Enhancing password security with honeywords and LLMs

Abstract

The increasing sophistication of cyber threats has amplified the need for innovative solutions to secure authentication systems. Honeywords, disguised credentials designed to detect unauthorized access, play a crucial role in cybersecurity by serving as early warning mechanisms. However, traditional honeyword generation methods often struggle with high false-positive and False-Negative Probability, limiting their effectiveness against advanced attackers. This study explores the integration of Large Language Models (LLMs) into password and honeyword generation systems. Leveraging LLMs’ natural language processing capabilities, we propose a novel framework for creating secure, user-friendly passwords and realistic honeywords. Our approach introduces multi-word, context-aware decoy generation, enhancing the indistinguishability of honeywords from genuine credentials. Empirical evaluations demonstrate significant improvements in performance metrics. Our model achieves a false negative probability ($FNP\left(B\right)$) of 0.33944, outperforming existing methods such as the Tweaking Path Model (0.54), the Deep Tweak Model (0.56), and the Chunk-Level GPT3 (0.58). Furthermore, it achieves a near-perfect false positive probability ($FPP\left(A\right)$) of $<$0.01, surpassing all compared algorithms. This research highlights the transformative potential of LLMs in enhancing authentication security. By addressing the limitations of traditional honeyword systems and introducing scalable, customizable solutions, this work contributes to the development of next-generation robust cybersecurity frameworks capable of countering evolving threats.