A Block Cipher Algorithm Recognition Method Based on Distance Metric and Ensemble Learning

Abstract

This invention discloses a method for identifying block cipher algorithms based on distance metrics and ensemble learning. The method first selects a public dataset, divides it to create a plaintext dataset, and then encrypts the plaintext dataset using a pre-defined block cipher algorithm to obtain a ciphertext dataset. It then calculates the distance metric between the plaintext and ciphertext, as well as the information entropy value of the ciphertext data, extracts ciphertext features to obtain a feature dataset, and establishes a corresponding label set. An ensemble learning classifier is constructed using a stacking method, trained on the feature dataset and labels, and optimized through experiments to find the optimal hyperparameter classifier model. Finally, for unknown ciphertext data, the trained ensemble learning classifier is used to identify the cipher algorithm. This invention employs a stacked ensemble as the classifier model algorithm and uses distance metrics and information entropy for feature extraction, which enhances the model's feature extraction capability and generalization ability, thereby improving the model's recognition accuracy.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically a method for identifying block cipher algorithms based on distance metrics and ensemble learning. Background Technology

[0002] Cryptographic algorithm identification is a method of identifying and classifying the specific encryption algorithm used in an encryption system by extracting features based solely on the ciphertext. This method analyzes the statistical, structural, and other implicit characteristics of the ciphertext to extract key indicators that reflect the unique behavior and patterns of different encryption algorithms.

[0003] In current research on machine learning-based cryptographic algorithms, feature extraction methods commonly use NIST randomness tests and entropy to analyze the randomness of ciphertext and use this as feature values ​​for identification and classification. To improve the efficiency of cryptographic algorithm recognition, machine learning methods are used as classification algorithms to construct classifiers, extract ciphertext features, and train models. Commonly used machine learning methods include logistic regression, decision trees, SVM, random forests, AdaBoost, and Bagging. However, in complex mixed ciphertext environments, randomness test metrics struggle to adapt to the diversity and complexity of ciphertexts, limiting the accuracy and effectiveness of feature extraction. Furthermore, a single classifier, when faced with ciphertext data of different types and complexities, may not be able to meet the recognition needs of all features, failing to fully leverage the model's advantages, resulting in insufficient robustness and generalization ability of the recognition results, and hindering effective improvement in classification results.

[0004] To address the aforementioned problems, this invention proposes a block cipher algorithm identification method based on distance metric and ensemble learning. By calculating the distance metric between ciphertext and plaintext from multiple parties and combining it with the ciphertext information entropy value to form a feature vector, an ensemble learning classifier is constructed using a stacking method for model training and testing, thereby improving the identification accuracy of encryption algorithms used in unknown ciphertext data. Summary of the Invention

[0005] This invention proposes a method for identifying block cipher algorithms based on distance metrics and ensemble learning. The method first selects a public dataset, divides it to create a plaintext dataset, and then encrypts the plaintext dataset using a pre-defined block cipher algorithm to obtain a ciphertext dataset. Next, it calculates the distance metric between the plaintext and ciphertext, as well as the information entropy value of the ciphertext data, extracts ciphertext features to obtain a feature dataset, and establishes a corresponding label set. An ensemble learning classifier is constructed using a stacking method, trained on the feature dataset and labels, and optimized through experiments to find the optimal hyperparameter classifier model. Finally, for unknown ciphertext data, the trained ensemble learning classifier is used to identify the cipher algorithm.

[0006] The technical solution to achieve the objective of this invention is:

[0007] A method for identifying block cipher algorithms based on distance metric and ensemble learning, specifically including the following steps:

[0008] (1) Data preparation and encryption;

[0009] Select a public dataset and divide it into different sizes to obtain a plaintext dataset. Then, encrypt all the plaintext data in the plaintext dataset using different block cipher algorithms to generate ciphertext data, thus forming a ciphertext dataset.

[0010] (2) Feature extraction based on distance metric and information entropy;

[0011] Calculate the distance metric between the plaintext vector and the ciphertext vector, as well as the information entropy value of the ciphertext vector, extract the ciphertext features, obtain the feature dataset, and set the corresponding cryptographic algorithm label for each feature data in the feature dataset;

[0012] (3) Construction and training of ensemble learning classifiers;

[0013] We construct an ensemble learning classifier based on the stacking method, selecting gradient boosting decision tree as the meta-classifier, and random forest, SVM, and decision tree as base classifiers. We train the model using feature datasets and labels, and find the optimal hyperparameter classifier model through experimental tuning.

[0014] (4) Password algorithm recognition is performed based on a trained ensemble learning classifier;

[0015] For unknown ciphertext data, a pre-trained ensemble learning classifier is used to identify block cipher algorithms.

[0016] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, the data preparation and encryption in step (1) are as follows:

[0017] (1.1) Select a public dataset as the plaintext dataset. The public dataset can be a text file, image file, etc.

[0018] (1.2) Select or divide pn files from the public dataset into three plaintext datasets of different sizes: 1KB, 16KB, and 32KB. The final plaintext dataset is Plaintext = {pl 1,1 ,pl 1,2 ,…,pl i,j ,…pl 3,pn}, where pl i,j Let i represent the j-th file of size i, where 1 ≤ i ≤ 3 and 1 ≤ j ≤ pn;

[0019] (1.3) Convert all files in the plaintext dataset Plaintext into binary format files;

[0020] (1.4) For all file data of all sizes in the plaintext dataset Plaintext, the open-source cryptographic libraries Crypto and GmSSL are used to encrypt the plaintext data using selected k block cipher algorithms, random keys, and CBC encryption mode, forming a ciphertext dataset Cipher={ciph} of size 3×pn×k. 1,1,1 ciph 1,1,2 ,…,ciph i,j,q ,…ciph 3,pn,k}, where ciph i,j,q This indicates that the j-th file pl of size i in the plaintext dataset Plaintext is processed by the q-th block cipher algorithm. i,j The encrypted ciphertext file has the following inequalities: 1≤i≤3, 1≤j≤pn, 1≤q≤k.

[0021] (1.5) Convert all ciphertext in the Cipher dataset into binary format files.

[0022] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, the feature extraction based on distance metric and information entropy in step (2) is as follows:

[0023] (2.1) To quantify the similarity or difference between plaintext and ciphertext, a distance metric between them is calculated to reflect the degree of change and characteristic differences imposed on the plaintext data by the encryption algorithm during the encryption process, thereby revealing the unique patterns and behavioral characteristics of different encryption algorithms when processing the same plaintext. Here, the ciphertext features are extracted by calculating the distance between the plaintext and ciphertext, as follows:

[0024] (2.1.1) To effectively extract ciphertext features, firstly, vectors are formed from each binary plaintext file and ciphertext file in the plaintext dataset and the ciphertext dataset, respectively, to better capture the information transformation and data distribution differences during the encryption process, thus constructing the feature vector of the ciphertext data; for the plaintext file p1 i,j This forms the plaintext vector pll. i,j Its length is len(pll) i,j ), then pll i,j (t) represents the t-th byte of the plaintext vector, 1≤t≤len(pll) i,j For encrypted files (ciph) i,j,q This forms the ciphertext vector ciphh i,j,q Its length is len(ciphh)i,j,q ) = len(pll i,j ), then ciphh i,j,q (t) represents the t-th byte of the ciphertext vector, 1≤t≤len(ciphh) i,j,q );

[0025] (2.1.2) Euclidean distance is the straight-line distance between two points in Euclidean space; in the field of machine learning, Euclidean distance is often used to evaluate the similarity or difference between data; here, the plaintext vector pll is used. i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Euclidean distance is used as a feature value of the distance metric, denoted as Fod(q, pll). i,j ciphh i,j,q The calculation formula is:

[0026]

[0027] For the Cipher dataset, calculate the Euclidean distance between all ciphertext files and their corresponding plaintext files to obtain the Euclidean distance feature set FOD = {Fod} of the Cipher dataset. 1,1,1 Fod 1,1,2 ,…,Fod i,j,q ,…Fod 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0028] For the eigenvalues ​​of FOD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, the corresponding tag value is set to Lod. i,j,q Lod i,j,q =q; corresponding to FOD, forming the Euclidean distance feature set label LOD = {Lod 1,1,1 Lod 1,1,2 ,…,Lod i,j,q ,…Lod 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0029] (2.1.3) Hamming distance is a method for measuring the number of different characters between two strings of equal length. It is calculated by performing an XOR operation on the two strings and counting the number of 1s; this is the Hamming distance value between the two variables. Hamming distance reflects the distribution of bit-level differences between the plaintext and ciphertext vectors after encryption. For example, Fhd(q, pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithmi,j,q The Hamming distance is calculated using the following formula:

[0030]

[0031] For the Cipher dataset, calculate the Hamming distance between all ciphertext files and their corresponding plaintext files to obtain the Hamming distance feature set FHD = {Fhd} of the Cipher dataset. 1,1,1 Fhd 1,1,2 ,…,Fhd i,j,q ,…Fhd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0032] For the eigenvalue Fhd in FHD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lhd. i,j,q Lhd i,j,q =q; corresponding to FHD, forming the Hamming distance feature set label LHD = {Lhd 1,1,1 Lhd 1,1,2 ,…,Lhd i,j,q ,…Lhd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0033] (2.1.4) Manhattan distance is a method for calculating the distance between two points in a regular grid. In two-dimensional coordinates, it represents the sum of the absolute axial distances of the two points in the standard coordinate system. Manhattan distance reveals the cumulative effect of the difference between plaintext and ciphertext after encryption. (Fmd(q, pll)) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Manhattan distance is calculated using the following formula:

[0034]

[0035] For the Cipher dataset, calculate the Manhattan distance between all ciphertext files and their corresponding plaintext files to obtain the Manhattan distance feature set FMD = {Fmd} of the Cipher dataset. 1,1,1 ,Fmd 1,1,2 ,…,Fmd i,j,q ,…Fmd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0036] For the eigenvalue Fmd in FMD i,j,qBased on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lmd. i,j,q Lmd i,j,q =q; corresponding to FMD, forming the Manhattan distance feature set label LMD = {Lmd 1,1,1 Lmd 1,1,2 ,…,Lmd i,j,q ,…Lmd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0037] (2.1.5) Cosine distance is a method in vector space that uses the cosine of the angle between two vectors as a measure of the difference between them; the closer the cosine value is to 1, the closer the angle is to 0 degrees, indicating that the two vectors are more similar; Fcd(q, pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The cosine distance is calculated using the following formula:

[0038]

[0039] For the Cipher dataset, calculate the cosine distance between all ciphertext files and their corresponding plaintext files to obtain the cosine distance feature set FCD = {Fcd} of the Cipher dataset. 1,1,1 ,Fcd 1,1,2 ,…,Fcd i,j,q ,…Fcd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0040] For the eigenvalue Fcd in FCD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lcd. i,j,q Lcd i,j,q =q; corresponding to FCD, forming a cosine distance feature set label LCD = {Lcd 1,1,1 ,Lcd 1,1,2 ,…,Lcd i,j,q ,…Lcd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0041] (2.2) Information entropy is commonly used to measure data uncertainty. In classification tasks, information entropy represents the uniformity of data distribution for each category. Information entropy is often used to evaluate the randomness of encrypted data; the higher the entropy value, the more dispersed the data distribution. For example, Fed(q, ciphh) i,j,q) represents the ciphertext vector ciphh encrypted using the q-th cryptographic algorithm. i,j,q The information entropy is calculated using the following formula:

[0042]

[0043] Where T represents the size of the symbol set, and ciphh is the ciphertext vector. i,j,q The number of different symbols in the ciphertext, where f represents the specific symbol value. For a binary ciphertext vector, f takes the value 0 or 1, therefore T = 2; ciphh i,j,q (f) indicates that in the ciphertext vector ciphh i,j,q The relative frequency or probability of the occurrence of a symbol with a value of f;

[0044] For the Cipher ciphertext dataset, calculate the information entropy of all ciphertext files to obtain the information entropy feature set FED = {Fed}. 1,1,1 Fed 1,1,2 ,…,Fed i,j,q ,…Fed 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0045] For the eigenvalue Fed in FED i,j,q Based on the q-th cryptographic algorithm used to encrypt the plaintext file, the corresponding tag value is set to Led. i,j,q ,Led i,j,q =q; corresponding to FED, forming the information entropy feature set label LED = {Led 1,1,1 ,Led 1,1,2 ,…,Led i,j,q ,…Led 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0046] (2.3) After calculating the distance metric feature value and information entropy feature value for all ciphertext files and their corresponding plaintext files in the Cipher ciphertext dataset, the feature dataset Fea is obtained, Fea = {FOD, FHD, FMD, FCD, FED}.

[0047] (2.4) Relative to the feature dataset Fea, the corresponding label set is Lab = {LOD, LHD, LMD, LCD, LED}. The label set Lab and the feature dataset Fea together constitute the dataset (Fea, Lab) used for training and testing the integrated learning classifier model.

[0048] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, the construction and training of the ensemble learning classifier in step (3) are as follows:

[0049] Ensemble learning is a machine learning method that improves the overall model performance by combining multiple base learners. Ensemble learning algorithms include voting, bagging, boosting, and stacking. Here, we choose stacking to build the classifier model. Stacking is a more complex ensemble method that constructs a multi-layered model structure, using the predictions of multiple base classifiers as new features, and inputting them into a meta-classifier for final prediction. Stacking effectively reduces overfitting and the bias of a single model, and can capture more complex feature relationships. The specific method is as follows:

[0050] (3.1) Data standardization processing;

[0051] For the existing datasets (Fea, Lab), the first step is to standardize them. The main purpose of standardization is to adjust the different feature scales of the data to a similar range, thereby eliminating bias caused by different units of measurement between features. Standardized data has a mean of 0 and a variance of 1. After standardization, the dataset is split into a training set (Fea) and a test set (Lab) using the `train_test_split` function from the open-source library sklearn in an 8:2 ratio. train Lab train ) and test set (Fea test Lab test );

[0052] (3.2) Define the base classifier;

[0053] Random forest, support vector machine, and decision tree were selected as base classifiers. Random forest is an ensemble learning model composed of multiple decision trees, possessing strong generalization ability and resistance to overfitting, but its interpretability is poor and the model is overly complex. Support vector machine performs excellently in handling high-dimensional or non-linear data, focusing on boundary samples, but it requires high parameter optimization and has a slow training speed. Decision tree is a simple and easily interpretable model that can capture complex patterns in the data, but single-tree models often have weak generalization ability and are prone to overfitting. For the three classifier models, the hyperparameters were set as follows through experimental tuning:

[0054] (3.2.1) 100 decision trees are generated using a random forest with a seed of 42 to ensure the repeatability of the results;

[0055] (3.2.2) Set the support vector machine probability to True to enable probability estimation and output the probability of each class. Set the kernel to RBF, that is, use radial basis function as kernel function. RBF kernel can handle non-linear data and achieve better classification effect by mapping the original features to a high-dimensional space.

[0056] (3.2.3) The decision tree is set to a random seed of 42 to ensure the repeatability of the results;

[0057] (3.3) Select a meta-classifier;

[0058] Gradient boosting decision trees (GBDT) were chosen as the meta-classifier for stacked ensembles. GBDT can model complex feature interactions and nonlinear relationships, improving the overall performance of the model. Through gradient descent, the errors of the previous model are gradually corrected, improving classification accuracy. Through experimental optimization, the number of decision trees n_estimators was set to 100, the learning rate was set to 0.3, and the random generator seed was set to 42.

[0059] (3.4) Construct and train the classifier model;

[0060] Based on the selected base classifiers and meta-classifiers, a stacked ensemble approach is used, inputting the training set (Fea) train Lab train The stacked ensemble learning classifier is trained by setting the following parameters: Passthrough=True, which passes the original features and base classifier outputs to the meta-classifier; Cv=5, which uses five-fold cross-validation to address the issue of overfitting the prediction results of the base classifiers when using GBDT as the meta-classifier; Stack_method=auto, which sets the stacking method to automatic stacking and automatically selects the most suitable prediction output method based on the available methods of the base classifiers; finally, a trained ensemble learning classifier is obtained.

[0061] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, step (4) involves identifying the cipher algorithm based on a trained ensemble learning classifier. The specific steps are as follows:

[0062] (4.1) Input ciphertext data test set (Fea) test Lab test (This information is then fed into the trained ensemble learning classifier.)

[0063] (4.2) Based on the trained ensemble learning classifier, the prediction method of the classifier model is used to predict the test set and generate the predicted label vector y. predIt predicts the label value corresponding to each feature data in the test set, and then determines the cryptographic algorithm used when the ciphertext data is encrypted based on the label value.

[0064] The beneficial effects of this invention are:

[0065] (1) The present invention provides a block cipher algorithm identification method based on distance metric and ensemble learning. It uses a variety of different distance metric calculation methods to quantify the distribution and interrelationship of plaintext data and ciphertext data in the feature space, mines the unique features generated by different cryptographic algorithms in the encryption process, captures the subtle differences and patterns shown by various cryptographic algorithms when generating ciphertext, and improves the feature extraction capability.

[0066] (2) The method of the present invention uses stacked ensemble learning to construct a multi-level classifier model. By combining the prediction results of multiple base classifiers and using a high-level meta-classifier for final decision-making, it is beneficial to optimize and integrate the prediction information of different models and improve the overall classification accuracy.

[0067] (3) The method of the present invention has good versatility, is applicable to various encryption scenarios and data distribution environments, and has good classification effect. Attached Figure Description

[0068] Figure 1 This is a flowchart of a block cipher algorithm identification method based on distance metric and ensemble learning according to the present invention;

[0069] Figure 2 This is a flowchart of the feature extraction process based on distance metric and information entropy in this invention.

[0070] Specific implementation examples

[0071] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but this is not intended to limit the present invention. Example

[0072] A method for identifying block cipher algorithms based on distance metric and ensemble learning, referring to... Figure 1 This includes the following steps:

[0073] (1) Data preparation and encryption;

[0074] (2) Feature extraction based on distance metric and information entropy;

[0075] (3) Construction and training of ensemble learning classifiers;

[0076] (4) Password algorithm recognition is performed based on the trained ensemble learning classifier.

[0077] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, the data preparation and encryption in step (1) are as follows:

[0078] (1.1) Select a public dataset as the plaintext dataset. The public dataset can be a text file, image file, etc.

[0079] (1.2) Select or divide pn files from the public dataset into three plaintext datasets of different sizes: 1KB, 16KB, and 32KB. The final plaintext dataset is Plaintext = {pl 1,1 ,pl 1,2 ,…,pl i,j ,…pl 3,pn}, where pl i,j Let i represent the j-th file of size i, where 1 ≤ i ≤ 3 and 1 ≤ j ≤ pn;

[0080] (1.3) Convert all files in the plaintext dataset Plaintext into binary format files;

[0081] (1.4) For all file data of all sizes in the plaintext dataset Plaintext, the open-source cryptographic libraries Crypto and GmSSL are used to encrypt the plaintext data using selected k block cipher algorithms, random keys, and CBC encryption mode, forming a ciphertext dataset Cipher={ciph} of size 3×pn×k. 1,1,1 ciph 1,1,2 ,…,ciph i,j,q ,…ciph 3,pn,k}, where ciph i,j,q This indicates that the j-th file pl of size i in the plaintext dataset Plaintext is processed by the q-th block cipher algorithm. i,j The encrypted ciphertext file has the following inequalities: 1≤i≤3, 1≤j≤pn, 1≤q≤k.

[0082] (1.5) Convert all ciphertext in the Cipher dataset into binary format files.

[0083] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, the feature extraction based on distance metric and information entropy in step (2) refers to... Figure 2 The specific steps are as follows:

[0084] (2.1) To quantify the similarity or difference between plaintext and ciphertext, a distance metric between them is calculated to reflect the degree of change and characteristic differences imposed on the plaintext data by the encryption algorithm during the encryption process, thereby revealing the unique patterns and behavioral characteristics of different encryption algorithms when processing the same plaintext. Here, the ciphertext features are extracted by calculating the distance between the plaintext and ciphertext, as follows:

[0085] (2.1.1) To effectively extract ciphertext features, firstly, vectors are formed from each binary plaintext file and ciphertext file in the plaintext dataset and the ciphertext dataset, respectively, to better capture the information transformation and data distribution differences during the encryption process, thus constructing the feature vector of the ciphertext data; for the plaintext file p1 i,j This forms the plaintext vector pll. i,j Its length is len(pll) i,j ), then pll i,j (t) represents the t-th byte of the plaintext vector, 1≤t≤len(pll) i,j For encrypted files (ciph) i,j,q This forms the ciphertext vector ciphh i,j,q Its length is len(ciphh) i,j,q ) = len(pll i,j ), then ciphh i,j,q (t) represents the t-th byte of the ciphertext vector, 1≤t≤len(ciphh) i,j,q );

[0086] (2.1.2) Euclidean distance is the straight-line distance between two points in Euclidean space; in the field of machine learning, Euclidean distance is often used to evaluate the similarity or difference between data; here, the plaintext vector pll is used. i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Euclidean distance is used as a feature value of the distance metric, denoted as Fod(q, pll). i,j ciphh i,j,q The calculation formula is:

[0087]

[0088] For the Cipher dataset, calculate the Euclidean distance between all ciphertext files and their corresponding plaintext files to obtain the Euclidean distance feature set FOD = {Fod} of the Cipher dataset. 1,1,1 Fod 1,1,2 ,…,Fod i,j,q ,…Fod 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0089] For the eigenvalues ​​of FOD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, the corresponding tag value is set to Lod. i,j,q Lod i,j,q =q; corresponding to FOD, forming the Euclidean distance feature set label LOD = {Lod 1,1,1 Lod 1,1,2 ,…,Lod i,j,q ,…Lod 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0090] (2.1.3) Hamming distance is a method for measuring the number of different characters between two strings of equal length. It is calculated by performing an XOR operation on the two strings and counting the number of 1s; this is the Hamming distance value between the two variables. Hamming distance reflects the distribution of bit-level differences between the plaintext and ciphertext vectors after encryption. For example, Fhd(q, pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Hamming distance is calculated using the following formula:

[0091]

[0092] For the Cipher dataset, calculate the Hamming distance between all ciphertext files and their corresponding plaintext files to obtain the Hamming distance feature set FHD = {Fhd} of the Cipher dataset. 1,1,1 Fhd 1,1,2 ,…,Fhd i,j,q ,…Fhd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0093] For the eigenvalue Fhd in FHD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lhd. i,j,q Lhd i,j,q =q; corresponding to FHD, forming the Hamming distance feature set label LHD = {Lhd 1,1,1 Lhd 1,1,2 ,…,Lhd i,j,q ,…Lhd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0094] (2.1.4) Manhattan distance is a method for calculating the distance between two points in a regular grid. In two-dimensional coordinates, it represents the sum of the absolute axial distances of the two points in the standard coordinate system. Manhattan distance reveals the cumulative effect of the difference between plaintext and ciphertext after encryption. (Fmd(q, pll)) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Manhattan distance is calculated using the following formula:

[0095]

[0096] For the Cipher dataset, calculate the Manhattan distance between all ciphertext files and their corresponding plaintext files to obtain the Manhattan distance feature set FMD = {Fmd} of the Cipher dataset. 1,1,1 ,Fmd 1,1,2 ,…,Fmd i,j,q ,…Fmd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0097] For the eigenvalue Fmd in FMD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lmd. i,j,q Lmd i,j,q =q; corresponding to FMD, forming the Manhattan distance feature set label LMD = {Lmd 1,1,1 Lmd 1,1,2 ,…,Lmd i,j,q ,…Lmd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0098] (2.1.5) Cosine distance is a method in vector space that uses the cosine of the angle between two vectors as a measure of the difference between them; the closer the cosine value is to 1, the closer the angle is to 0 degrees, indicating that the two vectors are more similar; Fcd(q, pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The cosine distance is calculated using the following formula:

[0099]

[0100] For the Cipher dataset, calculate the cosine distance between all ciphertext files and their corresponding plaintext files to obtain the cosine distance feature set FCD = {Fcd} of the Cipher dataset.1,1,1 ,Fcd 1,1,2 ,…,Fcd i,j,q ,…Fcd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0101] For the eigenvalue Fcd in FCD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lcd. i,j,q Lcd i,j,q =q; corresponding to FCD, forming a cosine distance feature set label LCD = {Lcd 1,1,1 ,Lcd 1,1,2 ,…,Lcd i,j,q ,…Lcd 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0102] (2.2) Information entropy is commonly used to measure data uncertainty. In classification tasks, information entropy represents the uniformity of data distribution for each category. Information entropy is often used to evaluate the randomness of encrypted data; the higher the entropy value, the more dispersed the data distribution. For example, Fed(q, ciphh) i,j,q ) represents the ciphertext vector ciphh encrypted using the q-th cryptographic algorithm. i,j,q The information entropy is calculated using the following formula:

[0103]

[0104] Where T represents the size of the symbol set, and ciphh is the ciphertext vector. i,j,q The number of different symbols in the ciphertext, where f represents the specific symbol value. For a binary ciphertext vector, f takes the value 0 or 1, therefore T = 2; ciphh i,j,q (f) indicates that in the ciphertext vector ciphh i,j,q The relative frequency or probability of the occurrence of a symbol with a value of f;

[0105] For the Cipher ciphertext dataset, calculate the information entropy of all ciphertext files to obtain the information entropy feature set FED = {Fed}. 1,1,1 Fed 1,1,2 ,…,Fed i,j,q ,…Fed 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0106] For the eigenvalue Fed in FED i,j,q Based on the q-th cryptographic algorithm used to encrypt the plaintext file, the corresponding tag value is set to Led. i,j,q ,Led i,j,q=q; corresponding to FED, forming the information entropy feature set label LED = {Led 1,1,1 ,Led 1,1,2 ,…,Led i,j,q ,…Led 3,pn,k}, where 1≤i≤3, 1≤j≤pn, 1≤q≤k;

[0107] (2.3) After calculating the distance metric feature value and information entropy feature value for all ciphertext files and their corresponding plaintext files in the Cipher ciphertext dataset, the feature dataset Fea is obtained, Fea = {FOD, FHD, FMD, FCD, FED}.

[0108] (2.4) Relative to the feature dataset Fea, the corresponding label set is Lab = {LOD, LHD, LMD, LCD, LED}. The label set Lab and the feature dataset Fea together constitute the dataset (Fea, Lab) used for training and testing the integrated learning classifier model.

[0109] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, the construction and training of the ensemble learning classifier in step (3) are as follows:

[0110] Ensemble learning is a machine learning method that improves the overall model performance by combining multiple base learners. Ensemble learning algorithms include voting, bagging, boosting, and stacking. Here, we choose stacking to build the classifier model. Stacking is a more complex ensemble method that constructs a multi-layered model structure, using the predictions of multiple base classifiers as new features, and inputting them into a meta-classifier for final prediction. Stacking effectively reduces overfitting and the bias of a single model, and can capture more complex feature relationships. The specific method is as follows:

[0111] (3.1) Data standardization processing;

[0112] For the existing datasets (Fea, Lab), the first step is to standardize them. The main purpose of standardization is to adjust the different feature scales of the data to a similar range, thereby eliminating bias caused by different units of measurement between features. Standardized data has a mean of 0 and a variance of 1. After standardization, the dataset is split into a training set (Fea) and a test set (Lab) using the `train_test_split` function from the open-source library sklearn in an 8:2 ratio. train Lab train ) and test set (Fea test Lab test);

[0113] (3.2) Define the base classifier;

[0114] Random forest, support vector machine, and decision tree were selected as base classifiers. Random forest is an ensemble learning model composed of multiple decision trees, possessing strong generalization ability and resistance to overfitting, but its interpretability is poor and the model is overly complex. Support vector machine performs excellently in handling high-dimensional or non-linear data, focusing on boundary samples, but it requires high parameter optimization and has a slow training speed. Decision tree is a simple and easily interpretable model that can capture complex patterns in the data, but single-tree models often have weak generalization ability and are prone to overfitting. For the three classifier models, the hyperparameters were set as follows through experimental tuning:

[0115] (3.2.1) 100 decision trees are generated using a random forest with a seed of 42 to ensure the repeatability of the results;

[0116] (3.2.2) Set the support vector machine probability to True to enable probability estimation and output the probability of each class. Set the kernel to RBF, that is, use radial basis function as kernel function. RBF kernel can handle non-linear data and achieve better classification effect by mapping the original features to a high-dimensional space.

[0117] (3.2.3) The decision tree is set to a random seed of 42 to ensure the repeatability of the results;

[0118] (3.3) Select a meta-classifier;

[0119] Gradient boosting decision trees (GBDT) were chosen as the meta-classifier for stacked ensembles. GBDT can model complex feature interactions and nonlinear relationships, improving the overall performance of the model. Through gradient descent, the errors of the previous model are gradually corrected, improving classification accuracy. Through experimental optimization, the number of decision trees n_estimators was set to 100, the learning rate was set to 0.3, and the random generator seed was set to 42.

[0120] (3.4) Construct and train the classifier model;

[0121] Based on the selected base classifiers and meta-classifiers, a stacked ensemble approach is used, inputting the training set (Fea) train Lab trainThe stacked ensemble learning classifier is trained by setting the following parameters: Passthrough=True, which passes the original features and base classifier outputs to the meta-classifier; Cv=5, which uses five-fold cross-validation to address the issue of overfitting the prediction results of the base classifiers when using GBDT as the meta-classifier; Stack_method=auto, which sets the stacking method to automatic stacking and automatically selects the most suitable prediction output method based on the available methods of the base classifiers; finally, a trained ensemble learning classifier is obtained.

[0122] In the block cipher algorithm identification method based on distance metric and ensemble learning of the present invention, step (4) involves identifying the cipher algorithm based on a trained ensemble learning classifier. The specific steps are as follows:

[0123] (4.1) Input ciphertext data test set (Fea) test Lab test (This information is then fed into the trained ensemble learning classifier.)

[0124] (4.2) Based on the trained ensemble learning classifier, the prediction method of the classifier model is used to predict the test set and generate the predicted label vector y. pred It predicts the label value corresponding to each feature data in the test set, and then determines the cryptographic algorithm used when the ciphertext data is encrypted based on the label value.

Claims

1. A method for identifying block cipher algorithms based on distance metric and ensemble learning, characterized in that, Includes the following steps: (1) Data preparation and encryption; Select a public dataset and divide it into different sizes to obtain a plaintext dataset. Then, encrypt all the plaintext data in the plaintext dataset using different block cipher algorithms to generate ciphertext data, thus forming a ciphertext dataset. Public datasets are either text files or image files; (2) Feature extraction based on distance metric and information entropy; Calculate the distance metric between the plaintext vector and the ciphertext vector, as well as the information entropy value of the ciphertext vector. The distance metrics include Euclidean distance, Hamming distance, Manhattan distance, and cosine distance. Extract ciphertext features to obtain a feature dataset, and set a corresponding cryptographic algorithm label for each feature data in the feature dataset. (3) Construction and training of ensemble learning classifiers; We construct an ensemble learning classifier based on the stacking method, selecting gradient boosting decision tree as the meta-classifier, and random forest, SVM, and decision tree as base classifiers. We train the model using feature datasets and labels, and find the optimal hyperparameter classifier model through experimental tuning. (4) Password algorithm recognition is performed based on a trained ensemble learning classifier; For unknown ciphertext data, based on the extracted features, a trained ensemble learning classifier is used to identify block cipher algorithms.

2. The method for identifying block cipher algorithms based on distance metric and ensemble learning according to claim 1, characterized in that, The data preparation and encryption described in step (1) further include the following steps: (1.1) Select or divide pn files from the public dataset into three plaintext datasets of different sizes: 1KB, 16KB, and 32KB. The final plaintext dataset is Plaintext = {pl 1,1 ,pl 1,2 ,…,pl i,j ,…pl 3,pn }, where pl i,j Let i represent the j-th file of size i, where 1 ≤ i ≤ 3 and 1 ≤ j ≤ pn; (1.2) Convert all files in the plaintext dataset Plaintext into binary format files; (1.3) For all file data of all sizes in the plaintext dataset Plaintext, the open-source cryptographic libraries Crypto and GmSSL are used to encrypt the plaintext data using selected k block cipher algorithms, random keys, and CBC encryption mode, forming a ciphertext dataset Cipher={ciph} of size 3×pn×k. 1,1,1 ciph 1,1,2 ,…,ciph i,j,q ,…ciph 3,pn,k }, where ciph i,j,q This indicates that the j-th file pl of size i in the plaintext dataset Plaintext is processed by the q-th block cipher algorithm. i,j The encrypted ciphertext file has the following inequalities: 1≤i≤3, 1≤j≤pn, 1≤q≤k. (1.4) Convert all ciphertext in the Cipher dataset into binary format files.

3. The method for identifying block cipher algorithms based on distance metric and ensemble learning according to claim 2, characterized in that, The feature extraction based on distance metric and information entropy described in step (2) is specifically implemented as follows: (2.1) By calculating the distance between the plaintext and the ciphertext, the features of the ciphertext are extracted. The specific method is as follows: (2.1.1) First, form vectors from each binary plaintext file and ciphertext file in the plaintext dataset and the ciphertext dataset Cipher, respectively, to construct the feature vector of the ciphertext data; for the plaintext file p1 i,j This forms the plaintext vector pll. i,j Its length is len(pll) i,j ), then pll i,j (t) represents the t-th byte of the plaintext vector, 1≤t≤len(pll) i,j For encrypted files (ciph) i,j,q This forms the ciphertext vector ciphh i,j,q Its length is len(ciphh) i,j,q ) = len(pll i,j ), then ciphh i,j,q (t) represents the t-th byte of the ciphertext vector, 1≤t≤len(ciphh) i,j,q ); (2.1.2) Transfer the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Euclidean distance is used as a feature value of the distance metric, denoted as Fod(q, pll). i,j ciphh i,j,q The calculation formula is: For the Cipher dataset, calculate the Euclidean distance between all ciphertext files and their corresponding plaintext files to obtain the Euclidean distance feature set FOD = {Fod} of the Cipher dataset. 1,1,1 Fod 1,1,2 ,…,Fod i,j,q ,…Fod 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; For the eigenvalues ​​of FOD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, the corresponding tag value is set to Lod. i,j,q Lod i,j,q =q; corresponding to FOD, forming the Euclidean distance feature set label LOD = {Lod 1,1,1 Lod 1,1,2 Lod i,j,q ,…Lod 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; (2.1.3) Fhd(q,pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Hamming distance is calculated using the following formula: For the Cipher dataset, calculate the Hamming distance between all ciphertext files and their corresponding plaintext files to obtain the Hamming distance feature set FHD = {Fhd} of the Cipher dataset. 1,1,1 Fhd 1,1,2 ,…,Fhd i,j,q ,…Fhd 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; For the eigenvalue Fhd in FHD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lhd. i,j,q Lhd i,j,q =q; corresponding to FHD, forming the Hamming distance feature set label LHD = {Lhd 1,1,1 ,Lhd 1,1,2 ,…,Lhd i,j,q ,…Lhd 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; (2.1.4) with Fmd(q,pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The Manhattan distance is calculated using the following formula: For the Cipher dataset, calculate the Manhattan distance between all ciphertext files and their corresponding plaintext files to obtain the Manhattan distance feature set FMD = {Fmd} of the Cipher dataset. 1,1,1 ,Fmd 1,1,2 ,…,Fmd i,j,q ,…Fmd 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; For the eigenvalue Fmd in FMD i,j,q Based on the qth cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lmd. i,j,q Lmd i,j,q =q; corresponding to FMD, forming the Manhattan distance feature set label LMD = {Lmd 1,1,1 Lmd 1,1,2 ,…,Lmd i,j,q ,…Lmd 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; (2.1.5) with Fcd(q,pll) i,j ciphh i,j,q ) represents the plaintext vector pll i,j and the ciphertext vector ciphh formed by encrypting with the qth cryptographic algorithm i,j,q The cosine distance is calculated using the following formula: For the Cipher dataset, calculate the cosine distance between all ciphertext files and their corresponding plaintext files to obtain the cosine distance feature set FCD = {Fcd} of the Cipher dataset. 1,1,1 ,Fcd 1,1,2 ,…,Fcd i,j,q ,…Fcd 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; For the eigenvalue Fcd in FCD i,j,q Based on the q-th cryptographic algorithm used to encrypt the plaintext file, set the corresponding tag value to Lcd. i,j,q Lcd i,j,q =q; corresponding to FCD, forming a cosine distance feature set label LCD = {Lcd 1,1,1 ,Lcd 1,1,2 ,…,Lcd i,j,q ,…Lcd 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; (2.2) Fed(q,ciphh) i,j,q ) represents the ciphertext vector ciphh encrypted using the q-th cryptographic algorithm. i,j,q The information entropy is calculated using the following formula: Where T represents the size of the symbol set, and ciphh is the ciphertext vector. i,j,q The number of different symbols in the ciphertext, where f represents the specific symbol value. For a binary ciphertext vector, f takes the value 0 or 1, therefore T = 2; ciphh i,j,q (f) indicates that in the ciphertext vector ciphh i,j,q The relative frequency or probability of the occurrence of a symbol with a value of f; For the Cipher ciphertext dataset, calculate the information entropy of all ciphertext files to obtain the information entropy feature set FED = {Fed}. 1,1,1 Fed 1,1,2 ,…,Fed i,j,q ,…Fed 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; For the eigenvalue Fed in FED i,j,q Based on the q-th cryptographic algorithm used to encrypt the plaintext file, the corresponding tag value is set to Led. i,j,q ,Led i,j,q =q; corresponding to FED, forming the information entropy feature set label LED = {Led 1,1,1 ,Led 1,1,2 ,…,Led i,j,q ,…Led 3,pn,k }, where 1≤i≤3, 1≤j≤pn, 1≤q≤k; (2.3) After calculating the distance metric feature value and information entropy feature value for all ciphertext files and their corresponding plaintext files in the Cipher ciphertext dataset, the feature dataset Fea is obtained, Fea = {FOD, FHD, FMD, FCD, FED}. (2.4) Relative to the feature dataset Fea, the corresponding label set is Lab = {LOD, LHD, LMD, LCD, LED}. The label set Lab and the feature dataset Fea together constitute the dataset (Fea, Lab) used for training and testing the ensemble learning classifier model.

4. The method for identifying block cipher algorithms based on distance metric and ensemble learning according to claim 3, characterized in that, The construction and training of the ensemble learning classifier described in step (3) are as follows: (3.1) Data standardization processing; For the existing datasets (Fea, Lab), we first standardize them. After standardization, we use the `train_test_split` function from the open-source library sklearn to split them into a training set (Fea) and a test set (Lab) in an 8:2 ratio. train Lab train ) and test set (Fea test Lab test ); (3.2) Define the base classifier; Random forest, support vector machine, and decision tree were selected as base classifiers, and the hyperparameters were set as follows after experimental tuning: (3.2.1) 100 decision trees are generated using a random forest with a seed of 42 to ensure the repeatability of the results; (3.2.2) Set the support vector machine probability to True to enable probability estimation and output the probability of each class. Set the kernel to RBF, that is, use radial basis function as kernel function. RBF kernel can handle non-linear data and achieve better classification effect by mapping the original features to a high-dimensional space. (3.2.3) The decision tree is set to a random seed of 42 to ensure the repeatability of the results; (3.3) Select a meta-classifier; Gradient boosting decision tree (GBDT) was chosen as the meta-classifier for stacked ensemble. GBDT can model complex feature interactions and nonlinear relationships, improve the overall performance of the model, and improve classification accuracy by gradually correcting the errors of the previous model through the gradient descent method. Through experimental optimization, the number of decision trees n_estimators was set to 100, the learning rate was set to 0.3, and the random generator seed was set to 42. (3.4) Construct and train the classifier model; Based on the selected base classifiers and meta-classifiers, a stacked ensemble approach is used, inputting the training set (Fea) train Lab train The stacked ensemble learning classifier is trained by setting the following parameters: Passthrough=True, which passes the original features and base classifier outputs to the meta-classifier; Cv=5, which uses five-fold cross-validation to address the issue of overfitting the prediction results of the base classifiers when using GBDT as the meta-classifier; Stack_method=auto, which sets the stacking method to automatic stacking and automatically selects the most suitable prediction output method based on the available methods of the base classifiers; finally, a trained ensemble learning classifier is obtained.

5. The method for identifying block cipher algorithms based on distance metric and ensemble learning according to claim 4, characterized in that, Step (4) involves password recognition based on a trained ensemble learning classifier. The specific steps are as follows: (4.1) Input ciphertext data test set (Fea) test Lab test (This information is then fed into the trained ensemble learning classifier.) (4.2) Based on the trained ensemble learning classifier, the prediction method of the classifier model is used to predict the test set and generate the predicted label vector y. pred It predicts the label value corresponding to each feature data in the test set, and then determines the cryptographic algorithm used when the ciphertext data is encrypted based on the label value.

Images