SODA ADVANCE: Password Strength Analysis Based on Social Network Data and Large Language Models

1. Introduction

Kalmar sirri ta kasance babbar hanyar kariya daga shiga mara izini, duk da haka, halayen mai amfani sau da yawa suna ba da fifiko ga sauƙin tunawa maimakon tsaro. Masu duba ƙarfin kalmar sirri na al'ada sun dogara ne akan ƙa'idodin nahawu masu tsayi (misali tsayi, nau'ikan haruffa), amma ba su yi la'akari da zaɓin mai amfani ba.Mahallin Ma'ana. Masu amfani sau da yawa suna samun kalmar sirri daga bayanan sirri (kamar suna, ranar haihuwa, abubuwan sha'awa), waɗanda yawancin bayanan yanzu suna samuwa a fili a dandamalin sadarwar zamantakewa.

This paper introducesSODA ADVANCE, a data reconstruction tool that leverages publicly available social network data to assess password strength by extending a module. Furthermore, this paper exploresLarge Language Models's double-edged sword role: as a potential asset for generating strong, personalized passwords and assessing security, and as a significant threat if misused for password cracking.

This research revolves around three key questions: Can Large Language Models generate complex yet memorable passwords based on public data? Can they effectively assess password strength while considering personal information? How does data propagation across multiple networks affect these capabilities?

2. Tsarin SODA ADVANCE

SODA ADVANCE is an evolved version of the SODA tool, specifically designed to assess password vulnerability by reconstructing a user's digital footprint from public sources.

2.1. Tsarin Gini da Sashe-sashe

Tsarin gine-ginen wannan tsarin (kamar yadda aka nuna a hoto na 1 a cikin PDF) ya ƙunshi sassa da yawa da aka haɗa:

Haɗa Bayanai:Masu rarrafe na yanar gizo da kayan aikin ɗaukar bayanai suna tattara bayanan mai amfani masu samuwa a bainar jama'a (bayanin bayanan sirri, sakonnoni, hotuna) daga cibiyoyin sadarwar jama'a da yawa.
Sake Gina da Haɗa Bayanai:Ana haɗa bayanai daga tushe daban-daban don gina cikakken hoton mai amfani. Fasahohi kamar gane fuska na iya danganta hotunan bayanan sirri da wasu shaidun mutum.
Sashen Ƙarfin Kalmar Sirri:O módulo central de análise recebe a senha inserida e o perfil do usuário reconstruído, avaliando a força usando várias métricas.

Descrição do Gráfico (Visão Geral da Figura 1):A figura ilustra um fluxo que começa com a coleta de dados de redes sociais (web crawler/scraper), levando a um módulo de fusão (reconhecimento facial, fusão de dados). O perfil reconstruído (contendo nome, sobrenome, cidade, etc.) e uma senha inserida são enviados a um módulo agregador, que calcula métricas (CUPP, LEET, COVERAGE, FORCE, CPS) e gera uma pontuação de força, visualmente representada por uma balança inclinada para "Sim" ou "Não".

2.2. Ma'auni na Ƙarfin Kalmar Sirri

O SODA ADVANCE adota e estende várias métricas estabelecidas:

CUPP (Common User Password Profiler):Verifica se a senha aparece em dicionários comuns ou padrões associados ao usuário (pontuação 1 se comum, caso contrário, mais baixa).
Leet Language Conversion:Evaluate resistance to simple character substitution (e.g., a→@, e→3). A lower score indicates a higher degree of Leet conversion, suggesting an attempt to obfuscate a weak base word.
COVERAGE:Measures the proportion of user-reconstructed personal data (tokens) contained in the password. High coverage is unfavorable.
FORCE:A composite metric that estimates cracking time based on length, character set, and entropy.

This paper introduces a novelCumulative Password StrengthMetric, it aggregates the scores of the aforementioned methods into a single, comprehensive strength indicator.

3. Manyan Harsunan Model: Matsayi Biyu a cikin Tsaron Kalmar Sirri

This study posits that large language models like GPT-4 represent a paradigm shift, serving as both a powerful tool for defense and a potent weapon for attack.

3.1. Manyan Harsunan Model don Ƙirƙirar Kalmar Sirri

When provided with a user's publicly available profile data, large language models can generate passwords characterized by the following features:

High strength:Incorporating high entropy, length, and character diversity.
Personalized and easy to remember:They can create passwords based on user interests (e.g., generating "OrangeSystem23" for a user named George who likes oranges and has studied system knowledge), making them easier to remember than random strings.
Context-aware:If instructed, they can avoid obvious personal data pitfalls.

This capability affirmatively answers the first research question but also highlights the threat: attackers can use the same technique to generate high-probability password guesses.

3.2. Large Language Models for Password Evaluation

In addition to generation, large language models can also be prompted to evaluate based on user profilesEvaluationAssess the strength of given passwords. They can perform semantic reasoning, identifying non-obvious associations (e.g., "Orange123" might be weak for a user whose favorite basketball team is the Orlando Magic and whose birthday is December 3rd). This contextual evaluation goes beyond traditional rule-based checkers, positively addressing the second research question.

4. Experimental Methodology and Results

4.1. Experimental Setup

The study involved100 real users. Researchers reconstructed their public profiles from social networks. Two main processes were tested:

Passwords generated by large language models:Provide user profiles to the large language model and prompt it to generate "strong yet memorable" passwords.
Passwords evaluated by the large language model:Provide user profiles and a set of candidate passwords (including weak passwords derived from the profiles) to the large language model, and have it rank or score the password strength.

These results were compared with the evaluation results from the metric-based module of SODA ADVANCE.

4.2. Key Findings

Large language model generation success rate

高

The large language model consistently generated passwords that were both strong (high entropy) and contextually personalized for the user.

Kimanta daidaito

Mafi kyau idan aka haɗa da mahallin

A cikin yanayin samar da bayanan hoton mai amfani, manyan harsunan ƙirar sun fi ma'aunin al'ada wajen gano sirrin sirri mai raunin ma'ana.

Tasirin hanyoyin sadarwa da yawa

Bayyananne

Yalwar bayanai da maimaitawa a dandamali da yawa (Facebook, LinkedIn, Instagram) sun haɓaka daidaiton gina SODA ADVANCE da ingancin samarwa/kimanta na manyan harsunan ƙirar sosai.

Gwajin ya nuna cewa, samuwar bayanan sirri a bainar jama'a yana taka muhimmiyar rawa ga kayan aikin tsaro da kuma masu yuwuwar kai hari masu amfani da irin wannan hanyoyin da ke ƙarƙashin jagorancin AI.Mai haɓaka ƙarfiaiki.

5. Technical Analysis and Framework

5.1. Mathematical Formulation

Sabon abuCumulative Password StrengthAn tsara ma'auni na ma'auni a matsayin tarawa mai nauyi na maki da aka daidaita daga kowane ma'auni. Ko da yake ba a yi cikakken bayani game da ainihin tsarin aikin a cikin abin da aka cire ba, ana iya ƙidaya shi kamar haka:

$CPS = 1 - \frac{1}{N} \sum_{i=1}^{N} w_i \cdot S_i$

A cikin:

$N$ shine adadin ma'aunin ma'auni na tushe (misali, CUPP, LEET, COVERAGE, FORCE).
$S_i$ shine maki da aka daidaita na ma'auni $i$ (yawanci 1 yana nuna haɗari mai girma/rauni).
$w_i$ shine nauyin da aka ba wa ma'auni $i$, kuma $\sum w_i = 1$.

Maki na CPS suna kusantar 1 yana nuna kalmar sirri mai ƙarfi. Ana iya ƙirƙira ma'aunin LEET da kansa. Idan $L$ shine tarin canjin Leet (misali, {'a': ['@','4'], 'e': ['3']...}), $P$ shine kalmar sirri, to, matakin canjin Leet $\ell$ zai iya zama:

$\ell(P) = \frac{\text{Adadin haruffan da aka yi amfani da canjin Leet a cikin kalmar sirri } P}{\text{Tsawon kalmar sirri } P}$

$\ell(P)$ mai girma yana nuna cewa kalmar sirri na iya zama sauƙin rikitarwa na kalmar ƙamus kawai.

5.2. Analytical Framework Example

Case Study: Evaluating "GeorgeCali1023"

Input:

Password:"GeorgeCali1023"
Reconstructed Profile: {Name: "George", Surname: "Smith", Education: "University of California", Date of Birth: "1994-01-23", City: "Cagliari"}

Framework Application:

CUPP:Check for "George", "Smith", "California", "Cal". "Cali" is a direct match for the common abbreviation of "California".Score: High Risk (e.g., 0.8)。
LEET:No character substitution (a→@, i→1, etc.).Score: Low Conversion Degree (e.g., 0.1)。
COVERAGE:令牌“George”和“Cali”（来自 California）直接来自画像。“1023”可能衍生自出生月/日（1月23日 -> 1/23）。高覆盖率。Score: High risk (e.g., 0.9)。
FORCE:Length is 13, with mixed uppercase/lowercase letters and numbers. From a purely grammatical perspective, the entropy is quite high.Score: Medium strength (e.g., 0.4 risk)。
Large Language Model Semantic Evaluation:Prompt: "For a user named George Smith, who attended the University of California, and was born on January 23, 1994, how strong is the password 'GeorgeCali1023'?" Large Language Model Output: "Weak. It directly uses the user's name, the abbreviation of their university, and likely their birth month and day. It is easily guessable from publicly available data."

Conclusion:While traditional entropy (FORCE) indicates moderate strength, contextual metrics (CUPP, COVERAGE) and the large language model evaluation all flag it asExtremely Vulnerable, due to its high semantic association with publicly available personal data. This exemplifies the core argument of this paper.

6. Critical Analyst Perspective

Core Insight:This paper successfully highlights a terrifying and unavoidable truth: the era of evaluating passwords in a contextual vacuum is over. Your "strong" password is only as strong as the weakest link in your public digital footprint. SODA ADVANCE formalizes this threat, but the true game-changer is the demonstration that large language models do not merely automate the cracking process—theyUnderstandThis process. This shifts the attack surface from brute-force computation to semantic reasoning, a far more efficient and dangerous paradigm.

Logical Thread:The argument is compelling: 1) Personal data is public (fact), 2) Passwords are derived from personal data (fact), 3) Therefore, public data can crack passwords (confirmed by tools like SODA). 4) Large language models are exceptionally adept at processing and generating language, including personal data and password patterns. 5) Thus, LLMs are the ultimate dual-use technology in this domain. This study clearly validates this thread with empirical data.

Strengths and Weaknesses:

Strengths:Proactive threat modeling. This paper does not merely document a vulnerability; it models the next generation of attack tools (AI-driven, context-aware) before they become mainstream. This is invaluable for defense.
Strengths:Practical validation. Using 100 real users grounds the study in reality, not just theory.
Shortcomings:The opacity of large language models. This paper treats large language models as a black box.Whydoes a large language model consider a password weak? Without explainability, it is difficult to fully trust or integrate it into automated systems. This contrasts with explainable (though simpler) metrics like CUPP or COVERAGE.
Major shortcoming:Ethical and adversarial blind spot. The paper briefly mentions the threat but does not address the significant arms race it implies. If researchers can do this, malicious actors can too—and potentially at a larger scale. The paper offers no mitigation or regulatory considerations for this new threat vector.

Actionable insights:

For the security team:Immediately deprioritize traditional password strength checkers. Invest in or develop tools capable of performing SODA-style reconstruction of public data on executives and key employees to audit their credentials.
For password managers and SaaS providers:Integrate contextual strength checks. Password managers should warn: "This password is very strong, but we found your cat's name 'Whiskers' and birth year '1988' on your public Instagram. Please consider changing it."
For researchers:The urgent next step isAdversarial Large Language Model Reinforcement. Can we train or prompt large language models to generate capabilities thatResistanceThe cipher of its own analytical capabilities? This is similar to the generative adversarial network used in image generation, where the generator and discriminator compete against each other. "Cipher GAN" could be a groundbreaking defense mechanism.
For everyone:This is the final nail in the coffin for passwords as the sole authentication factor. The unstated conclusion of this paper strongly calls for accelerating the adoption of phishing-resistant multi-factor authentication (WebAuthn/FIDO2) and passwordless technologies.

The research by Atzori et al. is a crucial wake-up call. This is not just about better password checkers; it is about recognizing that AI has fundamentally changed the cybersecurity landscape, rendering our past habits and tools dangerously obsolete.

7. Aikace-aikace da Hanyoyi na Gaba

The significance of this study extends far beyond academic interest:

Proactive enterprise security audit:Enterprises can deploy tools like SODA ADVANCE internally to audit employees' password practices based on their professional digital footprints (LinkedIn, company profiles), thereby reducing internal threats and spear-phishing risks.
Integration with Identity and Access Management:Future IAM systems could incorporate a continuous, passive module that monitors changes in employees' public social data and triggers mandatory password resets upon detecting high-risk associations.
AI-Driven, Privacy-Preserving Password Generation:The next evolutionary step involves on-device large language models (e.g., Apple's on-device models), which can generate strong passwords without sending personal data to the cloud, combining AI strength with user privacy.不Federated learning research for large language models, as explored by entities like Google AI, could be directly applied here.
Standardization of Contextual Password Metrics:CPS metrics or their successors may evolve into new standards for high-security environments (beyond NIST guidelines), mandating checks against publicly available information.
Ilimin Karfin Lantarki da Sirri:Wannan binciken ya ba da takamaiman misalai masu gargaɗi ga ilimin jama'a. Nuna yadda wasu sakonnin sada zumunta ke karya sirrin sirri, ya zama ƙarfi mai ƙarfi na hana wuce gona da iri.
Kayan Aikin Bincike da Bincike:Hukumomin tilasta bin doka da ƙwararrun ƙwararrun ɓarna na iya amfani da waɗannan fasahohin a cikin binciken shaidu, don samun damar amfani da na'urorin tsaro ko asusun da hanyoyin gargajiya ba za su iya karya ba, wanda ke haifar da muhimman batutuwan da'a da na shari'a waɗanda ke buƙatar ci gaba tare.

Haɗuwar kayan aikin leken asiri na buɗaɗɗen tushe, fasahohin sake gina bayanai da kuma hanyoyin samar da hankali na wucin gadi suna nuna sabon gaba a fagen tsaro. Nan gaba ba ya cikin ƙirƙirar sirrin sirri mai rikitarwa ba, amma a cikin haɓaka tsarin wayo waɗanda za su iya fahimta da kare alaƙar ma'ana da ba makawa muke fallasa a kan layi.

8. References

Atzori, M., Calò, E., Caruccio, L., Cirillo, S., Polese, G., & Solimando, G. (2025). Password Strength Analysis Through Social Network Data Exposure: A Combined Approach Relying on Data Reconstruction and Generative Models. SEBD 2025 Proceedings.
Author. (Year). SODA: A Data Reconstruction Tool. Related Conference or Journal. (Reference [2] in the PDF).
Author. (Year). On data reconstruction and semantic context. Related Publication. (Reference [3] in the PDF).
Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., & Bengio, Y. (2014). Generative Adversarial Nets. Advances in Neural Information Processing Systems (NeurIPS). (External sources regarding GANs).
Author. (Year). FORCE password metric. Related Publication. (Reference [5] in the PDF).
Author. (Year). LEET speak transformation analysis. Related Publication. (Reference [6] in the PDF).
Author. (Year). COVERAGE metric for passwords. Related Publication. (Reference [7] in the PDF).
National Institute of Standards and Technology (NIST). (2017). Digital Identity Guidelines (SP 800-63B). https://pages.nist.gov/800-63-3/sp800-63b.html (External authoritative source regarding authentication).
Author. (Year). CUPP - Common User Password Profiler. Related Publication. (Reference [9] in the PDF).
Google AI. (2023). Federated Learning and Analytics. https://ai.google/research/teams/federated-learning (External source on privacy-preserving artificial intelligence).