# Machine-Learning-Based Password-Strength-Estimation Approach for Passwords of Lithuanian Context
## 3 The Proposed Approach and Data Preparation  
### Password-Strength Dataset  
As the focus of the research is to estimate the strength of a password specifically in a Lithuanian context, two datasets were constructed and later combined into one used to train models. One is a password dataset taken from international-context passwords and the other from Lithuanian-context passwords. This is because Lithuanian users can use both English and Lithuanian words in their passwords. To build the Lithuanian-context password dataset, the part of passwords that belongs to the most used passwords list in Lithuanian, prepared by [PERSON] [26], has been taken. The primary list of the most common Lithuanian passwords consists of approximately 500,000 passwords, but in this experimental research, only a part of the list has been used, approximately 110,000. The main reason is that the full Lithuanian password list presented by [PERSON] [26] contains English passwords, and also, there are many passwords that have been formed by random characters, so it is not possible to understand the context of passwords; it is obvious as the passwords are not word-based. Regarding this problem, the password list has been manually reviewed, eliminating the English-language-word-based passwords and other noise found in the dataset. It was important to keep only unequivocally Lithuanian-context passwords. In the case of Lithuanian-context passwords, the dataset is not labeled; it is a plain list of passwords, with no password-strength labels assigned to it. The dataset of international-context passwords used in this experimental investigation is taken from [PERSON] [24]. The dataset has been chosen because it is well known and widely used in various related works. The full dataset contains a total of almost 700,000 passwords. It is important to maintain the balance between the Lithuanian- and international-password dataset subsets, so the same number of passwords (approximately 110,000) has been randomly chosen. All passwords in the international dataset have initially been assigned to one of three classes (0-weak, 1-medium, 2-strong). Later, in the next steps of the research, both datasets were combined into one, labeled, and used in experimental investigation. As we can see in Figure 1, only the passwords from the two datasets (international and Lithuanian) are labeled using a password-strength meter (zxcvbn) to measure the strength of the password. In Section 3.2, the description of the labeling process is presented in more detail. For international data, it was decided that zxcvbn is suitable for measuring password strength, as it takes into account many different English dictionaries (Table 1) and is effective according to related works. For the Lithuanian dataset, a modified version of the zxcvbn model is applied. The modifications applied to zxcvbn aim to take into account the morphological complexities that make up Lithuanian words (the four similarity measures have been used to find the similarity between the input password and one of the dictionaries). Once the passwords are labeled, the password features are extracted. These features include the maximum similarity of each dictionary used in the tool and four different similarity functions to compare. In addition, it includes simple password features, such as password length,number of lowercase and uppercase characters, digits, and special symbols in a password. Finally, the password dataset is combined into one. The combined dataset is used for machine learning methods to predict password strength. There is no automated method to detect whether the password has been written in the Lithuanian language, so a machine-learning-based approach is needed (the accuracy of the password language estimation was executed, but the accuracy was very limited and not suitable for practical application). The principle of the proposed approach is presented in the following steps (Figure 2).