GuessFuse: Hybrid Password Guessing With Multi-View

Password guessing is a primary method for password strength evaluation. Despite various password guessing models have been proposed, there is still a significant gap between their guessing effectiveness and the actual cracking capabilities of attackers. Integrating multiple models for password guessing, also known as hybrid password guessing, could better capture the cracking capabilities of real attackers. However, the reason why hybrid password guessing can enhance cracking capabilities, and how to effectively integrate multiple heterogeneous password guessing models, are still not well understood. To address these issues, this paper draws inspiration from the concept of multi-view learning. We regard the guess lists generated by various password guessing models as multiple views of the data. Through a comprehensive analysis of these guess lists, we have identified the key reason why hybrid password guessing can enhance the cracking capabilities: integrating more diverse views allows for the coverage of a wider range of heterogeneous password characteristics, and provides more detailed information on effective password distributions. Based on the findings, we propose a new hybrid password guessing framework, named GuessFuse. GuessFuse employs the multi-view subset extraction module and the segment splitting selection module to accurately extract and reorganize the effective password from diverse guess lists. Experimental results on six large-scale datasets demonstrate the effectiveness of GuessFuse. By combining two (resp. five) guess lists, GuessFuse outperforms its foremost counterparts by an average of 11.00% ~ 59.62% (resp. 4.70% ~ 17.66%) within 107 guesses. GuessFuse can effectively improve the cracking success rate under a limited number of guesses, approaching the actual cracking capabilities of attackers.