Pos-PCFG: A Password Guessing Method Incorporating Character Positions

Due to its easy-to-use characteristic, passwords are still the main way to authenticate a person online. However, as the increasing number of websites, users now often come across the issues of password overload. Such repeated use of one's passwords or choosing simple passwords such as names or dates could lead to serious security risks. Password-guessing simulations could effectively prevent these vulnerabilities. Nowadays, most modern websites request passwords with special characters to enhance their complexity. This study emphasizes the special characters within passwords. By using t-SNE visualization and KL divergence, we have analyzed the distribution of these characters among different passwords visually and quantitatively. As the result shows, special characters present a unique distribution mode in t-SNE visualization, with a higher KL divergence value than alphabetic and digit segments. Based on our findings, a password-guessing approach that classified the special character segments into four types according to the position named the Pos-PCFG model has been proposed. The model has improved the guessing accuracy of multiple datasets. In the Rockyou dataset test, accuracy was achieved with a notable 0.98% increase when guessing passwords consisting of special characters.