## 3 Password Generation Selection Model
### Password Generation Selection Model
### Principles of Evaluation

The password generation selection instantiation model OMECDN proposed in this chapter belongs to the offline walking password attack model and does not pay attention to specific users and specific identity information. Evaluating the effectiveness of the OMECDN model is used to calculate the hit rate (\(Hit\_rate\)) of the final password set on the test set. The calculation method is shown as

\[Hit\_rate=\frac{Hit}{Testing\_count}*100\% \tag{5}\]

where \(Hit\) is the hit frequency of the generated password set in the test set and \(Testing\_count\) is the number of passwords in the test set. For example, if 100 passwords are generated, 30 will appear in the test set, and there are 1000 passwords in the test set. In this instance, the generated password hit rate is 3%. The experiment also counts the repetition rate (\(Repetition\)) of the PassGAN model. The calculation method of the repetition rate is shown as

\[Repetition\ =\frac{Hit-Hit\_unique}{MaxTry}*100\% \tag{6}\]

where \(Hit\) is the number of hits of the generated password set in the test set, \(Hit\_unique\) is the number of remaining passwords in the hit test set to delete duplicate passwords, and \(MaxTry\) is the maximum number of generated passwords. For example, if 100 passwords

Figure 2: The password choosing procedure of OMECDN. are generated, 50 will appear in the test set, and 20 passwords will remain after the repetition is deleted. The password repetition rate generated in this case is 30%. The OMECDN model method has a password selection process, and the password hit rate (\(Hit\_rate\)) calculation method is calculated as

\[Hit\_rate =\frac{Hit_{\text{GAN-D}}(X)\geq\gamma}{Testing\_count}*100 \tag{7}\]

In contrast to using Equation (5) to calculate the hit rate, OMECDN only considers passwords whose scores in the candidate password set are greater than or equal to the threshold \(\gamma\). This decision was determined from the experiments, and the choice of threshold can continue to preserve the well-performing generation results in OMEN. This will be explained in detail in Section 5. ### Data Preprocessing

The password dataset is preprocessed as follows:

1. Delete repeated passwords in the dataset. 2. Delete passwords containing characters in the illegal character set in the dataset. The legal character set is \"qwertyuiopasdfghiklzxcvbnmQWERTYUI-OPASDFGHJKLZXCVBNM1234567890'1@#5%%%&^0_+=[]|_j^\",_<>/?! \(\backslash\)^\". 3. The PassGAN neural-network model requires 10 characters for the length of the input password sequence; thus, delete passwords with a length greater than 10 in the dataset. 4. Disrupt the sequence of passwords in the dataset. 5. After processing the dataset according to the above process, divide each dataset into a training set and a test set according to the ratio of 4:1. ### Environment and Dataset

The experimental software and hardware environment are shown in Table 1.

A total of four leaked password datasets were collected. Table 2 summarizes the number of passwords contained in these leaked password datasets and the source of the password sets. ### Features of OMEN Model

According to the content described in Section 3, we fed the Rockyou training set to the OMEN model for learning. After the N-gram sequence level value was counted, we used \begin{table}
\begin{tabular}{c l} \hline Operating system & Microsoft Windows 10.0.18363.1082 \\ CPU & Intel Core i7-9700 CPU @ 3.00 GHz 3.00 GHz \\ GPU & NVIDIA GeForce RTX 2070 SUPER \\ CUDA version & Release 10.1, V10.1,243 \\ Storage & NVMe GALAXY TA1H0240N 240G \\ \hline \end{tabular}
\end{table} 
Table 1: Hardware and software environment. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset Name** & **Passwords** &
\begin{tabular}{c} **De-Duplicated** \\ **Passwords** \\ \end{tabular} & **Source** \\ \hline Yahoo & 453,492 & 342,515 & Raidforums \\
12306 & 131,653 & 117,768 & Raidforums \\ CSDN & 6,428,630 & 4,034,934 & Raidforums \\ RockYou & 32,602,881 & 14,344,391 & Skullsecurity 1  \\ \hline \hline \end{tabular}
\end{table}