{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T01:30:31Z","timestamp":1760059831095,"version":"build-2065373602"},"reference-count":24,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2025,7,15]],"date-time":"2025-07-15T00:00:00Z","timestamp":1752537600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Sichuan Science and Technology Program","award":["2025ZNSFSC1479","2023YFG0264"],"award-info":[{"award-number":["2025ZNSFSC1479","2023YFG0264"]}]},{"name":"Science and Technology Program of Sichuan Province, China","award":["2025ZNSFSC1479","2023YFG0264"],"award-info":[{"award-number":["2025ZNSFSC1479","2023YFG0264"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>As a crucial component of account protection system evaluation and intrusion detection, the advancement of password guessing technology encounters challenges due to its reliance on password data. In password guessing research, there is a conflict between the traditional models\u2019 need for large training samples and the limitations on accessing password data imposed by privacy protection regulations. Consequently, security researchers often struggle with the issue of having a very limited password set from which to guess. This paper introduces a small-sample password guessing technique that enhances cross-domain features. It analyzes the password set using probabilistic context-free grammar (PCFG) to create a list of password structure probabilities and a dictionary of password fragment probabilities, which are then used to generate a password set structure vector. The method calculates the cosine similarity between the small-sample password set B from the target area and publicly leaked password sets Ai using the structure vector, identifying the set Amax with the highest similarity. This set is then utilized as a training set, where the features of the small-sample password set are enhanced by modifying the structure vectors of the training set. The enhanced training set is subsequently employed for PCFG password generation. The paper uses hit rate as the evaluation metric, and Experiment I reveals that the similarity between B and Ai can be reliably measured when the size of B exceeds 150. Experiment II confirms the hypothesis that a higher similarity between Ai and B leads to a greater hit rate of Ai on the test set of B, with potential improvements of up to 32% compared to training with B alone. Experiment III demonstrates that after enhancing the features of Amax, the hit rate for the small-sample password set can increase by as much as 10.52% compared to previous results. This method offers a viable solution for small-sample password guessing without requiring prior knowledge.<\/jats:p>","DOI":"10.3390\/e27070752","type":"journal-article","created":{"date-parts":[[2025,7,15]],"date-time":"2025-07-15T11:52:58Z","timestamp":1752580378000},"page":"752","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Cross-Domain Feature Enhancement-Based Password Guessing Method for Small Samples"],"prefix":"10.3390","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-3410-7262","authenticated-orcid":false,"given":"Cheng","family":"Liu","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China"},{"name":"No. 30 Institute of CETC, Chengdu 610041, China"},{"name":"National Key Laboratory of Security Communication, Chengdu 610041, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-4095-1094","authenticated-orcid":false,"given":"Junrong","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer and Software Engineering, Xihua University, Chengdu 610039, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiheng","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer and Software Engineering, Xihua University, Chengdu 610039, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3345-8339","authenticated-orcid":false,"given":"Bo","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer and Software Engineering, Xihua University, Chengdu 610039, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5283-7318","authenticated-orcid":false,"given":"Mengsu","family":"Hou","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China"},{"name":"School of Big Data and Artificial Intelligence, Chengdu Technological University, Chengdu 611730, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6740-0485","authenticated-orcid":false,"given":"Wei","family":"Yu","sequence":"additional","affiliation":[{"name":"No. 30 Institute of CETC, Chengdu 610041, China"},{"name":"National Key Laboratory of Security Communication, Chengdu 610041, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yujun","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-9240-5484","authenticated-orcid":false,"given":"Wenjun","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer and Software Engineering, Xihua University, Chengdu 610039, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"550","DOI":"10.1109\/TDSC.2015.2481884","article-title":"Zero-Sum Password Cracking Game: A Large-Scale Empirical Study on the Crackability, Correlation, and Security of Passwords","volume":"14","author":"Ji","year":"2017","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"102848","DOI":"10.1016\/j.cose.2022.102848","article-title":"#Segments: A Dominant Factor of Password Security to Resist against Data-driven Guessing","volume":"121","author":"Wang","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Su, X., Zhu, X., Li, Y., Li, Y., Chen, C., and Esteves-Ver\u00edssimo, P. (2024, January 24\u201327). PagPassGPT: Pattern Guided Password Guessing via Generative Pretrained Transformer. Proceedings of the 2024 54th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), Brisbane, Australia.","DOI":"10.1109\/DSN58291.2024.00049"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Deng, G., Yu, X., and Guo, H. (2019, January 9\u201313). Efficient Password Guessing Based on a Password Segmentation Approach. Proceedings of the 2019 IEEE Global Communications Conference (GLOBECOM), Waikoloa, HI, USA.","DOI":"10.1109\/GLOBECOM38437.2019.9013139"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Xie, J., Cheng, H., Zhu, R., Wang, P., and Liang, K. (2022, January 22\u201327). WordMarkov: A New Password Probability Model of Semantics. Proceedings of the 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Singapore.","DOI":"10.1109\/ICASSP43922.2022.9746203"},{"key":"ref_6","first-page":"67","article-title":"Advances in Password Guessing Research","volume":"11","author":"Zou","year":"2024","journal-title":"J. Cryptogr. (Chin. Engl. Ed.)"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Xie, Z., Shi, F., Zhang, M., Rao, Z., Zhou, Y., and Ji, X. (2025). Similarities: The Key Factors Influencing Cross-Site Password Guessing Performance. Electronics, 14.","DOI":"10.3390\/electronics14050945"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Wang, D., Zhang, Z., Wang, P., Yan, J., and Huang, X. (2016, January 24\u201328). Targeted Online Password Guessing: An Underestimated Threat. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), Vienna, Austria.","DOI":"10.1145\/2976749.2978339"},{"key":"ref_9","first-page":"1","article-title":"Research on a Password Guessing Model Based on Topic PCFG","volume":"8","author":"Bi","year":"2019","journal-title":"Inf. Netw. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Gan, X., Chen, M., Li, D., Wu, Z., Han, W., and Chen, H. (2021, January 17\u201319). Corpora-based Password Guessing: An Efficient Approach for Small Training Sets. Proceedings of the 2021 IEEE 4th International Conference on Electronics and Communication Engineering (ICECE), Xi\u2019an, China.","DOI":"10.1109\/ICECE54449.2021.9674437"},{"key":"ref_11","unstructured":"Chen, M. (2022). Research and Application of Password Guessing Rule Extension Method. [Master\u2019s Thesis, South China University of Technology]."},{"key":"ref_12","first-page":"2708","article-title":"Parametric Mixed Password Guessing Method","volume":"59","author":"Han","year":"2022","journal-title":"Comput. Res. Dev."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Hitaj, B., Gasti, P., Ateniese, G., and Perez-Cruz, F. (2019, January 5\u20137). Passgan: A deep learning approach for password guessing. Proceedings of the 17th International Conference on Applied Cryptography and Network Security, ACNS 2019, Bogota, Colombia.","DOI":"10.1007\/978-3-030-21568-2_11"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Yu, F., and Martin, M.V. (2022, January 6\u201310). GNPassGAN: Improved generative adversarial networks for trawling offline password guessing. Proceedings of the 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Genoa, Italy.","DOI":"10.1109\/EuroSPW55150.2022.00009"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Rando, J., Perez-Cruz, F., and Hitaj, B. (2023, January 25\u201329). Passgpt: Password modeling and (guided) generation with large language models. Proceedings of the European Symposium on Research in Computer Security, The Hague, The Netherlands.","DOI":"10.1007\/978-3-031-51482-1_9"},{"key":"ref_16","unstructured":"Geng, Y. (2022). Research on Small Sample Password Set Guessing Model Based on Multi-Task Learning. [Master\u2019s Thesis, Xi\u2019an University of Electronic Science and Technology]."},{"key":"ref_17","unstructured":"Melicher, W., Ur, B., Segreti, S.M., Komanduri, S., Bauer, L., Christin, N., and Cranor, L.F. (2016, January 10\u201312). Fast, lean, and accurate: Modeling password guessability using neural networks. Proceedings of the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA."},{"key":"ref_18","unstructured":"Wang, D., Zou, Y., Xiao, Y.-A., Ma, S., and Chen, X. (2023, January 9\u201311). Pass2Edit: A Multi-Step Generative Model for Guessing Edited Passwords. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA."},{"key":"ref_19","unstructured":"Yu, H. (2023). Research on Password Guessing Model Based on Digital Semantics. [Master\u2019s Thesis, East China Normal University]."},{"key":"ref_20","unstructured":"(2025, March 15). Tianya, China\u2019s Biggest Online Forum 40 Million Users Data Leaked [EB\/OL]. (2011-12). Available online: https:\/\/thehackernews.com\/2011\/12\/tianya-chinas-biggest-online-forum-40.html."},{"key":"ref_21","unstructured":"(2025, March 15). Train Ticket Website Leaks User Info [EB\/OL]. Available online: https:\/\/www.globaltimes.cn\/content\/898706.shtml."},{"key":"ref_22","unstructured":"Taylor, C. (2025, March 15). Twitch Resets All User Passwords After Suffering Data Breach [EB\/OL]. Available online: https:\/\/techcrunch.com\/2015\/03\/23\/twitch-passwords-data-breach-hack\/."},{"key":"ref_23","unstructured":"(2025, March 15). Twitter Data Breach and 10 Billion Password Leak Details [EB\/OL]. Available online: https:\/\/www.cybersecurity-insiders.com\/twitter-data-breach-and-10-billion-password-leak-details\/."},{"key":"ref_24","unstructured":"(2025, March 15). Hackers Steal 6 Million User Accounts for Cash-for-Surveys Site [EB\/OL]. Available online: https:\/\/www.vice.com\/en\/article\/hackers-steal-6-million-user-accounts-for-cash-for-surveys-site\/."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/27\/7\/752\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:09:47Z","timestamp":1760033387000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/27\/7\/752"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,15]]},"references-count":24,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["e27070752"],"URL":"https:\/\/doi.org\/10.3390\/e27070752","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2025,7,15]]}}}