Identification of block cipher algorithms using multi-layer perception algorithm
摘要
Cryptographic algorithm identification is the process of distinguishing or identifying the cryptographic algorithm by analysing the potential information of various features in the ciphertext under the condition of known ciphertext, which is the basis of cryptanalysis work. As the complexity of ciphertext increases, the interference between ciphertext data and encryption algorithms increases, and the identification effect of single-layer cryptographic algorithms in encryption algorithm identification work is poor. In order to solve the problems of low recognition accuracy and poor stability of the block cipher algorithm in the single-layer identification scheme, we propose a cryptographic algorithm identification scheme of block cipher algorithm using deep learning algorithm Multi-Layer Perception (MLP) in this paper. In this scheme, 15 NIST randomness test methods are used to extract ciphertext feature, and 10 meaningful features are selected as input to MLP classifier to make predictions. In the ciphertext-only scenario, five block cipher algorithms, AES, 3DES, Blowfish, CAST and RC2 are selected for the study of cryptographic algorithm identification, then binary classification and multiclassification identification are carried out. The experimental results demonstrate that, when the size of the ciphertext files and other experimental conditions are the same as for the five conventional machine learning models, the proposed scheme has superior accuracy and stability. Among them, the average identification accuracy of binary classification is 76.5% for ciphertext files of 1KB to 512KB size, which is 35.3%, 37.5%, 34.2%, 38.5%, and 41.6% higher than that of the traditional classical machine learning models SVM, GNB, KNN, RF, and LR respectively. The average identification accuracy of the multiclassification is 36.2%, which is significantly higher than the other five classical machine learning algorithms. When the ciphertext file sizes are different, among the identification rates of the six models fluctuate, the MLP model has the greatest stability and the least amount of influence.