Abstract:"Honeywords" have emerged as a promising defense mechanism for detecting data breaches and foiling offline dictionary attacks (ODA) by deceiving attackers with false passwords. In this paper, we propose PassFilter, a novel deep learning (DL) based attack framework, fundamental in its ability to identify passwords from a set of sweetwords associated with a user account, effectively challenging a variety of honeywords generation techniques (HGTs). The DL model in PassFilter is trained with a set of previously collected or adversarially generated passwords and honeywords, and carefully orchestrated to predict whether a sweetword is the password or a honeyword. Our model can compromise the security of state-of-the-art, heuristics-based, and representation learning-based HGTs proposed by Dionysiou et al. Specifically, our analysis with nine publicly available password datasets shows that PassFilter significantly outperforms the baseline random guessing success rate of 5%, achieving 6.10% to 52.78% on the 1st guessing attempt, considering 20 sweetwords per account. This success rate rapidly increases with additional login attempts before account lock-outs, often allowed on many real-world online services to maintain reasonable usability. For example, it ranges from 41.78% to 96.80% for five attempts, and from 72.87% to 99.00% for ten attempts, compared to 25% and 50% random guessing, respectively. We also examined PassFilter against general-purpose language models used for honeyword generation, like those proposed by Yu et al. These honeywords also proved vulnerable to our attack, with success rates of 14.19% for 1st guessing attempt, increasing to 30.23%, 41.70%, and 63.10% after 3rd, 5th, and 10th guessing attempts, respectively. Our findings demonstrate the effectiveness of DL model deployed in PassFilter in breaching state-of-the-art HGTs and compromising password security based on ODA.

Honeyfile Camouflage: Hiding Fake Files in Plain Sight

TSM: Measuring the Enticement of Honeyfiles with Natural Language Processing

Evade Deep Image Retrieval by Stashing Private Images in the Hash Space.

Contextual Chart Generation for Cyber Deception

HoneyModels: Machine Learning Honeypots

Gotta catch 'em all: a Multistage Framework for honeypot fingerprinting

ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent Threats

Understanding Fileless Attacks on Linux-based IoT Devices with HoneyCloud

Reveal the Mathematical Structures of Honeyword Security Metrics

Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques -- An Experiment

Understanding IoT Security with HoneyCloud

LLM in the Shell: Generative Honeypots

Honeyboost: Boosting honeypot performance with data fusion and anomaly detection

Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats

Honey Authentication with Machine Learning Augmented Bright-Field Microscopy

A Security Analysis of Honeywords

Real-Time Emulation Of Intrusion Victim In Honeyfarm

When AI Defeats Password Deception! A Deep Learning Framework to Distinguish Passwords and Honeywords

On the Role of Similarity in Detecting Masquerading Files

Containerized cloud-based honeypot deception for tracking attackers

HoneyBow: an Automated Malware Collection Tool Based on the High-Interaction Honeypot Principle