A method and system for identifying encryption algorithm type based on ciphertext features

Abstract

The present invention discloses a method and system for identifying encryption algorithm types based on ciphertext features, comprising: crawling plaintext password information on an information security website and performing data preprocessing; using an OpenSSL open source encryption library to perform encryption using different types of encryption algorithms, and obtaining an encrypted ciphertext set as training data; performing model training based on deep learning of a GRU model, testing the trained model, obtaining a category of classification errors, performing n-gram-based extraction on encrypted password strings corresponding to the error categories, obtaining n-gram fragments, recording fragment positions and tuple numbers, hiding data between two n-gram tuples, achieving the improvement of important features, and performing testing again, stopping training when the test result has a threshold degree of improvement, otherwise changing the number of n-gram tuples and the hidden fragment positions; the method can identify the ciphertext encryption type and correct the identified errors.

Description

[Technical field]

[0001] The present invention relates to the technical field of cryptography, and in particular to a method for identifying encryption algorithm types by ciphertext features. [Background technology]

[0002] In today's business activities, there are always a lot of important confidential data. In order to prevent data leakage, encryption algorithms are often used to encrypt these data to protect data security. However, due to the different importance and confidentiality levels of various types of data, different encryption algorithms must be used to encrypt different data to avoid data leakage and affect the normal use of data. It is very difficult to crack the encryption algorithm. The present invention does not crack the algorithm. Our goal is to identify the encryption type of the encrypted algorithm. When the encryption type does not meet the security standards, targeted reminders can be given to help enterprises or institutions obtain system security. Therefore, in order to ensure the correct use of encryption algorithms, it is very important to identify the type of encryption algorithms.

[0003] Deep learning is a type of machine learning. Since it was proposed in 2006, it has been widely used in many fields, including encryption algorithm recognition. In 2013, some scholars proposed a neural network-based attack differentiation method, which uses linguistics and information retrieval methods to generate classification models from ciphertexts encrypted by MARS, RC6, Rijndael, Serpent, and Twofish. However, the previous methods have a high recognition error rate, and after the recognition error, they cannot extract more effective features to optimize the accuracy, so they cannot guarantee good recognition, and the content of misrecognition cannot be reduced. [Summary of the invention]

[0004] The present invention provides a method for identifying the type of encryption algorithm based on ciphertext features, the method comprising:

[0005] Crawl the plaintext password information on the information security website and perform data preprocessing; use the OpenSSL open source encryption library to encrypt with different types of encryption algorithms to obtain the encrypted ciphertext set as training data; perform deep learning model training based on the GRU model, test the trained model, obtain the classification error category, perform n-gram-based extraction on the encrypted password string corresponding to the error category, obtain n-gram fragments, record the fragment position and the number of tuples, hide the data between two n-gram tuples, achieve the improvement of important features, and test again. When the test result has a threshold degree of improvement, stop training, otherwise change the number of n-gram tuples and the hidden fragment position.

[0006] Further optionally, in the method described above, the plain text password information on the crawler information security website mainly includes:

[0007] On information security related websites, regular expressions are used to match the keyword "common passwords" or major information security forums to match the relevant report content or information with numbers, symbols, and letters; and the data defects and spaces therein are processed.

[0008] Further optionally, in the method described above, the OpenSSL open source encryption library uses different types of encryption algorithms for encryption, mainly including:

[0009] The encryption algorithm in the OpenSSL open source encryption library is selected as the standard encryption algorithm, and different types of encryption algorithms are selected from it to encrypt the plain text password. These ciphertexts are stored according to the types of encryption algorithms to obtain ciphertext sets output by different types of encryption algorithms. Ciphertexts of various types whose lengths are less than a preset threshold are selected as training data.

[0010] Further optionally, in the method described above, the model training based on deep learning of the GRU model, testing the trained model, and obtaining the category of classification errors mainly include: taking different types of encryption algorithm samples as features according to the ciphertext set, taking the type of algorithm as a label value, obtaining a training set, constructing an encryption algorithm type recognition model based on the GRU neural network, and adding a dropout layer and regularization therein;

[0011] The model is input with test set samples to identify the test results, including correctly classified data and incorrectly classified data.

[0012] Further optionally, in the method described above, the encrypted password string corresponding to the error category is extracted based on n-gram, n-gram fragments are obtained, and the fragment positions and the number of tuples are recorded, which mainly includes:

[0013] Extract the features of the misclassified data and group them according to their symmetric characteristics; the grouping includes multi-dimensional segmentation of the password through an n-gram algorithm; analyzing whether there are identical n-gram fragments and recording the positions of the fragments; separating different n-gram fragments and grouping them according to the separated contents.

[0014] Further optionally, in the above method, hiding the data between two n-gram tuples to improve important features mainly includes:

[0015] The data in the middle of two n-gram features is hidden. If the hidden part contains other n-gram strings, it is not hidden. If the string between n-grams is longer than the preset length, it is not hidden either.

[0016] Further optionally, in the method as described above, the training is stopped when the test result is improved by a threshold level, otherwise the number of n-gram tuples and the position of the hidden fragment are changed, and mainly includes:

[0017] If it is found that there is no improvement in the accuracy, the number of n-gram tuples can be changed, from extracting bigrams to triplets to make the features more prominent; or the position of the hidden fragments can be changed, and only the N middle strings of the two tuples can be hidden instead of all of them, so as to improve the feature values ​​of the elements around the n-gram.

[0018] The present invention discloses a system for identifying encryption algorithm types based on ciphertext features, the system comprising:

[0019] A data acquisition module is used to obtain password content that can be used for testing through crawlers;

[0020] Deep learning training and testing module, used to train the deep learning GRU model and test the model accuracy;

[0021] The n-gram extraction module is used to identify the n-gram features of erroneous content for subsequent testing and improvement;

[0022] The fragment hiding module is used to hide unimportant fragments and enhance important features.

[0023] The technical solution provided by the present invention may include the following beneficial effects:

[0024] Aiming at the problem of encryption algorithm identification, the present invention proposes a method for identifying the encryption algorithm type based on ciphertext features. After correct training, as long as the ciphertext is input, the encryption algorithm type to which the ciphertext belongs can be efficiently and accurately identified. In addition, the present invention can extract features and hide irrelevant data for incorrect classification results, thereby improving and optimizing the accuracy rate.

Brief Description of the Drawings

[0025] Figure 1 The present invention is a flow chart of a method for identifying the type of encryption algorithm based on ciphertext features.

[0026] Figure 2 This is a structural diagram of a method for identifying encryption algorithm types based on ciphertext features according to the present invention. [Specific implementation method]

[0027] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0028] Figure 1 The flowchart of the method for identifying the type of encryption algorithm based on ciphertext features of the present invention is as follows. Figure 1 As shown, a method and system for identifying encryption algorithm types based on ciphertext features in this embodiment may specifically include the following steps:

[0029] The random distribution characteristics of the ciphertexts output by different encryption algorithms are different. The ciphertext can also be regarded as a piece of natural language text. The ciphertexts output by different encryption algorithms are like different languages. Based on this idea, the GRU neural network in deep learning can be used to extract ciphertext features and identify encryption algorithms.

[0030] Step 1: Use crawler technology to crawl relevant plaintext password data from various information security forums on the Internet and pre-process the data.

[0031] Based on the Scrapy framework of Python language, write a crawler program, use regular expressions to match the keyword "common passwords", or related reports of major information security forums such as "The password is set to:" or information with numbers, symbols, and letters.

[0032] Then clean or preprocess the data. The data crawled from the Internet is generally defective, or there are null values ​​or data errors, and these data cannot be used directly. At this time, the Pandas library in Python can be used to clean the data and obtain the correct data. For example: In a data table obtained in step 1, there are 1200 items of data, of which 6 are null values. If encryption is performed directly, the content that is not the original password will also be encrypted into the password, causing the output ciphertext and the original data to be inconsistent. Therefore, Pandas is used to fill in the null values, and the NAN values ​​are filled in these 6 null values. When performing password encryption operations, the null values ​​can be extracted and special processing can be performed.

[0033] Step 2: Encrypt the data using an encryption algorithm, and obtain a set of ciphertexts obtained after using different types of encryption algorithms.

[0034] OpenSSL is an open source software library package that applications can use for secure communications to avoid eavesdropping and confirm the identity of the other end of the connection. This library also contains an encryption library. Select the encryption algorithm in the OpenSSL open source encryption library as the standard encryption algorithm, and select different types of encryption algorithms from it to encrypt the data obtained in step 1. Store these ciphertexts according to the type of encryption algorithm to obtain different encryption algorithm output ciphertext sets. Select the content with a ciphertext bit difference less than a preset threshold, such as 64 bits, as valuable training data. Avoid some ciphertexts being too long and some being too short. If there are multiple types of encryption algorithms, perform multiple encryption and storage.

[0035] For example, for the data "Today's income is 1,000 yuan", the ciphertext obtained after MD5 encryption is "8ff695b12a854ed9da69ce82f5c948d2", the ciphertext obtained after SAH1 encryption is "b3ff0a58f4a88fe9549fd319d09f353d51f2462e", and the ciphertext obtained after AES encryption is "VkXv+pLtXVVS7qhtV / CWyjAKBwsxljs 1l / 1 / 3hEMn+Q=". The encrypted ciphertexts are stored in txt files named "MD5", "SAH1", and "AES" respectively. Other types of encryption algorithms are similar.

[0036] Step 3: Encode the labels, build an encryption algorithm type recognition model, and train it.

[0037] The encryption algorithm type is encoded and annotated for the ciphertext set obtained in step 2 to obtain a label set, and an encryption algorithm type recognition model based on the GRU neural network is constructed, in which a dropout layer and regularization are added. The GRU neural network model is a variant of the LSTM neural network model and a type of recurrent neural network. It has one less gate function than the LSTM, only an update gate and a reset gate, so the number of parameters is less than that of the LSTM, and the overall training speed is also faster than that of the LSTM. The dropout layer and regularization are added to avoid overfitting of the neural network model, resulting in a result with high classification accuracy only for the training set.

[0038] For example: Encode the encryption algorithm type according to the mapping table {"MD5":0,"SAH1":1,"AES":2}, and use the obtained encoding table {0, 1, 2} as the label to construct a GRU layer with 64 stacked layers, without bias, followed by a dropout layer, and add an L1 regularization parameter (0.01) to the output Dense layer.

[0039] Step 4: Train the encryption algorithm type recognition model to obtain the recognition result.

[0040] The ciphertext set obtained in step 2 is divided into a training set, a validation set and a test set. The test set and validation set and the label set obtained in step 3 are input into the GRU neural network model constructed in step 3 to obtain the encryption algorithm type recognition result for the ciphertext set. Among them, the validation set is to prevent the encryption algorithm type recognition model from overfitting and to better adjust the model's hyperparameter settings.

[0041] For example, there are 30 million txt files of ciphertext sets of "MD5", "SAH1", and "AES". They are divided into training set, validation set, and test set in a ratio of 5:2:3. The training set and validation set are input into the encryption algorithm type recognition model for training for 100 epochs. The callback parameter function is set to stop training when the training set error decreases and the validation set error increases. After training for 75 epochs, the model automatically stops training. Test with the test set to see if several algorithms can be correctly classified and determine which cryptographic algorithms are misidentified.

[0042] Step 5: Optimize the incorrect classification again.

[0043] First, extract the misclassified data features and group them according to their symmetric characteristics. The grouping method includes performing multi-element segmentation on the password through an n-gram algorithm. Analyze whether there are identical n-gram fragments and record the positions of the fragments. Separate different n-gram fragments and group them according to the separated contents.

[0044] Among them, the n-gram algorithm can automatically identify and extract recurring short segments of strings. For example, after MD5 encryption, the ciphertext is "8ff695b12a854ed9da69ce82f5c948d2", in which the binary segment 69 appears twice. Similarly, some three- and four-element strings often appear in a similar manner.

[0045] Step six, hide some non-n-gram string information fragments to improve the overall n-gram features. The reason why the password type cannot be correctly identified is largely because the features of the password string cannot be found, and n-gram is repetitive and easier to identify. Hiding some non-n-gram features is beneficial to improving the weight of n-gram. The hiding method is to hide the middle part of the data between two n-gram features. When the hidden part contains other n-gram strings, it is not hidden. When the string interval in the n-gram is greater than the preset length, it is not hidden. In other cases, data hiding is performed to improve the feature weight.

[0046] Step seven: Test the classified erroneous data again to obtain new features and classification results.

[0047] For the data set that was originally misclassified, after being processed by n-gram, the model is used again for classification test. After the algorithm is improved, the features are highlighted, there are new classification test results, and some can be correctly classified. For example, when the total accuracy rate reaches 88.82% from the original overall accuracy rate of 87.91%, the model is considered to have improved. If it is found that there is no improvement in the accuracy rate, the number of n-gram tuples is changed, and the number of tuples of n-gram is changed from extracting bigrams to triplets to make the features more prominent; or, the position of the hidden fragment is changed, and only the middle N strings of the two tuples are hidden instead of all, so as to improve the feature values ​​of the elements around the n-gram. This avoids the deletion of associated information with data features.

[0048] Step 8: Use Selenium testing tools to encrypt specific text on online encryption websites, then input the encrypted ciphertext into the encryption algorithm type recognition model for identification, conduct larger-scale automated testing, and adjust the test results. This is beneficial for obtaining large-scale data and obtaining the optimal parameter steps during feature adjustment.

[0049] Selenium is a tool for testing web applications. It runs directly in the browser, just like a real human being. With this software, we can encrypt specific text directly on the encrypted website and obtain the encrypted ciphertext. The encrypted ciphertext is input into the encryption algorithm type recognition model for recognition. If the recognition result is not the correct encryption algorithm, the ciphertext is added to the corresponding ciphertext set and the model is retrained.

[0050] For example, Selenium is used to encrypt plain text passwords on information security websites using md5 on the online encryption website chahuo.com. The number of encrypted words each time does not exceed 10, and a ciphertext set is obtained. This ciphertext set is input into the encryption algorithm type recognition model for recognition, and the recognition accuracy of the identified types is 81.27% for MD5, 54.29% for SAH1, and 65.44% for AES algorithm. Therefore, the types with the most recognition errors are specially re-entered and the number of tuples hidden by n-gram features is adjusted, so that the encryption algorithm can be targeted for optimization training in this type recognition model. This allows algorithms with high error rates to be further improved.

[0051] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiments can be implemented by software, or by means of software plus necessary general hardware platforms. Based on such understanding, the technical solutions of the above embodiments can be embodied in the form of software products, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0052] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for identifying the type of encryption algorithm based on ciphertext features, characterized in that: The method comprises: Crawl the plaintext password information on the information security website and perform data preprocessing; use the OpenSSL open source encryption library to encrypt with different types of encryption algorithms to obtain the encrypted ciphertext set as training data; perform deep learning model training based on the GRU model, test the trained model, and obtain the category of classification errors, including: using different types of encryption algorithm samples as features based on the ciphertext set, using the type of encryption algorithm as the label value to obtain the training set, and constructing an encryption algorithm type recognition model based on the GRU neural network, and adding dropout layers and regularization to it; input the test set samples through the model to identify the test results, including correctly classified data and incorrectly classified data; the encrypted password string corresponding to the error category The invention relates to an n-gram-based extraction method, wherein n-gram fragments are obtained, and the fragment positions and the number of tuples are recorded, including: extracting the features of the misclassified data and grouping them according to their symmetric features; the grouping includes multi-element segmentation of the password by the n-gram algorithm; analyzing whether the same n-gram fragments exist and recording the positions of the fragments; separating different n-gram fragments and grouping them according to the separated contents, wherein the repeated small character strings are automatically identified and extracted by the n-gram algorithm; hiding the data between two n-gram fragments to improve the feature importance, and testing again. When the test result has a threshold degree of improvement, the training is stopped, otherwise the number of n-gram tuples and the hidden fragment positions are changed.

2. The method according to claim 1, wherein: The plain text password information on the crawling information security website mainly includes: On information security related websites, regular expressions are used to match the keyword "common passwords" or major information security forums to match the report content or information with numbers, symbols, and letters with the words "The password is set to:"; and the data defects and spaces therein are processed.

3. The method according to claim 1, wherein: The OpenSSL open source encryption library uses different types of encryption algorithms for encryption, mainly including: The encryption algorithm in the OpenSSL open source encryption library is selected as the standard encryption algorithm, and different types of encryption algorithms are selected from it to encrypt the plain text password. These ciphertexts are stored according to the types of encryption algorithms to obtain ciphertext sets output by different types of encryption algorithms. Ciphertexts of various types whose lengths are less than a preset threshold are selected as training data.

4. The method according to claim 1, wherein: The method of hiding the data between two n-gram segments to improve the importance of features mainly includes: The data in the middle of two n-gram segments is hidden. When the hidden part contains other n-gram strings, it is not hidden; when the string interval in the n-gram is greater than the preset length, it is not hidden either.

5. The method according to claim 1, wherein: The training is stopped when the test result has a threshold level improvement, otherwise the number of n-gram tuples and the position of the hidden fragment are changed, which mainly includes: If it is found that there is no improvement in the accuracy, the number of n-gram tuples can be changed, from extracting bigrams to triplets to make the features more prominent; or the position of the hidden fragments can be changed, and only the N middle strings of the two n-gram fragments can be hidden instead of all of them, so as to improve the feature values ​​of the elements around the n-gram.

6. A system for identifying encryption algorithm types based on ciphertext features, applying a method for identifying encryption algorithm types based on ciphertext features as described in any one of claims 1 to 5, characterized in that: The system comprises: A data acquisition module is used to obtain password content that can be used for testing through crawlers; Deep learning training and testing module, used to train the deep learning GRU model and test the model accuracy; The n-gram extraction module is used to identify the n-gram features of erroneous content for subsequent testing and improvement; The fragment hiding module is used to hide unimportant fragments to enhance the importance of features.

Images