A Systematic Review on Password Guessing Tasks-Reference-Cited by-同舟云学术

A Systematic Review on Password Guessing Tasks

Published:2023-09-07 Issue:9 Volume:25 Page:1303
ISSN:1099-4300
Container-title:Entropy
language:en
Short-container-title:Entropy

Author:

Yu Wei¹^ORCID,Yin Qingsong²,Yin Hao¹,Xiao Wei³,Chang Tao⁴,He Liangliang⁵,Ni Lulin¹,Ji Qingbing¹

Affiliation:

1. The 30th Research Institute of China Electronics Technology Group Corporation, Chuangye Road, Chengdu 610093, China

2. Unit 95835 of PLA, Urumqi 841700, China

3. Wuhan Maritime Communication Research Institute, Canglong Avenue, Wuhan 430205, China

4. College of Computer, National University of Defense Technology, Deya Road, Changsha 410003, China

5. Northwest Institute of Mechanical and Electrical Engineering, Biyuan East Road, Xianyang 712000, China

Abstract

Recently, many password guessing algorithms have been proposed, seriously threatening cyber security. In this paper, we systematically review over thirty methods for password guessing published between 2016 and 2023. First, we introduce a taxonomy for classifying the existing methods into trawling guessing and targeted guessing. Second, we present an extensive benchmark dataset that can assist researchers and practitioners in successive works. Third, we conduct a bibliometric analysis to present trends in this field and cross-citation between reviewed papers. Further, we discuss the open challenges of password guessing in terms of diverse application scenarios, guessing efficiency, and the combination of traditional and deep learning methods. Finally, this review presents future research directions to guide successive research and development of password guessing.

Funder

National Defense Science and Technology Key Laboratory Foundation

Publisher

MDPI AG

Subject

General Physics and Astronomy

Link

https://www.mdpi.com/1099-4300/25/9/1303/pdf

Reference96 articles.

1. Wang, D. (2017). Research on Key Issues in Password Security. [Ph.D. Thesis, Peking University].

2. Bonneau, J., Herley, C., van Oorschot, P.C., and Stajano, F. (2012, January 21–23). The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes. Proceedings of the IEEE Symposium on Security and Privacy (SP 2012), San Francisco, CA, USA.

3. Bonneau, J. (2012, January 21–23). The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords. Proceedings of the IEEE Symposium on Security and Privacy (SP 2012), San Francisco, CA, USA.

4. Weippl, E.R., Katzenbeisser, S., Kruegel, C., Myers, A.C., and Halevi, S. (2016, January 24–28). Targeted Online Password Guessing: An Underestimated Threat. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.

5. Li, Y., Wang, H., and Sun, K. (2016, January 10–14). A study of personal information in human-chosen passwords and its security implications. Proceedings of the 35th Annual IEEE International Conference on Computer Communications (INFOCOM 2016), San Francisco, CA, USA.