A Comparison Study of Random Forest and Logistic Regression for Password Strength Classification

Abstract

Context: Passwords have become the universal method of authentication due to their
simplicity and compatibility across a wide range of systems. However, due to their
wide-spreadness, they have become vulnerable to external attacks like password cracking.
Users are infamously poor at maintaining entropy in their passwords due to their tendency of
including dictionary words, names, places, dates, keyboard patterns and so on in passwords,
making them predictable. Password strength classifiers developed using machine learning
algorithms like Random Forest (RF) and Logistic Regression (LR) can efficiently prevent
attacks by coercing users to create strong passwords.
Subjects and Methods: In this study, I trained two machine learning models to detect the
strength of different passwords. The two models use Random Forest and Logistic Regression
respectively to classify passwords strengths as 0,1 or 2 with 0 being weak and 2 being
strongest. I tested the model on 669,643 independent passwords retrieved from Kaggle and
evaluated the models’ classification against password standards.
Results: Random Forest has higher prediction accuracy whereas Logistic Regression has
better time performance