论文标题
Dalock：分发意识到密码节流
DALock: Distribution Aware Password Throttling
论文作者
论文摘要
大规模的在线密码猜测攻击是广泛的，并且不断成为网络安全风险之一。减轻在线破解风险的常见方法是在连续的不正确登录尝试后锁定用户。选择$ k $的价值会引起经典的安全性权衡。当$ k $太大时，黑客可以（迅速）闯入很大一部分的用户帐户，但是当$ k $太低时，我们将在几个错误后将其锁定出来，开始烦恼诚实的用户。通过观察到诚实的用户错误通常看起来与在线攻击者的密码猜测完全不同的动机，我们引入了Dalock a {\ em Distribution Aline}密码锁定机制，以减少用户烦恼，同时最大程度地减少用户风险。顾名思义，Dalock旨在了解用于登录攻击的密码的频率和普及，而标准节流机制（例如，$ k $ -strikes）却忽略了密码分布。特别是，除了（估算）{\ em all}登录尝试的累积概率（估算）的累计概率尝试对该特定帐户的累积概率之外，Dalock还保持了额外的“命中率”。我们通过使用现实世界密码数据集的大量模拟对Dalock进行经验评估。与传统的$ k $ strikes机制相比，我们发现达洛克提供了卓越的安全性/可用性权衡。 For example, in one of our simulations we are able to reduce the success rate of an attacker to $0.05\%$ (compared to $1\%$ for the $10$-strikes mechanism) whilst simultaneously reducing the unwanted lockout rate for accounts that are not under attack to just $0.08\%$ (compared to $4\%$ for the $3$-strikes mechanism).
Large-scale online password guessing attacks are wide-spread and continuously qualified as one of the top cyber-security risks. The common method for mitigating the risk of online cracking is to lock out the user after a fixed number ($K$) of consecutive incorrect login attempts. Selecting the value of $K$ induces a classic security-usability trade-off. When $K$ is too large a hacker can (quickly) break into a significant fraction of user accounts, but when $K$ is too low we will start to annoy honest users by locking them out after a few mistakes. Motivated by the observation that honest user mistakes typically look quite different than the password guesses of an online attacker, we introduce DALock a {\em distribution aware} password lockout mechanism to reduce user annoyance while minimizing user risk. As the name suggests, DALock is designed to be aware of the frequency and popularity of the password used for login attacks while standard throttling mechanisms (e.g., $K$-strikes) are oblivious to the password distribution. In particular, DALock maintains an extra "hit count" in addition to "strike count" for each user which is based on (estimates of) the cumulative probability of {\em all} login attempts for that particular account. We empirically evaluate DALock with an extensive battery of simulations using real world password datasets. In comparison with the traditional $K$-strikes mechanism we find that DALock offers a superior security/usability trade-off. For example, in one of our simulations we are able to reduce the success rate of an attacker to $0.05\%$ (compared to $1\%$ for the $10$-strikes mechanism) whilst simultaneously reducing the unwanted lockout rate for accounts that are not under attack to just $0.08\%$ (compared to $4\%$ for the $3$-strikes mechanism).
