FEPGuesser: Feedback-Information Enhanced Password Guesser Based on Natural Language Pre-Trained Model and VAE

Creating passwords involves a blend of natural language and password-specific knowledge. Merging these feature to obtain better representations and thus enhancing password cracking efficiency, have consistently remained one of the core challenges in the field of password guessing. In this paper, we put forward the Feedback-information Enhanced Password Guesser (FEPGuesser). We demonstrate, for the first time, how Parameter Efficient Fine Tuning can integrate password knowledge, natural language understanding and bidirectional attention mechanisms to well capture semantic in password sets. Additionally, we propose the novel structure of PassExBertVAE which integrates pre-trained model with Variational AutoEncoder (VAE) architecture for password guessing. We devise the algorithm which can make full use of the inherent properties of the password latent space generated by PassExBertVAE. This algorithm simulates real-world attack scenarios by leveraging attack feedback information to enhance cracking effectiveness. Experiments show that FEPGuesser overall achieves better results than PCFG, FLA, OMEN, PassGAN, PassFlow, DPG and VAEPass. Especially, on the most complex 000webhost dataset, FEPGuesser surpasses the latest PCFG model by 8.75 percentage points and exceeds the DPG model based on representation learning by 34.11 percentage points. Furthermore, cross-site attack experiments show that FEPGuesser is more target-adaptive than PCFG and other deep learning models.