# Machine-Learning-Based Password-Strength-Estimation Approach for Passwords of Lithuanian Context
## 3 The Proposed Approach and Data Preparation
### Labeling of Dataset Items  
First, the passwords for the international password dataset are newly labeled using the zxcvbn password-strength meter. The main reason is that the original dataset source provides passwords that are assigned just to one of three classes (weak, medium, and strong), and it does not provide a clear view of password strength. Therefore, in our experimental investigation, we added a new label (0-too guessable, 1-very guessable, 2-somewhat guessable, 3-safely unguessable, 4-very unguessable) by using the zxcvbn password-strength meter. The zxcvbn password meter uses five classes and becomes the main source for the initial estimation of the strength of the password. Therefore, the usage of five classes is more in compliance with the existing password-strength systems based on the usage of zxcvbn. The modification made to zxcvbn can be seen in Figure 3, where the tool has an additional text-matching and one additional fragment-scoring element. For the international dataset, the similarity-scoring component is turned off. Text similarity to defined dictionaries is estimated for further dataset feature construction, but the measures do not affect the password-strength score. For Lithuanian-word-based passwords, similarity metric-based scoring is activated. Figure 3: The scheme of the modified zxcvbn password-strength-meter model. Figure 2: The principle of the proposed approach to estimate the strength of Lithuanian passwords. One of the key components of the zxcvbn tool is dictionaries. A total of six default dictionaries are used, and three additional dictionaries are added, reflecting Lithuanian-language-specific information (see Table 1). Additionally, in the modified version of the tool, the similarity of the password to each dictionary item is measured. The similarity is calculated by four different similarity functions: Fuzz, Levenshtein Jaro, Levenshtein Jaro Winkler, and Levenshtein Ratio. Only the most similar word from each dictionary was selected and used for further password-strength estimation. The tool has a structure consisting of text matching, scoring, selecting the weakest combination, setting the cracking time, and a password-strength class. The original version of zxcvbn calculates the password strength based on the place of the string of characters located inside a dictionary: the closer the string is to the beginning of the list, the weaker the password. For the Lithuanian password dataset, the similarity of a string in a dictionary is used as the first criterion, followed by the rank in the dictionary, if necessary. This is relevant for Lithuanian words, as there are so many morphological cases of a word. It would be resource-intensive and close to impossible to have a dictionary of Lithuanian words that includes every possible case of each word that is also ranked as the most common. Only the most similar dictionary item is used for scoring. To get the number of guesses needed for the estimated password, the length of the similar fragment \(L\) must be estimated. It is achieved by taking the shortest of the compared words, password, or dictionary item:  
\[L=\text{min}\ (password,word_{max}) \tag{1}\]  
where \(L\) is the length of the text fragment, which is determined by the shortest length of the evaluated password and the most similar word \(word_{max}\); _password_ is the password in question; and \(word_{max}\) is the maximum similarity of the dictionary item to the password. For scoring, the \(word_{max}\) and appropriate scorings are determined for each dictionary. The next phase of zxcvbn is the estimation of the guesses needed to recover the password, on which the password score is based. To estimate how many guesses \(K\) will be needed to guess the password according to the rules and specifics of the Lithuanian language, an approximate formula was derived (2).