Another way is to use probabilistic graphical models. The paper "Personalized password guessing: A new security threat" addressed this threat several years ago.

https://experts.illinois.edu/en/publications/personalized-pa...