Machine-Learning-Based Password-Strength-Estimation Approach for Passwords of Lithuanian Context
Source abstract
Abstract
In an information-security-assurance system, humans are usually the weakest link. It is partly related to insufficient cybersecurity knowledge and the ignorance of standard security recommendations. Consequently, the required password-strength requirements in information systems are the minimum of what can be done to ensure system security. Therefore, it is important to use up-to-date and context-sensitive password-strength-estimation systems. However, minor languages are ignored, and password strength is usually estimated using English-only dictionaries. To change the situation, a machine learning approach was proposed in this article to support a more realistic model to estimate the strength of Lithuanian user passwords. A newly compiled dataset of password strength was produced. It integrated both international- and Lithuanian-language-specific passwords, including 6 commonly used password features and 36 similarity metrics for each item (4 similarity metrics for 9 different dictionaries). The proposed solution predicts the password strength of five classes with 77% accuracy. Taking into account the complexity of the accuracy of the Lithuanian language, the achieved result is adequate, as the availability of intelligent Lithuanian-language-specific password-cracking tools is not widely available yet.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: User Authentication and Security Systems · Information and Cyber Security · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Fundamental Science, Vilnius Gediminas Technical University, Saulėtekio Al. 11, LT-10223 Vilnius, Lithuania
References (33)
Show source-provided references
1. A robust approach for privacy data protection: IoT security assurance using generative adversarial imitation learning10.1109/JIOT.2021.3128531 ↗
2. The impact of GDPR on global technology development
3. Towards a method for data protection impact assessment: Making sense of GDPR requirements
4. Haghshenas, S.H., Hasnat, M.A., and Naeini, M. (2023, January 16–19). A temporal graph neural network for cyber attack detection and localization in smart grids. Proceedings of the 2023 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), Washington, DC, USA.10.1109/ISGT51731.2023.10066446 ↗
5. Inayat, U., Zia, M.F., Mahmood, S., Khalid, H.M., and Benbouzid, M. (2022). Learning-based methods for cyber attacks detection in IoT systems: A survey on methods, analysis, and future prospects. Electronics, 11.10.3390/electronics11091502 ↗
6. Rastenis, J., Ramanauskaitė, S., Suzdalev, I., Tunaitytė, K., Janulevičius, J., and Čenys, A. (2021). Multi-Language spam/Phishing classification by Email Body text: Toward automated security Incident investigation. Electronics, 10.10.3390/electronics10060668 ↗
7. Čeponis, D., and Goranin, N. (2021). Investigation of dual-flow deep learning models LSTM-FCN and GRU-FCN efficiency against single-flow CNN models for the host-based intrusion and malware detection task on univariate times series data. Appl. Sci., 10.10.3390/app10072373 ↗
8. Human factor, a critical weak point in the information security of an organization’s Internet of things10.1016/j.heliyon.2021.e06522 ↗
9. A review of authentication methods
10. Yang, W., Wang, S., Hu, J., Zheng, G., and Valli, C. (2019). Security and accuracy of fingerprint-based biometrics: A review. Symmetry, 11.10.3390/sym11020141 ↗
11. Gwyn, T., Roy, K., and Atay, M. (2021). Face recognition using popular deep net architectures: A brief comparative study. Fut. Internet, 13.10.3390/fi13070164 ↗
12. Mehrubeoglu, M., and Nguyen, V. (2018, January 12–14). Real-time eye tracking for password authentication. Proceedings of the 2018 IEEE International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA.10.1109/ICCE.2018.8326302 ↗
13. Mahesh, T.R., Ram, M.S., Ram, N.S.S., Gowtham, A., and Swamy, T.N. (2021, January 26–29). Real-Time Eye Blinking for Password Authentication. Proceedings of the International Conference on Intelligent Emerging Methods of Artificial Intelligence & Cloud Computing: Proceedings of IEMAICLOUD 2021, online.10.1007/978-3-030-92905-3_52 ↗
14. Juozapavičius, A., Brilingaitė, A., Bukauskas, L., and Lugo, R.G. (2022). Age and Gender Impact on Password Hygiene. Appl. Sci., 12.10.3390/app12020894 ↗
15. A comprehensive review study of cyber-attacks and cyber security; Emerging trends and recent developments10.1016/j.egyr.2021.08.126 ↗
16. Awad, M., Al-Qudah, Z., Idwan, S., and Jallad, A.H. (2016, January 6–8). Password security: Password behavior analysis at a small university. Proceedings of the 2016 5th International Conference on Electronic Devices, Systems and Applications (ICEDSA), Ras Al Khaimah, United Arab Emirates.10.1109/ICEDSA.2016.7818558 ↗
17. Katsini, C., Fidas, C., Raptis, G.E., Belk, M., Samaras, G., and Avouris, N. (2018, January 21–26). Influences of human cognition and visual behavior on password strength during picture password composition. Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems, Palais des Congrès de Montréal, Canada.10.1145/3173574.3173661 ↗
18. Ur, B., Segreti, S.M., Bauer, L., Christin, N., Cranor, L.F., Komanduri, S., Kurilova, D., Mazurek, M.L., Melicher, W., and Shay, R. (2015, January 12–14). Measuring real-world accuracies and biases in modeling password guessability. Proceedings of the 24th {USENIX} Security Symposium ({USENIX} Security 15), Washington, DC, USA.
19. Golla, M., and Dürmuth, M. (2018, January 15–19). On the Accuracy of Password Strength Meters. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA.10.1145/3243734.3243769 ↗
20. Wheeler, D.L. (2016, January 10–12). zxcvbn: Low-Budget Password Strength Estimation. Proceedings of the 25th USENIX Security, Austin, TX, USA.
21. Adaptation of password strength estimators to a non-english environment —the Czech experience10.1016/j.cose.2020.101757 ↗
22. Enhanced Evaluation Model of Security Strength for Passwords Using Integrated Korean and English Password Dictionaries
23. Sarkar, S., and Nandan, M. (2022, January 8). Password Strength Analysis and its Classification by Applying Machine Learning Based Techniques. Proceedings of the 2022 Second International Conference on Computer Science, Engineering and Applications (ICCSEA), Gunupur, India.10.1109/ICCSEA54677.2022.9936117 ↗
24. Bansal, B. (2022, May 25). Password Strength Classifier Dataset. Available online: https://www.kaggle.com/datasets/bhavikbb/password-strength-classifier-dataset.
25. Multi-Class Classification Prediction Model for Password Strength Based on Deep Learning10.33851/JMIS.2023.10.1.45 ↗
26. Mantas Sasnauskas—Lexcor (2023, May 25). LT-SecList: Lithuanian Passwords, Wordlists. GitHub. Available online: https://github.com/lexcor/LT-SecList.
27. Most Common Last Names in Lithuania (2023, May 25). Forebears. Available online: https://forebears.io/lithuania/surnames.
28. Most Popular First Names in Lithuania (2023, May 25). Forebears. Available online: https://forebears.io/lithuania/forenames.
29. Singh, A., Thakur, N., and Sharma, A. (2016, January 16–18). A review of supervised machine learning algorithms. Proceedings of the 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India.
30. Sen, P.C., Hajra, M., and Ghosh, M. (2018, January 6–7). Supervised classification algorithms in machine learning: A survey and review. Proceedings of the Emerging Technology in Modelling and Graphics: Proceedings of IEM Graph 2018, Kolkata, India.
31. A survey of deep learning and its applications: A new paradigm to machine learning10.1007/s11831-019-09344-w ↗
32. Xie, Z., Lin, Y., Yao, Z., Zhang, Z., Dai, Q., Cao, Y., and Hu, H. (2021). Self-supervised learning with swin transformers. arXiv.
33. Comparison of Deep Learning Approaches for Lithuanian Sentiment Analysis