迷失于披露：关于密码组成策略的推断
Lost in Disclosure: On The Inference of Password Composition Policies
AI总结：
本文针对从泄露密码数据推断密码组成策略的问题，指出朴素方法的不足，提出一种更可靠的简单方法，并实现工具 pol-infer 以验证其有效性。
摘要：
大规模密码数据泄露事件日益普遍，这使得研究人员能够利用真实世界的密码数据集开展大量密码安全研究，这些数据集通常包含数千万甚至数亿条记录。虽然已有大量研究关注密码组成策略（用户创建密码时必须遵守的规则集）如何影响系统上用户所选密码的分布，但关于推断给定一组用户所选密码是在何种密码组成策略下创建的研究却少得多。在本文中，我们阐述了采用朴素方法解决这一挑战时存在的问题，并提出了一种能够产生更可靠结果的简单方法。我们还介绍了 pol-infer，一个实现该方法的工具，并展示了其在推断密码组成策略方面的应用。
英文摘要：
Large-scale password data breaches are becoming increasingly commonplace, which has enabled researchers to produce a substantial body of password security research utilising real-world password datasets, which often contain numbers of records in the tens or even hundreds of millions. While much study has been conducted on how password composition policies (sets of rules that a user must abide by when creating a password) influence the distribution of user-chosen passwords on a system, much less research has been done on inferring the password composition policy that a given set of user-chosen passwords was created under. In this paper, we state the problem with the naive approach to this challenge, and suggest a simple approach that produces more reliable results. We also present pol-infer, a tool that implements this approach, and demonstrates its use in inferring password composition policies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
