## 3 Password Generation Selection Model
### Password Generation Selection Model

Table 2: Leaked password dataset information. the content to generate a candidate password set, where the N-gram sequence values of N are 2, 3, 4, and 5, respectively. The purpose of this experiment is to search for the best N value and calculate the hit rate of the OMEN model on the Rockyou test set. The hit rate is shown in Figure 3.

In the legend in Figure 3, OMEN2 gram indicates that N in the N-gram of the OMEN model is set to 2. Other legends are similar. The experimental results show that, when N in the OMEN model N-gram was 5, the OMEN model had the best hit performance. [PERSON] et al. (2019) argued that password-guessing algorithms based on Markov models are more efficient than PCFG-based guessing algorithms for cracking. For important improvements of the PCFG approach, such as the GENPass (2019) model (PCFG + LSTM (PL) approach), there are no relevant experiments to reproduce the specific process, and thus no comparison with the work in this paper is reflected. ### Features of PassGAN

The PassGAN neural-network model was trained with the same Rockyou training set of the trained ordered Markov enumerator. The experiment changed the maximum character sequence length (Sequence_length) and the number of training rounds (Iterations) for comparison experiments. The hit situation of the PassGAN neural-network model is shown in Figure 4.

In the legend in Figure 4, m10i200000 means that the maximum sequence length (Sequence_length) of the PassGAN neural-network model is 10,

Figure 4: The hits of PassGAN models. Figure 3: The hits of OMEN models. of training rounds (iterations) is 200,000. Other legends are similar. The results show that, when the maximum sequence length of the PassGAN neural-network model is 10, and the maximum number of training rounds is 200,000, the PassGAN neural-network model has the best hit performance. Combining Figures 3 and 4, it can be seen that the PassGAN model hit rate is worse than the OMEN model. One of the reasons is that the PassGAN model generates duplicate passphrases. Therefore, according to Equation (5), the PassGAN model duplication rate is statistically analyzed, and the results are shown in Figure 5.

Combining Figures 4 and 5, the following conclusions are drawn. When the number of training rounds was taken as 400,000 and the maximum character sequence length was 19, the password repetition rate reached 50.60% in the case of \(10^{9}\) generated passwords. The PassGAN model reflects the feature that the password repetition rate increases with the number of generated passwords for seven different parameter cases. However, the performance of the PassGAN model generator does not increase but becomes worse as the number of training rounds and the maximum character sequence length increase, while the repetition rate increases with the number of training rounds. In fact, the best performance of the generator was reached at about 200,000 training rounds, and this decreased as the number of training rounds rose. In the subsequent training, the discriminator has the advantage of obtaining a network with a similar structure to the generator (which better reproduces the distribution of the original dataset) while discarding the function of generating duplicate passphrases. ## 5 Results

Through the preparatory experiments in the previous section, some features in the OMEN model and PassGAN model are verified, which aids in understanding the experiments on OMECDN in this section. Similarly, hit rate test experiments were conducted on OMECDN to observe how OMECDN performs under different datasets and concerning different models, and the conclusions indicate how much superiority OMECDN has compared to the reference experiments. Further, the implications of the threshold selection in OMECDN are analyzed to verify the feasibility of the OMECDN screening process.