Achieving Flatness: Honeywords Generation Method for Passwords based on user behaviours

Abstract

Honeywords (decoy passwords) have been proposed to detect attacks against hashed password databases. For each user account, the original password is stored with many honeywords in order to thwart any adversary. The honeywords are selected deliberately such that a cyber-attacker who steals a file of hashed passwords cannot be sure, if it is the real password or a honeyword for any account. Moreover, entering with a honeyword to login will trigger an alarm notifying the administrator about a password file breach. At the expense of increasing the storage requirement by 24 times, the authors introduce a simple and effective solution to the detection of password file disclosure events. In this study, we scrutinise the honeyword system and highlight possible weak points. Also, we suggest an alternative approach that selects the honeywords from existing user information, a generic password list, dictionary attack, and by shuffling the characters. Four sets of honeywords are added to the system that resembles the real passwords, thereby achieving an extremely flat honeywords generation method. To measure the human behaviours in relation to trying to crack the password, a testbed engaged with by 820 people was created to determine the appropriate words for the traditional and proposed methods. The results show that under the new method it is harder to obtain any indication of the real password (high flatness) when compared with traditional approaches and the probability of choosing the real password is 1/k, where k = number of honeywords plus the real password.

Honeyword Generation Using a Proposed Discrete Salp Swarm Algorithm

“… Population size (population of salps) n: The proposed SSA experimented with many population sizes (20,40,60,80), with the size (80) being chosen as the generation size because the number of individuals suited the algorithm procedures. -We hereby confirm that all the Algorithms and Tables in the manuscript are ours.…”

A Scrutiny of Honeyword Generation Methods: Remarks on Strengths and Weaknesses Points

“…A k i f et al [50] suggested an alternative method that generates honeywords by using four techniques. As a consequence, four sets of honeywords are introduced to the system that seems like actual passwords.…”

“…For example, AAAAA ABCDD Remark 32. Choosing a tail issue On: Dictionary attack method [50], this method does not always generate honeywords because some passwords cannot be found in a dictionary attack.…”

A Proposed Harmony Search Algorithm for Honeyword Generation

“…H (password|r) will be saved in the system's password file. (v) In [19], Akif et al suggest a new honeyword generation approach that includes all four ways. As a consequence, the system received four groups of honeywords that are generated from the following: (1) Existing user information: Creating data with two sections of public personal questions.…”