Block Cipher System Identification Method Based on LeNet5-RF Algorithm

Abstract

The present invention discloses a block cipher system identification method based on the LeNet5-RF algorithm, constructs a ciphertext data set, a LeNet5 neural network, and a random forest model; obtains a ciphertext mapping matrix according to a ciphertext file; performs convolution and pooling on the ciphertext mapping matrix to obtain ciphertext features; regularizes the ciphertext mapping matrix; inputs the ciphertext mapping matrix into the LeNet5 neural network for training and outputs the ciphertext feature vector and the corresponding weight to the random forest model, and trains the random forest model; and sequentially processes the ciphertext file submitted by the user through the trained LeNet5 neural network and the random forest model to obtain the corresponding classification result. Compared with the traditional block ciphertext recognition model, the present invention innovatively combines the LeNet5 neural network and the random forest model. The convolutional neural network is used to extract ciphertext features at a fine-grained level. The classification accuracy of the traditional randomness detection and ciphertext entropy features is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic system identification, and in particular to a block cryptographic system identification method based on a LeNet5-RF algorithm. Background Art

[0002] Block encryption algorithm is an important research branch in modern cryptography. Its birth and development have a wide range of practical backgrounds and important theoretical value. Block cipher is to divide the sequence of numbers (referred to as plaintext numbers) after encoding the plaintext message into n groups of length, each with m bytes. Each group is transformed into an equal-length output number (referred to as ciphertext numbers) sequence under the control of the key. Cryptanalysis is a discipline that studies the attack, decryption and forgery of encrypted messages. Its main research objects are encryption algorithms and ciphertexts. Since the birth of cryptography, cryptanalysis technology has been continuously improved, complementing the research of cryptography and coding, and has now formed a complete system. In order to formulate targeted solutions for ciphertext data analysis, identifying the encryption algorithm to which the ciphertext belongs has become the primary task faced by ciphertext data analysts. Therefore, the research on encryption algorithm identification has important theoretical significance and practical application value.

[0003] Machine learning is one of the important methods for cryptographic system identification. Some scholars proposed a hierarchical identification scheme for cryptographic systems based on random forests, and introduced three clustering methods: CM clustering, CSN clustering, and CSBP clustering. The results show that the identification scheme with hierarchical identification is better than the single-cluster identification scheme. Some scholars used randomness tests to extract ciphertext features and proposed an identification scheme based on random forests. In this scheme, six block ciphers are identified in pairs, and their recognition rates vary under different features. Under some features, their recognition rates can reach more than 80%. Some scholars proposed a block cipher system identification method based on an improved random forest algorithm in a patent. By using logistic regression to improve the random forest classifier, the random forest model is first trained with the original features, and then the trees learned by the random forest model are used to construct new features, and then the new features are one-hot encoded. Finally, these new features are added to the original features to train the classification model together, thereby solving the problem that random forests are prone to overfitting on some sample sets with relatively large noise. In response to the problem of encryption algorithm identification, a research institute has proposed a method for identifying encryption algorithm types based on ciphertext features. After correct training, as long as the ciphertext is input, the encryption algorithm type to which the ciphertext belongs can be efficiently and accurately identified. It can also extract features and hide irrelevant data for incorrect classification results, thereby improving and optimizing the accuracy rate.

[0004] Although more and more researchers are applying machine learning methods to the field of cryptographic system identification, current research only stereotypes the cryptographic system identification task into the framework of machine learning classification tasks, ignoring the particularity of cryptographic systems and ciphertexts, so it is necessary to consider the two parts of ciphertext feature extraction and single-part identification. However, most of the current research is still only carried out from the machine learning part, which leads to the need to improve the accuracy of cryptographic system identification. Summary of the invention

[0005] The purpose of the present invention is to address the above-mentioned defects in the prior art and provide a block cipher system identification method based on the LeNet5-RF algorithm to solve the problems of low efficiency, low accuracy, and little effective identification information in the identification and analysis of the existing block cipher algorithms.

[0006] The above-mentioned object of the present invention is achieved by the following technical solutions:

[0007] The block cipher system identification method based on LeNet5-RF algorithm includes the following steps:

[0008] Step S1, constructing a ciphertext data set, a LeNet5 neural network, and a random forest model, where the ciphertext data set consists of ciphertext files;

[0009] Step S2: convert the ciphertext file into a ciphertext string, quantize and map the ciphertext string to form a ciphertext mapping matrix;

[0010] Step S3, convolve and pool the ciphertext mapping matrix obtained by preprocessing to obtain ciphertext features;

[0011] Step S4, regularizing the ciphertext mapping matrix;

[0012] Step S5, input the regularized ciphertext mapping matrix into the LeNet5 neural network, train the LeNet5 neural network and output the ciphertext feature vector and the corresponding weight;

[0013] Step S6: input the ciphertext feature vector and the corresponding weight into the random forest model to train the random forest model;

[0014] Step S7: The ciphertext file submitted by the user is processed by the trained LeNet5 neural network and random forest model in turn to obtain the corresponding classification results.

[0015] The step S2 as described above comprises the following steps:

[0016] Step S201, performing a linear transformation on the ciphertext file, and then dividing the ciphertext file after the linear transformation into blocks to obtain ciphertext blocks;

[0017] Step S202: quantize the divided ciphertext blocks by cumulative summation to obtain converted ciphertext data;

[0018] Step S203: Divide the ciphertext data in order to obtain a ciphertext mapping matrix of size .

[0019] Step S3 as described above comprises the following steps:

[0020] Step S301, convolve the ciphertext mapping matrix obtained by preprocessing;

[0021] Step S302, obtaining a down-sampled ciphertext matrix by pooling down-sampling;

[0022] Step S303: Flatten the downsampled ciphertext matrix to obtain ciphertext features.

[0023] The step S5 as described above comprises the following steps:

[0024] Step S501, input the ciphertext mapping matrix, convolve it through the filter for the first time and output it;

[0025] Step S502: Send the output of step S501 to the first pooling layer for downsampling, and then pass the filter through the second convolution to obtain the output;

[0026] Step S503, sending the output of step S502 to the second pooling layer which is the same as the first pooling layer, and expanding it to obtain a high-dimensional ciphertext feature vector;

[0027] Step S504: Perform multiple full-connection operations on the output of step S503 to finally obtain a ciphertext feature vector, and use softmax classification to obtain the weight corresponding to the ciphertext feature vector.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] Compared with the traditional group ciphertext recognition model, this invention innovatively combines the LeNet5 neural network and the random forest model. The convolutional neural network is used to extract ciphertext features at a fine-grained level to obtain ciphertext embedding. Compared with the traditional randomness detection and ciphertext entropy feature classification accuracy is improved by about 15%. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 Schematic diagram of the process of preprocessing ciphertext files;

[0031] Figure 2 This is the accuracy change curve of different block sizes;

[0032] Figure 3 Schematic diagram of extracting CnPo_192 ciphertext features;

[0033] Figure 4 It is the characteristic value distribution diagram of CnPo_192 ciphertext features;

[0034] Figure 5 Schematic diagram of the random forest parameter adaptation process;

[0035] Figure 6 This is the LeNet5 neural network training process;

[0036] Figure 7 This is a schematic diagram of the LeNet5 neural network structure;

[0037] Figure 8 It is a data processing flow chart;

[0038] Fig. 9 The generation process of a decision tree in a random forest;

[0039] Fig.10 Schematic diagram of the proportion of various ciphertext files in the ciphertext dataset. DETAILED DESCRIPTION

[0040] In order to facilitate those skilled in the art to understand and implement the present invention, the present invention is further described in detail below in conjunction with embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0041] The embodiment of the present invention provides a block cipher system identification method based on the LeNet5-RF algorithm, comprising the following steps:

[0042] Step S1, constructing a ciphertext data set, a LeNet5 neural network, and a random forest model (RF), wherein the ciphertext data set is composed of ciphertext files obtained by encrypting multimedia data such as text, pictures, and audio using a block cipher algorithm;

[0043] Step S2, ciphertext file preprocessing: first convert the ciphertext file into a 01 ciphertext string, then quantize and map the ciphertext string to form a ciphertext mapping matrix. The process is as follows Figure 1 As shown, the specific steps include:

[0044] Step S201, linearly transform the ciphertext file, and then divide the linearly transformed ciphertext file into blocks to obtain ciphertext blocks, the size of the ciphertext block is block×1024 / 8000, where Block is 8, 16 or 32;

[0045] Step S202: quantize the divided ciphertext blocks by cumulative summation to obtain 1024-dimensional converted ciphertext data;

[0046] Step S203: divide the ciphertext data in order to obtain a ciphertext mapping matrix of size 32*32.

[0047] Ciphertext preprocessing mainly involves the selection of ciphertext block size. In this embodiment, Block is set to 8, 16, and 32 bits respectively, and the corresponding ciphertext mapping matrices are generated for experiments, and the best block is selected according to the loss function. This method selects the LeNet5 network model to perform the AES-3DES binary classification task, and tests the accuracy of the three block methods. The experimental results are shown in Figure 2 ;

[0048] from Figure 2 As can be seen in the figure, the block division with Block = 8bit has a better effect, and both the training completion time and accuracy are better than those with 16 and 32bit blocks. In addition, the 8bit block processing requires the smallest ciphertext size, which is conducive to classification in complex ciphertext scenarios. Therefore, the 8bit block method is used for ciphertext preprocessing in the future.

[0049] Step S3, ciphertext feature extraction: The ciphertext mapping matrix obtained by preprocessing is convolved and pooled to obtain the final 64-dimensional (CnPo_64), 75-dimensional (CnPo_75), and 192-dimensional (CnPo_192) ciphertext features. The CnPo_192 extraction process is as follows: Figure 3 As shown;

[0050] Step S301: For each ciphertext data, a 32*32 ciphertext mapping matrix obtained by preprocessing is convolved once, where the input channel of the convolution is 1 and the output channel is 3;

[0051] Step S302: Perform two pooling downsamplings to obtain three 8*8 downsampled ciphertext matrices;

[0052] Step S303: Flatten the downsampled ciphertext matrix to obtain 192-dimensional ciphertext features.

[0053] In order to illustrate that the CnPo ciphertext features have good discrimination between different encryption algorithms, Figure 4 The distribution diagram of a certain dimension of the CnPo_192 ciphertext features of about 3600 encrypted ciphertexts of AES and 3DES is shown. It can be seen that there is a clear boundary between the characteristic values ​​of the two ciphertexts, the characteristic values ​​of 3DES are concentrated in 0-0.7 and the characteristic values ​​of AES are concentrated above 0.8.

[0054] Step S4, regularizing the ciphertext mapping matrix;

[0055] Step S5: Input the regularized ciphertext mapping matrix into the LeNet5 neural network, train the LeNet5 neural network and output the ciphertext feature vector and the corresponding weight. The training process of the LeNet5 neural network is as follows: Figure 6 ;

[0056] Step S501: Input a 32×32×1 ciphertext mapping matrix, and perform the first convolution (C1) with a 6×5×5 filter to obtain a 28×28×6 output;

[0057] Step S502: Send the output of step S501 to the first pooling layer (P1) for 2x2 downsampling, and then pass it through a second convolution (C2) with a 16×5×5 filter to obtain a 10×10×16 output;

[0058] Step S503: Send the output of step S502 to the second pooling layer P2 which is the same as the first pooling layer P1, and expand it to obtain a 400-dimensional high-dimensional ciphertext feature vector;

[0059] Step S504: perform three full-connection operations on the output of step S503 to finally obtain a 10-dimensional ciphertext feature vector, and use softmax classification to obtain the weight corresponding to the ciphertext feature vector.

[0060] Step S6: Input the ciphertext feature vector and the corresponding weight into the random forest model, train the random forest model, obtain the classification result, and calculate the corresponding classification accuracy.

[0061] The present invention uses the RandomForestClassifier and DecisionTreeClassifier modules in sklearn to construct a random forest model. The Gini index is used as the classification standard. The prediction accuracy of the random forest model is calculated;

[0062] Step S7: The ciphertext file submitted by the user is processed by the trained LeNet5 neural network and random forest model in turn to obtain the corresponding classification results.

[0063] Figure 5 The maximum depth of each decision tree, the number of decision trees and the adaptive process of the minimum information gain are shown. The three coordinate axes represent the three parameters ne, mid and md respectively. The color of the point represents the accuracy. The darker the color, the higher the accuracy, and the lighter the color, the lower the accuracy. The accuracy range is 55% to 99%.

[0064] Specifically, in this embodiment, the activation function of the LeNet5 neural network is the sigmoid function, the pooling layer is the maximum pooling layer, the loss function is the CrossEntropyLoss function, and the optimizer is Adam. The structure of the LeNet5 neural network is as follows: Figure 7 As shown;

[0065] Specifically, the block cipher system of the ciphertext file to be identified includes at least one of AES, 3DES, and Blowfish;

[0066] Compared with the traditional group ciphertext recognition model, this invention innovatively combines the LeNet5 neural network model with the random forest model. The convolutional neural network is used to extract the ciphertext feature vector at a fine-grained level, and the ciphertext embedding is obtained and then classified by the random forest model. Compared with the traditional randomness detection and ciphertext entropy feature classification, the accuracy is improved by about 15%.

[0067] The present invention adopts the LeNet5-RF algorithm to construct a classifier, and uses the extracted ciphertext feature vector and the corresponding weight as the input of the random forest model. After training and testing the random forest model, the recognition task of the block cipher system is finally completed.

[0068] In order to verify the effectiveness of the block cipher system identification method based on the improved random forest algorithm provided by the present invention, the following verification experiment is provided.

[0069] 1. Data preparation

[0070] In view of the fact that it is difficult to obtain a large amount of encrypted ciphertext data on the Internet, and there are problems such as data security and algorithm security, a large number of ciphertext files are made in this embodiment to complete the model training. The selection of the "plaintext" (hereinafter referred to as the original data) data set of these ciphertext files refers to the data sets used in some documents. Considering that ciphertext data in real life is mostly obtained by encrypting multimedia such as text, pictures, and audio, the data set used in the training model of the present invention also includes original data in these formats. Considering that the information contained in the picture and audio files has more channel characteristics, in order to avoid the model's learning of the channel, the data for training the model focuses on the use of a variety of audio and picture original data. All original data are downloaded from the corresponding official website, and the corresponding address is given. The original data were encrypted with three encryption algorithms: 3DES, AES, and Blowfish, and finally a ciphertext data set of about 49.5G was obtained, with about 187,600 ciphertext files. Various types of ciphertext files account for Fig.10 Shown

[0071] The present invention integrates the encryption toolkits currently provided by major open source platforms. The interface implementation of symmetric encryption and hash encryption is based on the Cipher module in the Cryptodome third-party library. Byte conversion is performed before encrypting the string ciphertext. According to the properties of different encryptions, the present invention performs different processing on the encryption object. Different symmetric encryption objects set different encryption block sizes and secret key lengths. The ciphertexts finally obtained are all hexadecimal text files.

[0072] The ciphertext data set is composed of image ciphertext, audio ciphertext, and text ciphertext in a ratio of 10:10:1. In addition, this method crawls some images and texts on the Internet and encrypts them for testing.

[0073] 2. Classification results evaluation criteria

[0074] In the cryptographic system identification task studied in the present invention, emphasis is placed on the accuracy of the classifier in identifying all cryptographic systems. The present invention uses precision / recall as a standard for evaluating the performance of the classifier.

[0075] Precision / Recall,The model is evaluated using the confusion matrix, which aims to obtain an effective measure of the classification model by showing the number of correct classifications and the number of predicted classifications for each encryption algorithm.,The confusion matrix produces a total of four results as shown in Table 1, TP (True Positive), TN (True Negative), FP (False Positive) and FN (False Negative).

[0076] Table 1 Classification confusion matrix

[0077]

[0078] Accuracy acc = (TP + TN) / (TP + FN + FP + TN)

[0079] Precision = TP / (TP+FP)

[0080] Recall = TP / (TP+FN)

[0081] For specific feature discrimination, cosine similarity is selected for comparison. This indicator is only used for auxiliary explanation during the experiment.

[0082] (III) Experimental results

[0083] Table 2 Comparison of ciphertext feature accuracy

[0084]

[0085] It can be seen from Table 2 that the CnPo ciphertext feature proposed by this method has a better classification effect than the randomness detection and entropy features used in the existing literature. Compared with the following, it can be seen that the CnPo feature extraction method proposed by this method completely surpasses the previous literature in terms of effect.

[0086] Table 3 LeNet5-RF binary test results

[0087] Classification LeNet5-RF 3DES,AES 96.07％ 3DES, Blowfish 96.83％ AES, Blowfish 95.89％

[0088] As shown in Table 3, the classification accuracy of LeNet5-RF is higher than 95%, which is higher than the existing level.

[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A block cipher system identification method based on LeNet5-RF algorithm, characterized in that: The following steps are involved: Step S1, constructing a ciphertext data set, a LeNet5 neural network, and a random forest model, where the ciphertext data set consists of ciphertext files; Step S2: convert the ciphertext file into a ciphertext string, quantize and map the ciphertext string to form a ciphertext mapping matrix; Step S3, convolve and pool the ciphertext mapping matrix obtained by preprocessing to obtain ciphertext features; Step S4, regularizing the ciphertext mapping matrix; Step S5, input the regularized ciphertext mapping matrix into the LeNet5 neural network, train the LeNet5 neural network and output the ciphertext feature vector and the corresponding weight; Step S6: input the ciphertext feature vector and the corresponding weight into the random forest model to train the random forest model; Step S7: The ciphertext file submitted by the user is processed by the trained LeNet5 neural network and random forest model in turn to obtain the corresponding classification results. The step S2 comprises the following steps: Step S201, performing a linear transformation on the ciphertext file, and then dividing the ciphertext file after the linear transformation into blocks to obtain ciphertext blocks; Step S202: quantize the divided ciphertext blocks by cumulative summation to obtain converted ciphertext data; Step S203: Sequentially divide the ciphertext data into a ciphertext mapping matrix of size , The step S3 comprises the following steps: Step S301, convolve the ciphertext mapping matrix obtained by preprocessing; Step S302, obtaining a down-sampled ciphertext matrix by pooling down-sampling; Step S303: Flatten the downsampled ciphertext matrix to obtain ciphertext features. The step S5 comprises the following steps: Step S501, input the ciphertext mapping matrix, convolve it through the filter for the first time and output it; Step S502: Send the output of step S501 to the first pooling layer for downsampling, and then pass the filter through the second convolution to obtain the output; Step S503, sending the output of step S502 to the second pooling layer which is the same as the first pooling layer, and expanding it to obtain a high-dimensional ciphertext feature vector; Step S504: Perform multiple full-connection operations on the output of step S503 to finally obtain a ciphertext feature vector, and use softmax classification to obtain the weight corresponding to the ciphertext feature vector.

Images