关键词: 口令安全, 中文口令, GPT-2模型, 口令猜测, 预训练语言模型

Abstract: As authentication mechanisms diversify, passwords, as a traditional and widely adopted authentication method, face severe security challenges. Due to linguistic characteristics and cultural differences, Chinese users?? password choices differ significantly from those of English-speaking users, providing new perspectives for guessability attacks. To address this issue, this paper proposes a Chinese surname-based password guessing method using the GPT-2 model, aiming to effectively enhance the guessing capability for Chinese passwords. The proposed method employs unsupervised fine-tuning to enable the pre-trained language model to generate passwords closely related to surnames. To compensate for GPT-2??s lack of support for Chinese characters, this model leverages a news corpus as the pre-training dataset, converting Chinese text into Pinyin and training the model to recognize Pinyin, thereby helping the model more accurately understand Chinese users' password habits. Experimental results demonstrate that the proposed model exhibits superior performance in password guessing tasks, particularly in resource-constrained environments, achieving higher success rates compared with traditional guessing methods and deep learning-based password attack techniques. Additionally, this paper explores the impact of temperature parameters on the success rate of password guessing, identifying potential directions for further improving password security.

Key words: password security, Chinese password, GPT-2 model, password guessing, pre-trained language model