# A Deep Learning-Based Password Security Evaluation Model
## 3 Methodology
### Phase 3: Building a Password Evaluation Model with Deep Learning  
A deep learning-based password security evaluation model is built by using the feature data of the password that was built with the above procedure and the label data that includes whether there has been a leak. The model is suitable for low-spec IoT environments, and it must be impossible for an attacker who has obtained the weights and  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature** & **Description** & **Score** \\ \hline LUDS requirement & Combination of uppercase letters, lowercase & 0–4 \\  & letters, numbers, and special symbols & \\ zxcvbn point & List of frequently used passwords & 0–4 \\ Levenshtein distance & Difference between the original letter string & 0–1 \\  & and the comparison letter string & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Password feature data list.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Label** & **Description** \\ \hline
0 & A password that has been leaked one or more times \\
1 & A password that has not been leaked \\ \hline \hline \end{tabular}
\end{table}
Table 2: Password label data list.  
structures of the trained model to analyze any information. Therefore, a fully connected neural network, which is frequently used to predict results with a simple structure and a small number of operations, is selected. The fully connected neural network is composed of an input layer for inputting the feature data, a hidden layer for performing the actual prediction, and an output layer for outputting the prediction results, as shown in Figure 8.  
The input layer of the password security evaluation model in Figure 8 receives the three pieces of feature data in Table 1 as input. They are used to learn the weights of the hidden layer, and the weights are updated by comparing the password leakage probability that was predicted as the result with whether the password has been leaked, which is the label data. For this, the prediction result of the evaluation model is normalized from 0 to 1, which is the range of the label data. This is solved by applying the sigmoid function to the result that is returned to the output layer.  
In general, the choice of hyperparameters such as the depth, activation function, and optimization function of the hidden layer is important to train an excellent evaluation model with a fully connected neural network. In order to check the accuracy of the trained evaluation model and select a model, the feature data and label data are separated into 70% training data, 20% validation data, and 10% test data as shown in Table 3. In the model training process of Figure 5, the training data and validation data are used to update the weights of the evaluation model and to determine the degree of learning. The trained evaluation model uses the test data to check and determine whether the evaluation model is properly trained.  
To this end, 68,582 passwords that have been leaked and 64,865 passwords that have not been leaked were obtained with the processes in Figures 6 and 7. Based on Table 3, they were classified into 93,415 training data, 26,688 validation data, and 13,344 test data.  
Figure 8: Structure of password evaluation model with deep learning.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Data** & **Separation (\%)** & **Number of Data** \\ \hline Training data & 70 & 93,415 \\ Validation data & 20 & 26,688 \\ Test data & 10 & 13,344 \\ Total & 100 & 133,447 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Data separation for deep learning.