenging, as mobile environments are increasingly complex, heterogeneous, and evolving. One potential solution is to resort to advanced machine learning techniques, in order to help manage the rise in data volumes and algorithm-driven applications. The recent success of deep learning underpins new and powerful tools that tackle problems in this space.In this paper we bridge the gap between deep learning and mobile and wireless networking research, by presenting a comprehensive survey of the crossovers between the two areas. We first briefly introduce essential background and state-of-theart in deep learning techniques with potential applications to networking. We then discuss several techniques and platforms that facilitate the efficient deployment of deep learning onto mobile systems. Subsequently, we provide an encyclopedic review of mobile and wireless networking research based on deep learning, which we categorize by different domains. Drawing from our experience, we discuss how to tailor deep learning to mobile environments. We complete this survey by pinpointing current challenges and open future directions for research.

show abstract

Section: H Deep Learning Driven Network Securitymentioning

confidence: 99%

Deep Learning in Mobile and Wireless Networking: A Survey

Zhang

Patras

Haddadi

2019

IEEE Commun. Surv. Tutorials

1,335

838

View full text Add to dashboard Cite

show abstract

“…The differences between the two versions of the paper can be summarized as follows: (1) we identified an issue with the PassGAN implementation used in [33], which led to a substantial decrease in the number of unique passwords generated. We corrected this issue and, as a result, in this paper we report a rate of generation of unique passwords roughly four times higher than in our earlier work; and (2) in the updated paper, we compare PassGAN with state-of-the-art password guessing based on Markov Models, and with the work on neural-network (RNN) by Melicher et al [52], in addition to John the Ripper and HashCat.…”

Section: Changes With Respect To An Earlier Version Of This Papermentioning

confidence: 99%

PassGAN: A Deep Learning Approach for Password Guessing

Hitaj

Gasti

Ateniese

et al. 2019

Lecture Notes in Computer Science

Self Cite

177

128

View full text Add to dashboard Cite

State-of-the-art password guessing tools, such as HashCat and John the Ripper, enable users to check billions of passwords per second against password hashes. In addition to performing straightforward dictionary attacks, these tools can expand password dictionaries using password generation rules, such as concatenation of words (e.g., "password123456") and leet speak (e.g., "password" becomes "p4s5w0rd"). Although these rules work well in practice, expanding them to model further passwords is a laborious task that requires specialized expertise.To address this issue, in this paper we introduce PassGAN, a novel approach that replaces human-generated password rules with theory-grounded machine learning algorithms. Instead of relying on manual password analysis, PassGAN uses a Generative Adversarial Network (GAN) to autonomously learn the distribution of real passwords from actual password leaks, and to generate high-quality password guesses. Our experiments show that this approach is very promising. When we evaluated PassGAN on two large password datasets, we were able to surpass rule-based and state-of-the-art machine learning password guessing tools. However, in contrast with the other tools, PassGAN achieved this result without any a-priori knowledge on passwords or common password structures. Additionally, when we combined the output of PassGAN with the output of HashCat, we were able to match 51%-73% more passwords than with HashCat alone. This is remarkable, because it shows that PassGAN can autonomously extract a considerable number of password properties that current state-of-the art rules do not encode.

show abstract

“…They find that adding samples from DeepDGA to the training data of deep learning based DGA classifiers improves their performance against unseen malware families, aiding generalization of the models when insufficient training data is available. In the field of password security, Hitaj et al [28] have proposed PassGAN, another generative model trained in the GAN framework. Pass-GAN learns to capture the distribution of human passwords and is able to surpass state of the art tools for password guessing.…”

Section: Related Workmentioning

confidence: 99%

CharBot: A Simple and Effective Method for Evading DGA Classifiers

et al. 2019

View full text Add to dashboard Cite

Domain generation algorithms (DGAs) are commonly leveraged by malware to create lists of domain names which can be used for command and control (C&C) purposes. Approaches based on machine learning have recently been developed to automatically detect generated domain names in real-time. In this work, we present a novel DGA called CharBot which is capable of producing large numbers of unregistered domain names that are not detected by state-of-the-art classifiers for real-time detection of DGAs, including the recently published methods FANCI (a random forest based on human-engineered features) and LSTM.MI (a deep learning approach). CharBot is very simple, effective and requires no knowledge of the targeted DGA classifiers. We show that retraining the classifiers on CharBot samples is not a viable defense strategy. We believe these findings show that DGA classifiers are inherently vulnerable to adversarial attacks if they rely only on the domain name string to make a decision. Designing a robust DGA classifier may, therefore, necessitate the use of additional information besides the domain name alone. To the best of our knowledge, CharBot is the simplest and most efficient black-box adversarial attack against DGA classifiers proposed to date.

show abstract

PassGAN: A Deep Learning Approach for Password Guessing

Cited by 6 publications

References 0 publications

Deep Learning in Mobile and Wireless Networking: A Survey

Deep Learning in Mobile and Wireless Networking: A Survey

PassGAN: A Deep Learning Approach for Password Guessing

CharBot: A Simple and Effective Method for Evading DGA Classifiers

Contact Info

Product

Resources

About