GENPass: A General Deep Learning Model for Password Guessing with PCFG Rules and Adversarial Generation

Password has become today's dominant method of authentication in social network. While the brute-force attack methods, such as HashCat and John the Ripper, are unpractical, the research then switches to the password guess. The state-of-the-art approaches, such as Markov Model and probabilistic context-free grammars(PCFG), are all based on statistical probability. These approaches have a low matching rate. The methods on neural network have been proved more accurate and practical for password guessing than traditional methods. However, a raw neural network model is not qualified for cross-sites attack since each data set has its own features. This paper proposes a general deep learning model for password guessing, called GENPass. GENPass can learn features from several data sets and ensure the output wordlist high accuracy in different data sets by using adversarial generation. The password generator of GENPass is PCFG+LSTM(PL), where LSTM is a kind of Recurrent Neural Network. We combine neural network with PCFG because we found people were used to set their passwords with meaningful strings. Compared with LSTM, PL increased the matching rate by 16%-30% in the cross-sites tests when learning from a single dataset. GENPass uses several PL models to learn datasets and generate passwords. The result shows that the matching rate of GENPass is 20% higher than that of simply mixing those datasets in the cross-sites test.