Password Guessing Based on GAN with Gumbel-Softmax

Abstract

Password guessing is an important issue in user security and privacy protection. Using generative adversarial network (GAN) to guess passwords is a new strategy emerging in recent years, which exploits the discriminator’s evaluation of passwords to guide the update of the generator so that password guessing sets can be produced. However, the sampling process of discrete data from a categorical distribution is not differentiable so that backpropagation does not work well. In this paper, we propose a novel password guessing model named G-Pass, which consists of two main components. The first is a new network structure, which modifies the generator from the convolutional neural network (CNN) to long short-term memory- (LSTM-) based network and employs multiple convolutional layers in the discriminator to provide more informative signals for generator updating. The second is Gumbel-Softmax with temperature control for training GAN on passwords. Experimental results show the proposed G-Pass outperforms PassGAN in password quality and cracking rate. Moreover, by dynamically adjusting one parameter during the training process, a trade-off between sample diversity and quality can be achieved with our proposed model.

A Systematic Review on Password Guessing Tasks

“…To address the problem of non-differentiability of the password discrete data sampling process, works [ 44 , 45 ] used Gumbel-Softmax [ 46 ] relaxation technique to train the GAN-based password guessing model. In addition, an alternative solution is provided in the work [ 44 ], which uses a smooth representation of the real password obtained by an additional autoencoder.…”