Cipher-text Features Based Cipher System Recognition

With the rapid development of computer and communication technologies,more and more data is transferred over the public internet.In recent years,security incidents have occurred frequently,and the concern for information security is increasing.Ciphers play a very important role in modern information every aspect of information security.The analysis and identification of cryptographic algorithms used in a security system have a great theoretical practical application value for evaluating the security of information system,cipher analysis and attacking,illegal communication monitoring,malicious code recognition,etc.At the same time,the ability to resist the recognition of cryptographic algorithms can also be used as a criterion to measure the security of cryptographic algorithms,and a certain reference for the design of cryptographic algorithms.Based on the cipher-text only condition,this thesis studies the cryptographic algorithm recognition of cipher text.This thesis studies and analyzes the key technologies of feature extraction,classifier training,feature selection and algorithm identification.The main content of the thesis is as follows:(1)Cipher-texts are generated for 11 modern cryptographic algorithms such as AES,TDES,and Camellia.The actual files are used as plaintexts,and the working mode of ciphers includes ECB and CBC.Cipher-text features are extracted through the methods of randomness detection,entropy calculation,FFT calculation etc.We analyze the cipher-text feature distributions which are generated by different cryptographic algorithms and working modes.(2)SVM is used to identify cryptographic algorithms,and it is found the classification accuracy is up to 70%,and 11 classes recognition accuracy rate is 30.5%.The recognition effect is significantly better than random guessing.(3)Ensemble learning methods are used to recognize cryptographic algorithms of cipher text.This thesis uses the Random Forest based on the Bagging method and the GBDT based on Gradient Boosting method to identify the cryptographic algorithms of cipher-texts,and the accuracy rates are up to 80% in two classes recognition.Comparing with the single classifier scheme of SVM and decision tree,the ensemble learning method can improve the recognition accuracy of cryptographic algorithms.(4)At last,this thesis tests and analyzes factors that affect the accuracy of cryptographic algorithm recognition.The feature selection method is used to evaluate the effectiveness of the cipher text features in the cryptographic algorithm recognition task.After lots of repeating experiments,more effective cipher text features were selected.The experiment results show that,in the recognition task of cryptographic algorithm,more features do not means higher accuracy rate.Selecting more effective cipher-text features,and discarding redundant features,can improve the recognition accuracy of the classifier.In contrast,the longer the length of the collected cipher-text is,the easier it is to identify the cipher-text encryption algorithm.The cipher-text recognition accuracy of ciphers-in-depth is higher than simple cipher-text.The cipher-text generated by the ECB mode is easier to identify than which generated by CBC mode.