Miner malware has been steadily increasing in recent years as the value of cryptocurrency rises, which poses a considerable threat to users’ device security. Miner malware has obvious behavior patterns in order to participate in blockchain computing. However, most miner malware detection methods use raw bytes feature and sequential opcode as detection features. It is difficult for these methods to obtain better detection results due to not modeling robust features. In this paper, a miner malware identification method based on graph classification network is designed by analyzing the features of function call graph and control flow graph of miner malware, called MBGINet. MBGINet can model the behavior graph relationship of miner malware by extracting the connection features of critical nodes in the behavior graph. Finally, MBGINet transforms these node features into the feature vectors of the graph for miner malware identification. In the test experiments, datasets with different volumes are used for simulating real-world scenarios. The experimental results show that the MBGINet method achieves a leading and stable performance compared to the dedicated opcode detection method and obtains an accuracy improvement of 3.08% on the simulated in-the-wild dataset. Meanwhile, MBGINet gains an advantage over the general malware detection method Malconv. These experimental results demonstrate the superiority of the MBGINet method, which has excellent characteristics in adapting to realistic scenarios.

/pdf/cryptocurrency-mining-malware-detection-based-on-behavior-4ic1ifog.pdf

Cryptocurrency Mining Malware Detection Based on Behavior Pattern and Graph Neural Network

To help users create stronger passwords, nearly every respectable web service adopts a password strength meter (PSM) to provide real-time strength feedback upon user registration and password change. Recent research has found that PSMs that provide accurate feedback can indeed effectively nudge users toward choosing stronger passwords. Thus, it is imperative to systematically evaluate existing PSMs to facilitate the selection of accurate ones. In this paper, we highlight that there is no single silver bullet metric for measuring the accuracy of PSMs: For each given guessing scenario and strategy, a speciﬁc metric is necessary. We investigate the intrinsic characteristics of online and ofﬂine guessing scenarios, and for the ﬁrst time , propose a systematic evaluation framework that is composed of four different dimensioned criteria to rate PSM accuracy under these two password guessing scenarios (as well as various guessing strategies). More speciﬁcally, for online guessing , the strength misjudgments of passwords with different popularity would have varied effects on PSM accuracy, and we suggest the weighted Spearman metric and consider two typical attackers: The general attacker who is unaware of the target password distribution, and the knowledgeable attacker aware of it. For ofﬂine guessing , since the cracked passwords are generally weaker than the uncracked ones, and they correspond to two disparate distributions, we adopt the Kullback-Leibler divergence metric and investigate the four most typical guessing strategies: brute-force, dictionary-based, probability-based, and a combination of above three strategies. In particular, we propose the Precision metric to measure PSM accuracy when non-binned strength feedback (e.g., probability) is transformed into easy-to-understand bins/scores (e.g., [weak, medium, strong]). We further introduce a reconciled Precision metric to characterize the impacts of strength misjudgments in different directions (e.g., weak → strong and strong → weak) on PSM accuracy. The effectiveness and practicality of our evaluation framework are demonstrated by rating 12 leading PSMs, leveraging 14 real-world password datasets. Finally, we provide three recommendations to help improve the accuracy of PSMs.

No Single Silver Bullet: Measuring the Accuracy of Password Strength Meters

—Passwords are typically the ﬁrst line of protection in a security system, yet they are also the most vulnerable. The key to ensuring security is to use strong passwords. The security systems encourage users to create strong passwords through password strength estimation. There is no doubt that the existing password strength estimate methods are already very accurate for the identiﬁcation of the weak passwords. However, among the passwords that meet their strong password condition, there are still some misjudged passwords. In this poster, we propose Character Distance Strong Password Checker (CDSPC). Speciﬁcally, Consecutive Lead Character Distance (CLCD) and Average Adjacent Character Distance (AACD) are used in CDSPC. CLCD is the sum of distance between all characters and the ﬁrst character in the password. And AACD is the average value of every two adjacent characters distance in the password. The types of characters contained in the password and the lengths of password are recognized by CLCD, while the permutations of characters in the password are recognized by AACD. In the experiment, CDSPC was able to distinguish a misjudged strong password that had been evaluated as strong password using the password strength evaluation methods LPSE and ZXCVBN.

Poster: The last step of password strength evaluation

Identity authentication is an important line of defense of network security, password has long been the mainstream way of identity authentication, password attack plays an important role in password security research. Probabilistic Context Free Grammar (PCFG) and the Markov chain-based model are the two most effective password attack methods. They can effectively model and describe the password from the substructure composition level and the character dependence level, respectively. This paper first analyzes the various encryption algorithms for cryptographic database, which are currently mainstream, and describes the comparison and strength of these algorithms. Moreover, this paper analyzes the current cipher structure within the password database. At last, this paper briefly describes the current method of password attacks and focuses on three most important methods, including Markov chain, OMEN algorithm and context-independent, to crack the password. This paper discusses the development of these three algorithms in current academic field, including the Recursive-OMEN algorithm based on structure partition and string reorganization, Adam algorithm based on dictionary attack, and genetic algorithm.

Analysis on Password Attack Model and Password Generation

In recent years, unending breaches of users’ personally identifiable information (PII) have become increasingly severe, making targeted password guessing using PII a practical threat. However, to our knowledge, most password strength meters (PSMs) only consider the traditional trawling password guessing threat, and no PSM has taken into account the more severe targeted guessing threat using PII (e.g., name, birthday, and phone number). To fill this gap, in this paper, we mainly focus on targeted password strength evaluation in the scenario where users’ PII is available to the attacker. First, to capture more fine-grained password structures, we introduce the high-frequency substring as a new grammar tag into leading targeted password probabilistic models TarGuess-I and TarMarkov, and propose TarGuess-I-H and TarMarkov-H. Then, we weight and combine our two improved models to devise PII-PSM, the first practical targeted PSM resistant to common PII-accessible attackers. By using the weighted Spearman (WSpearman) metric recommended at CCS’18, we evaluate the accuracy of our PII-PSM and its counterparts (i.e., our TarGuess-I-H and TarMarkov-H, as well as two benchmarks of Optimal and Min_auto). We conduct evaluation experiments on password datasets leaked from eight high-profile English and Chinese services. Results show that our PII-PSM is more accurate than TarGuess-I-H and TarMarkov-H, and is closer to Optimal and Min_auto, with WSpearman differences of only 0.014 $$\sim $$ 0.023 and 0.012 $$\sim $$ 0.031, respectively. This establishes the accuracy of PII-PSM, facilitating to nudge users to select stronger passwords. 

PII-PSM: A New Targeted Password Strength Meter Using Personally Identifiable Information

Password strength meters (PSMs) are being widely used, but they often give conflicting, inaccurate and misleading feedback, which defeats their purpose. Except for fuzzyPSM, all PSMs assume passwords are newly constructed, which is not true in reality. FuzzyPSM considers password reuse, six major leet transformations and initial capitalization, and performs the best as evaluated by Golla and Durmuth at ACM CCS’18. On the basis of fuzzyPSM, we propose a new PSM based on R euse, L eet and S eparation, namely RLS-PSM. First, we classify password reuse behaviors into capitalization and those that use special characters for leet or separation, and calculate the corresponding probabilities. Then, to balance efficiency and precision, we use Long Short-Term Memory to calculate the probabilities of alphanumeric strings. Besides, we propose to use benchmark passwords to show the relative strength of a password. Due to the varied impacts of different service types and diversified economic value of websites, we consider parameter settings of RLS-PSM under six different service types. Finally, we use the Monte Carlo method and weighted Spearman coefficient to measure and compare the robustness and accuracy of RLS-PSM, leading PSMs (including Markov-based PSM, PCFG-based PSM, fuzzyPSM, RNN, and Zxcvbn), and password cracking tools (including JtR and Hashcat). We find that the robustness of RLS-PSM is significantly higher than all counterparts when evaluating attempts > 104 (e.g., on average, Fraction of Successfully Evaluated passwords of RLS-PSM is 18.9% higher than fuzzyPSM). The accuracy of RLS-PSM is also better than other mainstream PSMs used for comparison in this paper, except for fuzzyPSM.

RLS-PSM: A Robust and Accurate Password Strength Meter Based on Reuse, Leet and Separation

A password strength evaluation method based on password reuse, character hopping and separation belongs to the technical field of information security, and comprises the following steps: selecting a password set matched with a scene, and constructing a character conversion dictionary and a password structure dictionary through a fuzzy matching algorithm; restoring the password input by the user into a basic character segment, and recording character conversion and a password structure; calculating a basic character segment construction probability by using a neural network, searching a dictionary for a character conversion and password structure corresponding probability, and performing probability continuous multiplication to obtain a password construction probability; and feeding back the absolute intensity and the relative intensity of the password and candidate passwords which are similar to but sufficiently safe to the user password to the user. User password reuse characteristicsare concluded into capital conversion, character hopping and separation. The neural network is combined with a fuzzy matching algorithm, so that the password strength can be evaluated more accuratelyand robustly. The user knows the strength of the password relative to the passwords of other users through the relative strength, and selects a safer password easy to memorize from the candidate passwords.

Dong Qiying

Papers

RLS-PSM: A Robust and Accurate Password Strength Meter Based on Reuse, Leet and Separation

Password strength evaluation method based on password reuse, character hopping and separation