Zipf's Law in Passwords
Zipf's Law in Passwords
复制标题
齐普夫密码定律
DOI：
10.1109/tifs.2017.2721359
复制
发表时间：
2017-11-01
影响因子：
6.8
通讯作者：
Jian, Gaopeng
中科院分区：
文献类型：
--
作者：
Wang, Ding;Cheng, Haibo;Jian, Gaopeng
尽管三十年的密集研究工作，它仍然是一个悬而未决的问题，什么是用户生成的密码的潜在分布。在本文中，我们朝着理解这个基本问题迈出了实质性的一步。通过引入一些计算统计技术，并基于14个大规模数据集，其中包括1.133亿个真实世界的密码，我们首次提出了两个Zipf类模型（即，PDF-Zipf和CDF-Zipf）来表征密码的分布。更具体地说，我们的PDF-Zipf模型可以很好地拟合流行的密码，并获得大于0.97的决定系数;我们的CDF-Zipf模型可以很好地拟合整个密码数据集，经验分布与拟合的理论模型之间的最大累积分布函数（CDF）偏差为0.49%相似于4.59%（平均1.85%）。结合密码分布的具体知识，我们提出了一种新的度量密码数据集强度的方法。大量的实验结果表明，所提出的Zipf类模型和安全度量的有效性和普遍适用性。
Despite three decades of intensive research efforts, it remains an open question as to what is the underlying distribution of user-generated passwords. In this paper, we make a substantial step forward toward understanding this foundational question. By introducing a number of computational statistical techniques and based on 14 large-scale data sets, which consist of 113.3 million real-world passwords, we, for the first time, propose two Zipf-like models (i.e., PDF-Zipf and CDF-Zipf) to characterize the distribution of passwords. More specifically, our PDF-Zipf model can well fit the popular passwords and obtain a coefficient of determination larger than 0.97; our CDF-Zipf model can well fit the entire password data set, with the maximum cumulative distribution function (CDF) deviation between the empirical distribution and the fitted theoretical model being 0.49%similar to 4.59% (on an average 1.85%). With the concrete knowledge of password distributions, we suggest a new metric for measuring the strength of password data sets. Extensive experimental results show the effectiveness and general applicability of the proposed Zipf-like models and security metric.