發(fā)布時(shí)間：2019-05-27 15:44

【摘要】：通過(guò)對(duì)大規(guī)模的真實(shí)口令數(shù)據(jù)進(jìn)行分析挖掘,獲得若干統(tǒng)計(jì)特征及口令設(shè)置規(guī)則,并將這些統(tǒng)計(jì)特征和規(guī)則成功應(yīng)用于口令的脆弱性評(píng)估及恢復(fù)系統(tǒng).以83 454 724條真實(shí)明文口令為研究對(duì)象,詳細(xì)統(tǒng)計(jì)了它們的長(zhǎng)度、字符種類、組合類型等各項(xiàng)特征,分析了口令和賬號(hào)、郵箱之間的關(guān)系,挖掘了同一個(gè)人的口令在不同網(wǎng)站之間的關(guān)系,并統(tǒng)計(jì)了常用黑客字典對(duì)真實(shí)口令庫(kù)的覆蓋情況,總結(jié)出若干條用戶設(shè)置口令的真實(shí)規(guī)則.在這些規(guī)則和統(tǒng)計(jì)特征的基礎(chǔ)上,提出并設(shè)計(jì)了基于規(guī)則的口令脆弱性評(píng)估算法和口令恢復(fù)系統(tǒng).測(cè)試證明,該文算法計(jì)算的口令強(qiáng)度分?jǐn)?shù)與專家打分的擬合度分別高達(dá)97.4%(誤差小于等于5%)、82.7%(誤差小于等于4%).與共享軟件相比,文中提出的口令恢復(fù)系統(tǒng)成功的概率平均提高了7.5%~66.7%.盡管文中的規(guī)則總結(jié)自中國(guó)口令庫(kù),但其統(tǒng)計(jì)挖掘方法可以適用于國(guó)際口令庫(kù).
[Abstract]:Through the analysis and mining of large-scale real password data, some statistical features and password setting rules are obtained, and these statistical features and rules are successfully applied to password vulnerability assessment and recovery system. In this paper, 83,454724 real plaintext passwords are taken as the research object, their length, character types and combination types are counted in detail, and the relationship between passwords, account numbers and mailboxes is analyzed. This paper excavates the relationship between different websites of the same person's password, counts the coverage of the common hacker dictionary to the real command library, and sums up some real rules for users to set the password. On the basis of these rules and statistical characteristics, a rule-based password vulnerability assessment algorithm and password recovery system are proposed and designed. The test results show that the fitting degree of the password strength fraction calculated by the algorithm is 97.4% (the error is less than or equal to 5%) and the error is 82.7% (the error is less than or equal to 4%). Compared with the shared software, the probability of success of the password recovery system proposed in this paper is 7.5% 鈮，

本文編號(hào)：2486272