Ciphertext encryption algorithm identification method and device

Abstract

The invention discloses a ciphertext encryption algorithm identification method and device. The method comprises the following steps: acquiring a first ciphertext to be identified, and extracting a first feature set corresponding to the first ciphertext; analyzing the first feature set by using a random forest sub-model in a pre-trained encryption algorithm identification model to obtain a first leaf node index matrix; combining the first leaf node index matrix and the first feature set into a second feature set; and analyzing the second feature set by using a K nearest neighbor sub-model in the encryption algorithm identification model, and determining a target encryption algorithm used by the first ciphertext. The technical problem that subsequent security analysis is affected due to the fact that it is difficult to accurately identify an encryption algorithm used by a ciphertext in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method and device for identifying a ciphertext encryption algorithm. Background Art

[0002] Cryptography plays a vital role in power systems, protecting sensitive and private information in the system from malicious attackers. However, power systems usually store cryptographic algorithms and keys in the chips of terminal devices, and due to the closed nature of the system, security detection equipment can only sense data streams through parallel access and cannot directly obtain the cryptographic information used by the equipment. This leads to how to accurately identify information such as the type of password, algorithm, and key length from the data stream without interfering with the normal operation of the system. Although early cryptographic algorithm recognition research mainly relies on statistical-based methods, which are intuitive and easy to understand, they work better when dealing with scenarios with fewer encryption algorithms. When faced with the increase in cryptographic algorithms and the complex and subtle differences between ciphertext features, they are unable to cope with it. Machine learning solutions have become a research hotspot in the field of cryptographic algorithm recognition due to their simple design, stable performance, and ability to handle complex data relationships. However, machine learning technology is usually used to solve problems that humans can solve but are not efficient, such as image classification, target recognition, speech recognition, etc., while the detection and recognition of cryptographic algorithms are significantly different from them. It is impossible to directly apply machine learning algorithms to complete the recognition work through mathematical and chemical expressions. The cryptographic algorithm recognition problem is simply reduced to a general pattern recognition problem, which ignores its particularity and limits the possibility of technological innovation.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for identifying a ciphertext encryption algorithm, so as to at least solve the technical problem in the related art that it is difficult to accurately identify the encryption algorithm used by the ciphertext, which affects the subsequent security analysis.

[0005] According to one aspect of an embodiment of the present application, a method for identifying a ciphertext encryption algorithm is provided, including: obtaining a first ciphertext to be identified, and extracting a first feature set corresponding to the first ciphertext; analyzing the first feature set using a random forest sub-model in a pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix; combining the first leaf node index matrix and the first feature set into a second feature set; analyzing the second feature set using a K nearest neighbor sub-model in the encryption algorithm recognition model to determine the target encryption algorithm used by the first ciphertext.

[0006] Optionally, extracting a first feature set corresponding to the first ciphertext includes: testing the first ciphertext using multiple randomness testing methods of the National Institute of Standards and Technology (NIST) to obtain multiple first features for reflecting the randomness of the first ciphertext, and combining the multiple first features into a first feature set.

[0007] Optionally, the first leaf node index matrix and the first feature set are combined into a second feature set, including: encoding the first leaf node index matrix using a one-hot encoder to obtain a third feature set; normalizing the first feature set to obtain a fourth feature set; and combining the third feature set and the fourth feature set into a second feature set.

[0008] Optionally, the training process of the random forest sub-model includes: obtaining second ciphertexts of multiple known encryption algorithms; for each second ciphertext, extracting the fifth feature set corresponding to the second ciphertext as a training sample, and determining the encryption algorithm corresponding to the second ciphertext as a sample label; forming a sample set from multiple training samples, and dividing the sample set into a training set, a validation set, and a test set; randomly extracting multiple training subsets from the training set with replacement using a bootstrap method; for each training subset, constructing a decision tree corresponding to the training subset using a preset decision tree algorithm, and pruning the decision tree, wherein the preset decision tree algorithm includes: a classification and regression tree algorithm; forming a random forest sub-model from multiple trained decision trees; evaluating the performance of the random forest sub-model using a validation set, and adjusting the model parameters of the random forest sub-model based on the evaluation results, wherein the model parameters include at least one of the following: the number of decision trees, the maximum depth of each decision tree, the minimum number of sample splits, the minimum number of leaf node samples, and the feature sampling ratio.

[0009] Optionally, the training process of the K nearest neighbor sub-model includes: for each fifth feature set in the training set, using the trained random forest sub-model to analyze the fifth feature set to obtain a second leaf node index matrix; using a one-hot encoder to encode the second leaf node index matrix to obtain a sixth feature set; normalizing the fifth feature set to obtain a seventh feature set; combining the sixth feature set and the seventh feature set into an eighth feature set; using multiple eighth feature sets to train the K nearest neighbor sub-model, and using a validation set to evaluate the performance of the trained K nearest neighbor sub-model.

[0010] Optionally, the trained random forest sub-model and K nearest neighbor sub-model are combined to obtain an encryption algorithm recognition model; the encryption algorithm recognition model is used to analyze each training sample in the test set to obtain an encryption algorithm classification result; the confusion matrix is ​​used to analyze the encryption algorithm classification result and the sample labels of each training sample in the test set to obtain a performance test result of the encryption algorithm recognition model.

[0011] Optionally, after determining the target encryption algorithm used by the first ciphertext, the method further includes: performing a traffic security analysis on the first ciphertext according to the target encryption algorithm.

[0012] According to another aspect of an embodiment of the present application, a device for identifying a ciphertext encryption algorithm is also provided, including: an acquisition module, used to obtain a first ciphertext to be identified and extract a first feature set corresponding to the first ciphertext; a first analysis module, used to analyze the first feature set using a random forest sub-model in a pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix; a combination module, used to combine the first leaf node index matrix and the first feature set into a second feature set; a second analysis module, used to analyze the second feature set using a K nearest neighbor sub-model in the encryption algorithm recognition model to determine the target encryption algorithm used by the first ciphertext.

[0013] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product comprising: a computer program, wherein when the computer program is executed by a processor, the above-mentioned ciphertext encryption algorithm recognition method is implemented.

[0014] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned ciphertext encryption algorithm recognition method through the computer program.

[0015] In an embodiment of the present application, a first ciphertext to be identified is obtained, and a first feature set corresponding to the first ciphertext is extracted; the first feature set is analyzed using a random forest sub-model in a pre-trained encryption algorithm identification model to obtain a first leaf node index matrix; the first leaf node index matrix and the first feature set are combined into a second feature set; the second feature set is analyzed using a K nearest neighbor sub-model in the encryption algorithm identification model to determine the target encryption algorithm used by the first ciphertext. In this way, by constructing multiple decision trees using a random forest sub-model, path information about data samples in a decision tree, i.e., a leaf node index matrix, is provided. The leaf node index matrix of the random forest sub-model provides an additional feature dimension, which helps the K nearest neighbor sub-model to more accurately distinguish encryption algorithms that are difficult to distinguish in the original feature space. The combination of the random forest sub-model and the K nearest neighbor sub-model enables the encryption algorithm identification model to more effectively identify different encryption algorithms, thereby solving the technical problem that it is difficult to accurately identify the encryption algorithm used by the ciphertext in the related technology, which affects the subsequent security analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a flowchart of an optional ciphertext encryption algorithm identification method according to an embodiment of the present application;

[0018] Figure 2 It is a structural schematic diagram of an optional ciphertext encryption algorithm recognition device according to an embodiment of the present application;

[0019] Figure 3 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0023] NIST (National Institute of Standards and Technology): An institution that conducts research in the fields of science and engineering. It provides standards, tools, test methods and test procedures to promote industry innovation and enhance industry competitiveness. NIST has research in many fields, including nanoscience and technology, engineering, information technology, neutron research, material measurement and physical measurement. It is also responsible for developing and promoting federal information processing standards and providing consulting and technical assistance to other agencies in computer science and technology.

[0024] Example 1

[0025] According to an embodiment of the present application, a method for identifying a ciphertext encryption algorithm is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] Figure 1 is a flow chart of a method for identifying a ciphertext encryption algorithm provided in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0027] Step S102, obtaining a first ciphertext to be identified, and extracting a first feature set corresponding to the first ciphertext;

[0028] Step S104, analyzing the first feature set using the random forest sub-model in the pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix;

[0029] Step S106, combining the first leaf node index matrix and the first feature set into a second feature set;

[0030] Step S108, analyzing the second feature set using the K nearest neighbor sub-model in the encryption algorithm identification model to determine the target encryption algorithm used by the first ciphertext.

[0031] The following describes the steps of the ciphertext encryption algorithm identification method in conjunction with a specific implementation process.

[0032] In order to solve the technical problem that it is difficult to accurately identify the encryption algorithm used in the ciphertext in the related art, which affects the subsequent security analysis, this application proposes to use an encryption algorithm identification model to identify the encryption algorithm. The model includes a random forest sub-model and a K nearest neighbor sub-model, and the encryption algorithm identification model is trained in the following way:

[0033] Optionally, the training process of the random forest sub-model can be performed using the following steps:

[0034] S1, obtaining second ciphertexts of multiple known encryption algorithms;

[0035] S2, for each second ciphertext, extracting the fifth feature set corresponding to the second ciphertext as a training sample, and determining the encryption algorithm corresponding to the second ciphertext as a sample label;

[0036] S3, multiple training samples are combined into a sample set, and the sample set is divided into a training set, a validation set and a test set;

[0037] S4, using the bootstrap method to randomly extract multiple training subsets from the training set with replacement;

[0038] For example, determine the size of the original data set, i.e., the training set, as N, and decide the number of bootstrap samples, i.e., training subsets, which are usually denoted as B. Randomly draw samples from the training set with replacement, and put them back each time a sample is drawn so that the sample may still be selected the next time it is drawn. After N samples are drawn continuously, a training subset is generated. Repeat this process B times, generating a new training subset from the original training set each time, and obtain B training subsets.

[0039] S5, for each training subset, using a preset decision tree algorithm to construct a decision tree corresponding to the training subset, and pruning the decision tree, wherein the preset decision tree algorithm includes: a classification and regression tree algorithm;

[0040] Taking the B training subsets generated above as an example, for each training subset S i , use the regression tree algorithm to build a decision tree T i , initialize an empty decision tree T i , among all the features of the current node, select the best split point, which will be selected based on indicators such as information gain, Gini impurity or mean square error. Split the current node into two child nodes according to the best split point, and repeat the above steps for each child node until the conditions are met (such as the number of samples in the node is less than a certain threshold, the node purity reaches a certain standard, etc.), and repeat this step until a complete decision tree T is generated i . Then for each decision tree T iPruning is a method to reduce overfitting. It simplifies the structure of the tree by removing some branches in the decision tree. Pruning can be pre-pruning (stopping the growth of the tree before it is fully grown) or post-pruning (letting the tree grow fully first, then removing unimportant branches), and finally generating a complete decision tree. In the process of building a decision tree, some early termination conditions are set to prevent overgrowth, such as sample thresholds, purity thresholds, or maximum depth limits, that is, if the number of samples of a node is lower than a certain threshold or the purity reaches a certain threshold, it will no longer be split.

[0041] S6, composing the trained multiple decision trees into a random forest sub-model;

[0042] S7, using the validation set to evaluate the performance of the random forest sub-model, and adjusting the model parameters of the random forest sub-model based on the evaluation results, wherein the model parameters include at least one of the following: the number of decision trees, the maximum depth of each decision tree, the minimum number of sample splits, the minimum number of leaf node samples, and the feature sampling ratio. Repeat the evaluation and adjustment process, and after multiple iterations and evaluations, select the best performing model parameter configuration as the final random forest sub-model.

[0043] Optionally, the training process of the K nearest neighbor sub-model can be performed using the following steps:

[0044] S1, for each fifth feature set in the training set, using the trained random forest sub-model to analyze the fifth feature set to obtain a second leaf node index matrix;

[0045] S2, encode the second leaf node index matrix using a one-hot encoder to obtain the sixth feature set;

[0046] Among them, when the second leaf node index matrix is ​​encoded using a one-hot encoder, each index value in the second leaf node index matrix is ​​converted into a binary vector. These vectors are mutually exclusive in the set, that is, only one bit is 1 at any given time, and the rest are 0. The encoded data forms a new sixth feature set, which can increase the predictive ability of the model because they contain the path information of the sample in the decision tree.

[0047] S3, normalizing the fifth feature set to obtain a seventh feature set;

[0048] S4, combining the sixth feature set and the seventh feature set into an eighth feature set;

[0049] S5, using multiple eighth feature sets to train the K nearest neighbor sub-model, and using the validation set to evaluate the performance of the trained K nearest neighbor sub-model, repeating the training and evaluation process until satisfactory model performance is achieved, and obtaining the final K nearest neighbor sub-model.

[0050] The core of the K-nearest neighbor sub-model is to calculate the distance between the new sample and all samples in the training set, and then select the nearest k neighbors. The most common distance metric is the Euclidean distance, which is:

[0051]

[0052] In the above formula, a and b are two sample points, a i and b i are their values ​​on the i-th feature.

[0053] Optionally, the trained random forest sub-model and K nearest neighbor sub-model are combined to obtain an encryption algorithm recognition model; the encryption algorithm recognition model is used to analyze each training sample in the test set to obtain an encryption algorithm classification result; the confusion matrix is ​​used to analyze the encryption algorithm classification result and the sample labels of each training sample in the test set to obtain a performance test result of the encryption algorithm recognition model.

[0054] Once the performance test results of the encryption algorithm identification model meet the preset standards, the model can be used in the actual encryption algorithm identification task. The specific steps are as follows:

[0055] First, a first ciphertext to be identified is obtained, and a first feature set corresponding to the first ciphertext is extracted; including: using a variety of randomness testing methods of the National Institute of Standards and Technology (NIST) to test the first ciphertext, obtaining a plurality of first features for reflecting the randomness of the first ciphertext, and combining the plurality of first features into a first feature set.

[0056] For example, use the NIST random test method to scan the first ciphertext to be identified CT1, CT2, ..., CT s , get the first feature set represents the jth feature of the i-th ciphertext.

[0057] The first feature set is analyzed using the random forest sub-model in the pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix.

[0058] The first leaf node index matrix and the first feature set are combined into a second feature set, including: encoding the first leaf node index matrix using a one-hot encoder to obtain a third feature set; normalizing the first feature set to obtain a fourth feature set; and combining the third feature set and the fourth feature set into a second feature set.

[0059] The second feature set is analyzed using a K-nearest neighbor sub-model in the encryption algorithm identification model to determine a target encryption algorithm used by the first ciphertext.

[0060] Optionally, after determining the target encryption algorithm used by the first ciphertext, a traffic security analysis may be performed on the first ciphertext according to the target encryption algorithm.

[0061] In an embodiment of the present application, a first ciphertext to be identified is obtained, and a first feature set corresponding to the first ciphertext is extracted; the first feature set is analyzed using a random forest sub-model in a pre-trained encryption algorithm identification model to obtain a first leaf node index matrix; the first leaf node index matrix and the first feature set are combined into a second feature set; the second feature set is analyzed using a K nearest neighbor sub-model in the encryption algorithm identification model to determine the target encryption algorithm used by the first ciphertext. In this way, by constructing multiple decision trees using a random forest sub-model, path information about data samples in a decision tree, i.e., a leaf node index matrix, is provided. The leaf node index matrix of the random forest sub-model provides an additional feature dimension, which helps the K nearest neighbor sub-model to more accurately distinguish encryption algorithms that are difficult to distinguish in the original feature space. The combination of the random forest sub-model and the K nearest neighbor sub-model enables the encryption algorithm identification model to more effectively identify different encryption algorithms, thereby solving the technical problem that it is difficult to accurately identify the encryption algorithm used by the ciphertext in the related technology, which affects the subsequent security analysis.

[0062] Example 2

[0063] According to an embodiment of the present application, a ciphertext encryption algorithm identification device for implementing the ciphertext encryption algorithm identification method in Embodiment 2 is also provided. Figure 2 As shown, the identification device of the ciphertext encryption algorithm at least includes: an acquisition module 21, a first analysis module 22, a combination module 23 and a second analysis module 24, wherein:

[0064] An acquisition module 21 is used to acquire a first ciphertext to be identified and extract a first feature set corresponding to the first ciphertext;

[0065] A first analysis module 22 is used to analyze the first feature set using a random forest sub-model in a pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix;

[0066] A combining module 23, used for combining the first leaf node index matrix and the first feature set into a second feature set;

[0067] The second analysis module 24 is used to analyze the second feature set by using the K nearest neighbor sub-model in the encryption algorithm recognition model to determine the target encryption algorithm used by the first ciphertext.

[0068] The functions of each module of the ciphertext encryption algorithm recognition device are described below in conjunction with a specific implementation process.

[0069] In order to solve the technical problem that it is difficult to accurately identify the encryption algorithm used in the ciphertext in the related art, which affects the subsequent security analysis, this application proposes to use an encryption algorithm identification model to identify the encryption algorithm. The model includes a random forest sub-model and a K nearest neighbor sub-model, and the encryption algorithm identification model is trained in the following way:

[0070] Optionally, the training process of the random forest sub-model is as follows:

[0071] S1, obtaining second ciphertexts of multiple known encryption algorithms;

[0072] S2, for each second ciphertext, extracting the fifth feature set corresponding to the second ciphertext as a training sample, and determining the encryption algorithm corresponding to the second ciphertext as a sample label;

[0073] S3, multiple training samples are combined into a sample set, and the sample set is divided into a training set, a validation set and a test set;

[0074] S4, using the bootstrap method to randomly extract multiple training subsets from the training set with replacement;

[0075] S5, for each training subset, using a preset decision tree algorithm to construct a decision tree corresponding to the training subset, and pruning the decision tree, wherein the preset decision tree algorithm includes: a classification and regression tree algorithm;

[0076] S6, composing the trained multiple decision trees into a random forest sub-model;

[0077] S7, using the validation set to evaluate the performance of the random forest sub-model, and adjusting the model parameters of the random forest sub-model based on the evaluation results, wherein the model parameters include at least one of the following: the number of decision trees, the maximum depth of each decision tree, the minimum number of sample splits, the minimum number of leaf node samples, and the feature sampling ratio. Repeat the evaluation and adjustment process, and after multiple iterations and evaluations, select the best performing model parameter configuration as the final random forest sub-model.

[0078] Optionally, the training process of the K nearest neighbor sub-model includes:

[0079] S1, for each fifth feature set in the training set, using the trained random forest sub-model to analyze the fifth feature set to obtain a second leaf node index matrix;

[0080] S2, encode the second leaf node index matrix using a one-hot encoder to obtain the sixth feature set;

[0081] S3, normalizing the fifth feature set to obtain a seventh feature set;

[0082] S4, combining the sixth feature set and the seventh feature set into an eighth feature set;

[0083] S5, using multiple eighth feature sets to train the K nearest neighbor sub-model, and using the validation set to evaluate the performance of the trained K nearest neighbor sub-model, repeating the training and evaluation process until satisfactory model performance is achieved, and obtaining the final K nearest neighbor sub-model.

[0084] Optionally, the trained random forest sub-model and K nearest neighbor sub-model are combined to obtain an encryption algorithm recognition model; the encryption algorithm recognition model is used to analyze each training sample in the test set to obtain an encryption algorithm classification result; the confusion matrix is ​​used to analyze the encryption algorithm classification result and the sample labels of each training sample in the test set to obtain a performance test result of the encryption algorithm recognition model.

[0085] Once the performance test results of the encryption algorithm identification model meet the preset standards, the model can be used in the actual encryption algorithm identification task. The specific steps are as follows:

[0086] First, an acquisition module acquires a first ciphertext to be identified and extracts a first feature set corresponding to the first ciphertext; including: using a variety of randomness testing methods of the National Institute of Standards and Technology (NIST) to test the first ciphertext, obtaining a plurality of first features for reflecting the randomness of the first ciphertext, and combining the plurality of first features into a first feature set.

[0087] The first analysis module uses the random forest sub-model in the pre-trained encryption algorithm recognition model to analyze the first feature set to obtain a first leaf node index matrix.

[0088] The combination module combines the first leaf node index matrix and the first feature set into a second feature set. Specifically: the first leaf node index matrix is ​​encoded using a one-hot encoder to obtain a third feature set; the first feature set is normalized to obtain a fourth feature set; and the third feature set and the fourth feature set are combined into a second feature set.

[0089] The second analysis module analyzes the second feature set using the K nearest neighbor sub-model in the encryption algorithm recognition model to determine the target encryption algorithm used by the first ciphertext.

[0090] Optionally, after determining the target encryption algorithm used by the first ciphertext, the method further includes: performing a traffic security analysis on the first ciphertext according to the target encryption algorithm.

[0091] It should be noted that each module in the identification device of the ciphertext encryption algorithm in the embodiment of the present application corresponds one by one to each implementation step of the identification method of the ciphertext encryption algorithm in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1, and will not be repeated here.

[0092] Example 3

[0093] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, the method for identifying the ciphertext encryption algorithm in Example 1 is implemented.

[0094] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the method for identifying the ciphertext encryption algorithm in Example 1 by running the computer program.

[0095] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the computer program executes the method for identifying the ciphertext encryption algorithm in Example 1 when running.

[0096] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the ciphertext encryption algorithm identification method in Example 1 through the computer program.

[0097] Specifically, when the computer program is running, the following steps are executed: obtaining a first ciphertext to be identified, and extracting a first feature set corresponding to the first ciphertext; analyzing the first feature set using a random forest sub-model in a pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix; combining the first leaf node index matrix and the first feature set into a second feature set; analyzing the second feature set using a K nearest neighbor sub-model in the encryption algorithm recognition model to determine the target encryption algorithm used by the first ciphertext.

[0098] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 3 The hardware structure block diagram of an electronic device for implementing a method for identifying a ciphertext encryption algorithm is shown. Figure 3As shown, the electronic device 30 may include one or more (302a, 302b, ..., 302n are used to illustrate) processors 302 (the processor 302 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 3 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 3 More or fewer components as shown, or with Figure 3 Different configurations shown.

[0099] It should be noted that the one or more processors 302 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 30. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0100] The memory 304 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the identification method of the ciphertext encryption algorithm in the embodiment of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 304 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 304 may further include a memory remotely arranged relative to the processor 302, and these remote memories may be connected to the electronic device 30 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0101] The transmission device 306 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 30. In one example, the transmission device 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 306 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0102] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 30 .

[0103] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0104] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0105] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0107] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0108] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0109] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for identifying a ciphertext encryption algorithm, characterized in that: include: Obtaining a first ciphertext to be identified, and extracting a first feature set corresponding to the first ciphertext; Analyze the first feature set using a random forest sub-model in a pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix; Combining the first leaf node index matrix and the first feature set into a second feature set; The second feature set is analyzed using a K nearest neighbor sub-model in the encryption algorithm identification model to determine a target encryption algorithm used by the first ciphertext.

2. The method according to claim 1, characterized in that: Extracting a first feature set corresponding to the first ciphertext includes: The first ciphertext is tested using multiple randomness testing methods of the National Institute of Standards and Technology (NIST) to obtain multiple first features for reflecting the randomness of the first ciphertext, and the multiple first features are combined into the first feature set.

3. The method according to claim 1, characterized in that Combining the first leaf node index matrix and the first feature set into a second feature set includes: Encode the first leaf node index matrix using a one-hot encoder to obtain a third feature set; Normalizing the first feature set to obtain a fourth feature set; The third feature set and the fourth feature set are combined into the second feature set.

4. The method according to claim 1, characterized in that The training process of the random forest sub-model includes: Obtaining second ciphertexts of multiple known encryption algorithms; For each second ciphertext, extract a fifth feature set corresponding to the second ciphertext as a training sample, and determine an encryption algorithm corresponding to the second ciphertext as a sample label; Combining a plurality of the training samples into a sample set, and dividing the sample set into a training set, a validation set, and a test set; A plurality of training subsets are randomly extracted with replacement from the training set using a bootstrap method; For each training subset, a decision tree corresponding to the training subset is constructed using a preset decision tree algorithm, and the decision tree is pruned, wherein the preset decision tree algorithm includes: a classification and regression tree algorithm; The trained multiple decision trees are combined into the random forest sub-model; The performance of the random forest sub-model is evaluated using the validation set, and the model parameters of the random forest sub-model are adjusted according to the evaluation results, wherein the model parameters include at least one of the following: the number of decision trees, the maximum depth of each decision tree, the minimum number of sample splits, the minimum number of leaf node samples, and the feature sampling ratio.

5. The method according to claim 4, characterized in that The training process of the K nearest neighbor sub-model includes: For each fifth feature set in the training set, the fifth feature set is analyzed using the trained random forest sub-model to obtain a second leaf node index matrix; the second leaf node index matrix is ​​encoded using a one-hot encoder to obtain a sixth feature set; the fifth feature set is normalized to obtain a seventh feature set; the sixth feature set and the seventh feature set are combined into an eighth feature set; The K nearest neighbor sub-model is trained using a plurality of the eighth feature sets, and the performance of the trained K nearest neighbor sub-model is evaluated using the validation set.

6. The method according to claim 5, characterized in that The method further comprises: The random forest sub-model and the K nearest neighbor sub-model after training are combined to obtain the encryption algorithm recognition model; Analyzing each training sample in the test set using the encryption algorithm recognition model to obtain an encryption algorithm classification result; The classification results of the encryption algorithm and the sample labels of each training sample in the test set are analyzed using a confusion matrix to obtain the performance test results of the encryption algorithm recognition model.

7. The method according to claim 1, characterized in that After determining the target encryption algorithm used by the first ciphertext, the method further includes: Perform traffic security analysis on the first ciphertext according to the target encryption algorithm.

8. A device for identifying a ciphertext encryption algorithm, characterized in that: include: An acquisition module, used to acquire a first ciphertext to be identified and extract a first feature set corresponding to the first ciphertext; A first analysis module, configured to analyze the first feature set using a random forest sub-model in a pre-trained encryption algorithm recognition model to obtain a first leaf node index matrix; A combining module, used for combining the first leaf node index matrix and the first feature set into a second feature set; The second analysis module is used to analyze the second feature set by using the K nearest neighbor sub-model in the encryption algorithm identification model to determine the target encryption algorithm used by the first ciphertext.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the method for identifying the ciphertext encryption algorithm described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the ciphertext encryption algorithm recognition method according to any one of claims 1 to 7 through the computer program.

Images