HoneyGen: Generating Honeywords Using Representation Learning

Abstract

Honeywords are false passwords injected in a database for detecting password leakage. Generating honeywords is a challenging problem due to the various assumptions about the adversary's knowledge as well as users' password-selection behaviour. The success of a Honeywords Generation Technique (HGT) lies on the resulting honeywords; the method fails if an adversary can easily distinguish the real password. In this paper, we propose HoneyGen, a practical and highly robust HGT that produces realistic looking honeywords. We do this by leveraging representation learning techniques to learn useful and explanatory representations from a massive collection of unstructured data, i.e., each operator's password database. We perform both a quantitative and qualitative evaluation of our framework using the state-of-the-art metrics. Our results suggest that HoneyGen generates high-quality honeywords that cause sophisticated attackers to achieve low distinguishing success rates.

Targeted Honeyword Generation with Language Models

“…We choose to use chaffing-by-tweaking instead of other recently proposed methods in the literature because other methods are more vulnerable to targeted attacks, with a typical example mentioned in Section 1.1, and some more examples shown in Table 4. Dionysiou et al [12] highlight the intricacy of developing tweaking rules in such a way that it could be difficult for an attacker to distinguish the password from its changed versions. For example, if a chaffing-by-tweaking strategy randomly perturbs the last three characters of a password, the adversary may easily conclude that the authentic password is the first one in the instances "18!morning", "18!morniey", and "18!gorndge".…”

“…Thus, they replace all occurrences of a particular symbol in a given password with a randomly chosen alternate symbol, lower-case each letter in a password with probability p = 0.3, upper-case each letter in a password with probability f = 0.03, and replace each digit occurrence with probability q = 0.05. [12] contains the pseudocode and rationale for the assignment of p, q, and f . A few examples of honeywords developed by tweaking are included in Table 5.…”

“…Once an attacker obtains users' PII, and if only one sweetword in a user's sweetword list contains the user's PII, it is highly likely that this sweetword is the real password and others are fake. For example, for a sweetword list "liyaodong007, gaby1124, abg71993, australiaisno#1, soloelbambino, k646321102, noviembre9101, blueluna17, usa0858199600, kirsten03" which are generated using the real password "liyaodong007" in the linkedin dataset and the HGT proposed in [12]. In a nutshell, this HGT is first trained on a real password dataset, and it converts all real passwords in the dataset into vectors using a word embedding technique called fasttext.…”

“…For instance, "jones34monkey" is tokenized as "l 5 d 2 l 6 " (a five-letter word followed by two digits and a six-letter word), indicating that some possible honeywords are "apple10laptop, tired93braces, hills28highly". This technique, as outlined in [12], demands considerable modifications on the client-side authentication system, which has a significant impact on usability. Additionally, it is incapable of generating honeywords of varying length or structure, thus limiting the spectrum of possible honeywords.…”

“…Integration of GPT-3 into the operator's system for honeyword production is relatively simple. Unlike other HGTs that require to be trained on a leaked password dataset [12], our HGT only requires the operator to simply incorporate the OpenAI API [3], and give a specific prompt and temperature in the GEN (k, P W i ) command and no training on leaked password is required.…”