Tree structure-based cryptographic algorithm logical expression identification method

Abstract

The invention relates to a tree structure-based cryptographic algorithm logical expression identification method. A cryptographic algorithm and a cryptographic function are identified by the following steps of: 1) extracting a logical expression used in the realization of cryptographic algorithms by researching a realization principle of different cryptographic algorithms, and storing the logical expression in a cryptographic algorithm logical expression feature database by adopting a tree structure; 2) performing disassembly analysis on a target program to be identified, and establishing an abstract syntax tree set only containing logical operation; 3) matching the function abstract syntax tree set of the target program by using a matching algorithm with the tree structure according to the cryptographic algorithm logical expression feature database, and recording a matching result; 4) repeating the step 3) until all functions are finished matching; and 5) combing and marking matching results. Compared with the conventional methods of static feature code detection, core function discrimination, dynamic analysis and the like, the tree structure-based cryptographic algorithm logical expression identification method has outstanding advantages in identification efficiency and accuracy; and the analysis efficiency of cryptographic function is improved.

Description

technical field [0001] The invention belongs to the technical field of binary reverse engineering and information security, in particular to a tree-structure-based cryptographic algorithm logic expression recognition method. Background technique [0002] With the rapid development of computer science and technology and network communication technology, society has entered the information age, and people exchange information through computer networks more and more frequently. Information security in the process of information exchange has been paid more and more attention by people. The confidential communication, safe storage, integrity protection, authentication, signature and verification of information are all inseparable from the use of cryptographic algorithms. Cryptographic algorithms are the core of information security technology; especially in the military field, the security of cryptographic algorithms is indispensable. In addition, some malicious software also us...

AI Technical Summary

Problems solved by technology

This method is relatively simple to implement and has high detection efficiency (binary code matching). However, there are certain limitations: First, this method needs to collect constant features used in the implementation of cryptographic algorithms and build a feature library. Deal with deformed algorithms and algorithms that do not use constant features; secondly, static signatures of cryptographic algorithms are usually used in the initialization phase, and further manual analysis is required to find the cryptographic core functions

This method has certain limitations: first, data training is required, and the size of the training set and the rationality of the training directly determine the judgment result; second, the judgment result can only filter out suspected cryptographic core functions, and cannot label the specific algorithm name. Manual further analysis; in addition, some non-cryptographic functions with more logical operations and arithmetic operations will be misjudged as cryptographic functions

[0006] In addition, with the continuous development and improvement of dynamic analysis technology under the Windows platform, some dynamic identification methods of cryptographic algorithms have also appeared, but because dynamic tracking needs to record a large amount of data, identification efficiency is its biggest bottleneck

Images