Makine öğrenmesi teknikleri ile yeni olası şifreler üreterek şifre sözlüklerinin genişletilmesi

By using username and password combinations, online accounts are protected. Passwords provide protection against unauthorized access to a user's accounts and personal information, such as bank account information, purchase history, or home address. The stronger the password, the more protected account of users will be from hackers and malicious software. For this reason, users should maintain solid passwords for all accounts on their systems. A weak password is one that is easy to guess by performing a brute force attack utilizing a subset of all possible passwords, including words in the dictionary, proper names, and words derived from user names. In addition, they are short, common, or system default passwords. Any hack has a significant role played by weak passwords. Applications may not always require strong passwords for the ease of the user, which leads to users using weak passwords like password, password123, Password@123, 123456, their own mobile number, etc. A weak password might also be one that is easy to guess and doesn't always refer to length and character usage. For example, Gorkem@12345 appears to be a complicated password, but it is predictable. Weak passwords include those that contain the user's name, address, or phone number. While creating the passwords, users should use random strings with special characters and their length shouldn't be too short because weak passwords can be brute-forced by attackers or be predictable if their length is too short. Although it may be challenging to remember, that is actually quite secure from a security standpoint. If a password contains daily life phrases it is called a weak password. This is due to the fact that they are mostly predictable and can be attacked by dictionary attacks. A password dictionary is a list of possible passwords. When an attacker obtains the hash of a password from a compromised password database, they can compare the hash of all the passwords in a dictionary to an obtained hash value and if a match is found, the password that corresponds to the hash value is found. This is called a dictionary attack. After leaked passwords were analyzed, it was found that the most commonly used passwords were simple dictionary words, and the most common method to crack password hashes was dictionary attacks. People tend to create passwords that are easy to remember, so they choose common phrases that are used in daily life which usually exist in password dictionaries. The password dictionaries, also known as Wordlists are used to crack passwords and they consist of real password dumps from leaked databases, such as rockyou.txt. Others are taken from larger dumps of millions of passwords and resulted in the most commonly reoccurring items. Here are some of the more important wordlists for generic password cracking, such as SecLists, WordList-Compendium, Kaonashi, Crackstation Wordlist Password Cracking Dictionary, RockYou and Top-WPA-Probable. When performing a dictionary attack, the more and more likely the existing passwords in the wordlist used by the attacker are, the more likely the hacked password is to be cracked. In this thesis work, we tried to build classified worldlists such as machine-like-generated or human-like-generated in order to use those wordlists while dictionary attacks are performed and take the password-cracking to the next level. Enriched wordlists are created using machine learning and deep learning methods, especially LSTM(RNN) method. In this project, it is concentrated on expanding the existing password dictionary lists using machine learning techniques, combining existing password phrases with other permutations, and developing more potential passwords that a user could construct. High-accuracy passwords that the user can create are generated and new wordlists are built, after classifying operation of whether the password generated is machine-like generated or user-like-generated. Due to the fact that people tend to create passwords that are easy to remember and they choose common phrases that are used in daily life, In this way, it is investigated that it is possible to perform more powerful attacks by enriching the wordlist by utilizing human-like classified passwords. The goal of the thesis is to create enriched dictionaries after generating potential logical passwords that the user might construct in the future in order to increase the capacity of the dictionary attacks. By giving password dictionary attacks additional power in this investigation, it will be feasible to demonstrate that dictionary attacks are actually more effective than previously believed. In the machine learning literature, a common method suitable for our aim is RNN(LSTM). So that, Recurrent Neural Networks (RNN) is used as one of the Machine Learning techniques. As Recurrent Neural Network (RNN) architecture, Long Short-Term Memory (LSTM) is utilized in this work. Moreover, In this thesis, we consider the following question: Can we enrich a password dictionary by analyzing the existing passwords and adding new ones after password classification operation, by using machine-learning techniques? By empowering the password dictionaries using that way, it will be possible that dictionary attacks can actually be made more effective than previously thought.