Neural network-based multi-set cryptographic analysis method and system

Abstract

The invention provides a multi-set cryptographic analysis method and system based on a neural network, and the method comprises the steps: taking an active half-byte unit as an initial plaintext differential structure, encrypting a set round through a target encryption algorithm, generating a multi-set ciphertext sample, carrying out the pairing of all ciphertexts, calculating a differential value between the ciphertext pairs, and forming input data; compressing the input data according to the influence of each half-byte unit on the accuracy of the neural network discriminator; inputting the compressed input data into a pre-trained neural network discriminator, and extracting differential-linear cryptographic features contained in multiple sets; a residual structure containing multiple attention layers and a full-connection residual module are introduced into the neural network discriminator. According to the method, differential-linear features in multiple sets can be directly learned, and statistical characteristics in the multiple sets of data can be more effectively captured, so that the upper limit of the number of analysis rounds or the classification accuracy of a neural network discriminator is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of cryptanalysis, and particularly relates to a multiple set cryptanalysis method and system based on a neural network. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute prior art.

[0003] In cryptanalysis, a multiple set refers to a set of ciphertexts generated by constructing a specific structure of plaintext input. Specifically, when constructing the plaintext, only one designated half-byte cell in the plaintext structure is activated, and the remaining bytes remain constant or fixed. After encrypting this type of plaintext input, the resulting set of ciphertexts constitutes a multiple set. Since only one half-byte cell has controllable changes, the input structure formed can induce specific cryptographic characteristics to propagate in the ciphertext, allowing the set of ciphertexts to contain structural information for statistical learning and analysis.

[0004] Existing neural network-based cryptanalysis methods mainly focus on learning integral cryptographic characteristics from the ciphertext information contained in the multiple set to effectively distinguish the encryption structure. However, when targeting cryptographic structures with high diffusion characteristics and no obvious byte block characteristics, this type of method has difficulty effectively extracting integral characteristics, resulting in a significant reduction in the effectiveness of integral attacks and making it difficult to effectively distinguish the target encryption structure. SUMMARY

[0005] To solve the above problems, the present application proposes a multiple set cryptanalysis method and system based on a neural network. The present application can directly learn differential-linear characteristics in multiple sets, more effectively capture statistical characteristics in multiple set data, and significantly improve the upper limit of the analysis round of the neural network discriminator or the classification accuracy. The present application can maintain strong recognition ability and attack effect when facing deeper rounds or more complex encryption algorithms, expanding the applicability and effectiveness of neural network cryptanalysis in high security strength scenarios.

[0006] According to some embodiments, the present application adopts the following technical solutions: A multiple set cryptanalysis method based on a neural network, comprising the following steps: An active half-byte cell is used as an initial plaintext differential structure, and after a set number of rounds of encryption by the target encryption algorithm, a multiple set ciphertext sample is generated. The ciphertexts are paired two by two, the differential values between the ciphertext pairs are calculated, and input data is formed; According to the influence of each half-byte cell on the accuracy of the neural network discriminator, the input data is compressed; The compressed input data is fed into a pre-trained neural network discriminator to extract differential-linear cryptographic features contained in the multiset. The neural network discriminator introduces a residual structure containing a multi-head attention layer and a fully connected residual module. By adding the output of the multi-head attention layer to its input, skip connections are achieved to enhance gradient propagation and feature reuse capabilities. The fully connected residual module extracts potential fine-grained correlations in the ciphertext differential sequence to enhance the neural network discriminator's learning and representation capabilities for cryptographic features.

[0007] As an alternative implementation, after a set number of encryption rounds using the target encryption algorithm, a multiset of ciphertext samples is generated. The process of pairing each ciphertext pair and calculating the difference between them to form the input data includes: when only one half-byte unit in the plaintext is active, the internal state values ​​after the r-th round of encryption constitute a multiset. Multiple sets of ciphertext differences are constructed by pairing each set of ciphertexts. This represents the total number of ciphertext differences. The bit length representing the difference is used to construct the input layer of the neural network discriminator into a dimension of . matrix.

[0008] As an alternative implementation, the process of compressing the input data according to the impact of each half-byte unit on the accuracy of the neural network discriminator includes: gradually reducing the number of half-byte units in the output difference and monitoring the corresponding model accuracy changes; if the removal of a half-byte unit causes the model accuracy to drop by more than a set value, then the half-byte unit is retained, otherwise it is discarded.

[0009] As an alternative implementation, the process of compressing the input data based on the impact of each half-byte unit on the accuracy of the neural network discriminator includes: selecting only the most effective first... Each output mask is used for input construction while preserving cryptographic features. If there are a total of... An output mask, denoted as The new input format is a sequence formed by sequentially combining the output masks with the state values ​​of each ciphertext half-byte unit in the target round.

[0010] As an alternative implementation, the training process of the neural network discriminator includes: Use a random number generator to generate training, validation, and test data. When constructing the training data, set... Indicates the first One key, Indicates the first Plain text, in which In each dataset, the sample labels and Each accounts for half, let The bit length of a single plaintext cell. For the total bit length of the cryptographic state, Each of the samples Only one plaintext nibble unit is activated, while the remaining positions remain fixed, thus constructing a plaintext multiset. This multiset is then processed... After round encryption, we get Given a set of ciphertexts, perform pairwise XOR operations on all ciphertexts, concatenate all the difference results, and form an input vector; for each ciphertext... The sample is randomly sampled from a uniform distribution to generate a sample of size . The encrypted multiset is used as a reference input.

[0011] As an alternative implementation, the neural network discriminator is a neural network model based on the Transformer architecture, including an input module, a multi-head attention module, a feedforward-like neural network structure, and an output module connected in sequence. The multi-head attention module adopts a residual structure containing a multi-head attention layer, followed by a normalization layer. The feedforward-like neural network structure includes two fully connected hidden layers, and a normalization operation layer is added after the first hidden layer. The output layer includes a fully connected layer and an activation function.

[0012] As an alternative implementation, the residual structure of the multi-head attention layer of the neural network discriminator uses four attention heads, each with the same key and query dimensions, which match the dimensions of the ciphertext difference sequence.

[0013] A multiset cryptanalysis system based on neural networks, comprising: The input generation module is configured to use an active half-byte unit as the initial plaintext difference structure, encrypt it through the target encryption algorithm for a set number of rounds to generate a multiset ciphertext sample, pair each ciphertext pair, calculate the difference value between the ciphertext pairs, and form the input data. The input filtering module is configured to compress the input data based on the impact of each half-byte unit on the accuracy of the neural network discriminator; The cryptanalysis module is configured to input compressed input data into a pre-trained neural network discriminator to extract differential-linear cryptographic features implied in multiple sets. The neural network discriminator introduces a residual structure containing a multi-head attention layer and a fully connected residual module. By adding the output of the multi-head attention layer to its input, skip connections are achieved to enhance gradient propagation and feature reuse capabilities. The fully connected residual module extracts potential fine-grained correlations in the ciphertext differential sequence to enhance the neural network discriminator's learning and representation capabilities for cryptographic features.

[0014] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the steps in the above method.

[0015] An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the steps in the method described above.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention enables neural network models to effectively learn differential-linear cryptographic features in multiset cryptanalysis scenarios, and to design the model and input structure in conjunction with the characteristics of the target cryptographic algorithm, thereby improving the accuracy of the neural network discriminator and its applicability to more encryption rounds.

[0017] Compared with existing neural network discriminators based on multiset conditions, the differential-linear neural network discriminator proposed in this invention exhibits superior performance on multiple lightweight symmetric cryptographic algorithms, achieving leading levels in key indicators such as attack round capability and classification accuracy.

[0018] Furthermore, to further improve the training efficiency and convergence speed of the neural network model, this invention also proposes a matching input optimization algorithm for automatically searching and identifying ciphertext location information (cell positions) that have a significant impact on cryptographic features in multiple sets. By filtering and retaining key positions, this method can effectively compress the input size of the neural network, eliminate redundant or low-relevance features, reduce noise interference in the input data, thereby improving the stability of the model training process and significantly improving the final classification accuracy and analysis performance.

[0019] This invention addresses application scenarios with limited training resources by proposing a novel input format that balances training data scale and model accuracy, thereby reducing the model's dependence on data volume and computing resources.

[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a neural network architecture used in one embodiment; Figure 2 This is a schematic diagram of a method for filtering key cells in encrypted differential processing, as described in one embodiment. Figure 3 This is a schematic diagram showing the performance comparison results of a neural network discriminator on various cryptographic algorithms. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] Where there is no conflict, the embodiments and features described in this application may be combined with each other.

[0027] A multiset cryptanalysis method based on neural networks includes the following steps: Using an active half-byte unit as the initial plaintext differential structure, after being encrypted by the target encryption algorithm for a set round, a multiset ciphertext sample is generated. Each ciphertext is paired up, and the difference value between the ciphertext pairs is calculated to form the input data. Based on the impact of each half-byte unit on the accuracy of the neural network discriminator, the input data is compressed. The compressed input data is fed into a pre-trained neural network discriminator to extract differential-linear cryptographic features contained in the multiset. The neural network discriminator introduces a residual structure containing a multi-head attention layer and a fully connected residual module. By adding the output of the multi-head attention layer to its input, skip connections are achieved to enhance gradient propagation and feature reuse capabilities. The fully connected residual module extracts potential fine-grained correlations in the ciphertext differential sequence to enhance the neural network discriminator's learning and representation capabilities for cryptographic features.

[0028] This invention can effectively extract differential-linear cryptographic features contained in multiple sets, thereby improving the model's discriminative ability, training efficiency, and stability.

[0029] The following is a detailed description.

[0030] First, the format of the input data: When only one 4-bit plaintext cell is active, the multiset of internal state values ​​after the r-th round of encryption is denoted as: The bitwise XOR operation is denoted as... When only one plaintext cell is activated, this invention utilizes the differential combinations between all ciphertexts in this structure as input to a neural network to train a differential linear neural network discriminator. By pairing these 16 ciphertexts together, a... Ciphertext Differential. Specifically, this invention constructs the bitwise XOR difference between all ciphertexts as the analysis object, that is, in the ciphertext set after the r-th round of encryption, consider the following differential form:

[0031] set up This represents the total number of ciphertext differences. This represents the bit length of the difference. The input to the neural network input layer is constructed as a dimensional array. Matrix, where .

[0032] The three datasets used in this embodiment—training data, validation data, and test data—are all generated using a random number generator to ensure the uniformity and randomness of the key and plaintext.

[0033] set up Indicates the first One key, Indicates the first Plain text, in which .set up The bit length of a single plaintext cell. This represents the total bit length of the cryptographic state. In this embodiment of the invention, samples generated using ciphertext data are labeled as tags. Samples generated using random data are labeled. In each dataset, the sample labels and Each component is allocated half to ensure dataset balance. (Regarding sample labels...) Each of the samples Only one plaintext cell is activated during the traversal. (1 possible values), with the remaining positions kept fixed, thus constructing a size of The multiple collection of plain texts. This multiple collection is... After round encryption, we get Each ciphertext contains 10 ciphertexts. Perform pairwise XOR operations on all ciphertexts, concatenate all the difference results to form an input vector with a total length of 1. for The sample is randomly sampled from a uniform distribution to generate a sample of size . The encrypted multiset is used as a reference input.

[0034] In this embodiment, the sizes of the training dataset, validation dataset, and test dataset are respectively set as follows: The dataset contains 200 samples. All datasets were used for training and inference with a batch size of 200 to ensure model training stability and efficiency. During training, mean squared error was used as the loss function, and the optimizer used the Adam algorithm with default Keras parameters. To improve training stability and efficiency, a periodic learning rate scheduling strategy was employed. Learning rate during round training The definition is as follows: , , , .

[0035] like Figure 1 As shown, the neural network model in this embodiment is based on the Transformer architecture. Its input representation is as follows: an active nibble unit (cell) is used as the initial plaintext difference structure. After being encrypted r times by the target encryption algorithm, multiset ciphertext samples are generated. The difference values ​​between ciphertext pairs are calculated based on a predefined difference construction method. The final constructed neural network input data is organized into a dimension... A two-dimensional matrix.

[0036] The main structure of the neural network model includes module 1 and module 2, as follows: Multi-head attention module (Module 1): This module employs a residual structure containing a multi-head attention layer, followed by a Layer Normalization operation. Skip connections are implemented by adding the output of the attention layer to its input, enhancing gradient propagation and feature reuse capabilities. The normalization layer performs row-wise normalization, ensuring each row's output has zero mean and unit variance, which helps improve training stability.

[0037] Feedforward-like neural network structure (module 2): This module consists of a residual structure containing two fully connected hidden layers (with 128 and 128 neurons respectively). The module employs a Layer Normalization operation after the first hidden layer to stabilize the training process. Subsequently, a GlobalAveragePooling1D layer aggregates the two-dimensional matrix features, generating a fixed-length vector representation. The entire module fuses the input with the outputs of the two hidden layers via skip connections to enhance feature transfer.

[0038] Output prediction module: The final output layer is a fully connected layer with a single neuron, and the activation function is Sigmoid, which is used to implement the probability output of the binary classification task.

[0039] In this embodiment, the model input is the set of all ciphertext difference vectors. To effectively model the potential correlations between ciphertext differences, the model introduces a multi-head attention mechanism to learn the multidimensional dependencies present in the data.

[0040] Specifically, this embodiment uses four attention heads, each with a key and a query dimension of 1. Since the input to the attention layer is a set of 64-dimensional ciphertext difference sequences, this configuration can effectively capture the diverse interaction patterns between ciphertext differences, thereby improving the model's ability to model internal feature structures. Furthermore, a set of fully connected residual modules, similar to a feedforward neural network structure, is introduced into the model to further extract potential fine-grained correlations and complex patterns in the ciphertext difference sequences, thereby enhancing the neural network discriminator's ability to learn and express cryptographic features.

[0041] In some embodiments, all bits of the ciphertext difference are used as input to the neural network. To reduce the input dimensionality, this embodiment also proposes a method for filtering key cells of the ciphertext difference, such as... Figure 2 This algorithm is used to search for key cells in the output mask that have a significant impact on model performance. It effectively reduces the input dimension of the neural network, thereby accelerating the training process and reducing memory overhead.

[0042] The core idea of ​​this algorithm is to remove output cells that have no significant impact on model accuracy. Specifically, it involves gradually reducing the number of cells in the output difference and monitoring the corresponding changes in model accuracy. If removing a cell would cause a significant drop in model accuracy, that cell is retained; otherwise, it is discarded. The set of retained cells after Algorithm 1 is denoted as . , where m represents the number of cells retained in the output difference.

[0043] As mentioned earlier, if the input to a neural network consists of multi-set ciphertext differential bits, this input format has high dimensionality, leading to a significant increase in the model's demand for training data. To achieve a balance between accuracy and data efficiency, this embodiment proposes a new input format.

[0044] Traditional neural network discriminators require extracting differential-linear trajectory information for all possible output masks, resulting in a large input dimensionality. In contrast, this invention selects only the most effective output discriminators. An output mask is used to construct the input, thereby effectively reducing the input dimensionality while preserving the main cryptographic features.

[0045] The specific process is as follows: If there are a total An output mask, denoted as The new neural network input format is then defined as:

[0046] in Indicating the 7th round The input format ultimately generates a ciphertext state value of length . The input vector. Taking the 8-round SKINNY algorithm as an example, when all the ciphertext differences are used as the neural network input, the model can achieve a classification accuracy of 70.9% with an input dimension of 1440.

[0047] In contrast, this embodiment uses a compressed input structure, employing only the differential information corresponding to 29 sets of output masks (a total of 464 dimensions of input), to achieve a classification accuracy of 62.6%, effectively balancing accuracy and input dimension (training overhead), thereby improving the applicability of the model in resource-constrained scenarios.

[0048] like Figure 3 The figure shows the performance comparison of the proposed neural network discriminator on several typical lightweight symmetric cryptographic algorithms. The datasets used in the experiments are all [size missing]. The evaluation metric was the model's accuracy in identifying difference-linear structures, and a comparative analysis was conducted with the best results in existing literature.

[0049] For the SKINNT-64-64 algorithm, the neural network discriminator in this embodiment achieves an accuracy of 70.9% in the 8th round, which is higher than existing research (Zhang, Liu, et al. "Neural-Inspired Advances in IntegralCryptanalysis"). arXiv preprint arXiv:2505.10790(2025) 58.6%. It should be noted that the results in this prior art are based on a weak key discriminator, and its accuracy is obtained through theoretical calculations under the assumption that the key satisfies randomness, which fails to fully reflect the classification performance under actual training models. Therefore, this embodiment has significant advantages in terms of practical deployability and recognition capability.

[0050] In the PRESENT-64-80 algorithm, the neural network distinguisher of this invention achieves an accuracy of 79.8% in the 8th round, significantly higher than the 57.32% accuracy in existing research (Zahednejad, Behnam, and Lijun Lyu. "An improved integral distinguisher scheme based on neural networks." International Journal of Intelligent Systems 37.10 (2022): 7584-7613), and can be further extended to the 9th and 10th rounds, still maintaining a higher recognition ability than random guessing. In the LBlock-64-80 algorithm, the distinguisher of this invention achieves an accuracy of 99.8% in the 10th round, a significant improvement over the 53.2% accuracy proposed in the existing technology, and can be further extended to the 11th round. For the RECTANGLE-64-80 algorithm, the neural network discriminator of this invention achieves an accuracy of 94.8% in the 8th round and still maintains an effective recognition capability of 69.7% in the 9th round. This is a significant improvement compared to the existing research (Wu, Wanqing, and Mingyu Guo. "Improved integral neural discriminator model for lightweight cipher PRESENT." Cybersecurity 7.1(2024): 1-14) which only achieved a recognition rate of 53.2% in the 7th round.

[0051] In summary, the method provided in this embodiment significantly improves the recognition accuracy and applicable rounds of the neural network discriminator on multiple algorithm platforms, verifying the versatility and effectiveness of the proposed method in multiset differential-linear cryptanalysis.

[0052] Example 2 A multiset cryptanalysis system based on neural networks, comprising: The input generation module is configured to use an active half-byte unit as the initial plaintext difference structure, encrypt it through the target encryption algorithm for a set number of rounds to generate a multiset ciphertext sample, pair each ciphertext pair, calculate the difference value between the ciphertext pairs, and form the input data. The input filtering module is configured to compress the input data based on the impact of each half-byte unit on the accuracy of the neural network discriminator; The cryptanalysis module is configured to input compressed input data into a pre-trained neural network discriminator to extract differential-linear cryptographic features implied in multiple sets. The neural network discriminator introduces a residual structure containing a multi-head attention layer and a fully connected residual module. By adding the output of the multi-head attention layer to its input, skip connections are achieved to enhance gradient propagation and feature reuse capabilities. The fully connected residual module extracts potential fine-grained correlations in the ciphertext differential sequence to enhance the neural network discriminator's learning and representation capabilities for cryptographic features.

[0053] Example 3 A computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the steps in the method provided in Embodiment 1.

[0054] Example 4 An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the steps in the method provided in Embodiment 1.

[0055] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of one or more computer-usable storage media (including, but not limited to, disk storage, etc.) containing computer-usable program code. CD - ROM It takes the form of a computer program product implemented on (such as optical memory, etc.).

[0056] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0058] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0059] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made by those skilled in the art without creative effort within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multiset cryptanalysis method based on neural networks, characterized in that, Includes the following steps: Using an active half-byte unit as the initial plaintext differential structure, after being encrypted by the target encryption algorithm for a set round, a multiset ciphertext sample is generated. Each ciphertext is paired up, and the difference value between the ciphertext pairs is calculated to form the input data. Based on the impact of each half-byte unit on the accuracy of the neural network discriminator, the input data is compressed. The compressed input data is fed into a pre-trained neural network discriminator to extract differential-linear cryptographic features contained in the multiset. The neural network discriminator introduces a residual structure containing a multi-head attention layer and a fully connected residual module. By adding the output of the multi-head attention layer to its input, skip connections are achieved to enhance gradient propagation and feature reuse capabilities. The fully connected residual module extracts potential fine-grained correlations in the ciphertext differential sequence to enhance the neural network discriminator's learning and representation capabilities for cryptographic features.

2. The multiset cryptanalysis method based on neural networks as described in claim 1, characterized in that, After the target encryption algorithm encrypts the data for a set number of rounds, a multiset of ciphertext samples is generated. The process of pairing each ciphertext and calculating the difference between ciphertext pairs to form the input data includes: when only one half-byte unit in the plaintext is active, the internal state values ​​after the r-th round of encryption constitute a multiset. Multiple sets of ciphertext differences are constructed by pairing each set of ciphertexts. This represents the total number of ciphertext differences. The bit length representing the difference is used to construct the input layer of the neural network discriminator into a dimension of . matrix.

3. The multiset cryptanalysis method based on neural networks as described in claim 1, characterized in that, Based on the impact of each nibble unit on the accuracy of the neural network discriminator, the process of compressing the input data includes: gradually reducing the number of nibble units in the output difference and monitoring the corresponding changes in model accuracy; if the removal of a nibble unit would cause the model accuracy to drop beyond a set value, then the nibble unit would be retained, otherwise it would be discarded.

4. The multiset cryptanalysis method based on neural networks as described in claim 1, characterized in that, Based on the impact of each half-byte unit on the accuracy of the neural network discriminator, the process of compressing the input data includes: selecting only the most effective first... Each output mask is used for input construction while preserving cryptographic features. If there are a total of... An output mask, denoted as The new input format is a sequence formed by sequentially combining the output masks with the state values ​​of each ciphertext half-byte unit in the target round.

5. The multiset cryptanalysis method based on neural networks as described in claim 1, characterized in that, The training process of the neural network discriminator includes: Use a random number generator to generate training, validation, and test data. When constructing the training data, set... Indicates the first One key, Indicates the first Plain text, in which In each dataset, the sample labels and Each accounts for half, let The bit length of a single plaintext cell. For the total bit length of the cryptographic state, Each of the samples Only one plaintext nibble unit is activated, while the remaining positions remain fixed, thus constructing a plaintext multiset. This multiset is then processed... After round encryption, we get Given a set of ciphertexts, perform pairwise XOR operations on all ciphertexts, concatenate all the difference results, and form an input vector; for each ciphertext... The sample is randomly sampled from a uniform distribution to generate a sample of size . The encrypted multiset is used as a reference input.

6. The multiset cryptanalysis method based on neural networks as described in claim 1, characterized in that, The neural network discriminator is a neural network model based on the Transformer architecture, which includes an input module, a multi-head attention module, a feedforward-like neural network structure, and an output module connected in sequence. The multi-head attention module adopts a residual structure containing a multi-head attention layer, followed by a normalization layer. The feedforward-like neural network structure includes two fully connected hidden layers, and a normalization operation layer is added after the first hidden layer. The output layer includes a fully connected layer and an activation function.

7. The multiset cryptanalysis method based on neural networks as described in claim 1, characterized in that, The residual structure of the multi-head attention layer of the neural network discriminator uses four attention heads, each with the same key and query dimensions, which match the dimensions of the ciphertext difference sequence.

8. A multiset cryptanalysis system based on neural networks, characterized in that, include: The input generation module is configured to use an active half-byte unit as the initial plaintext difference structure, encrypt it through the target encryption algorithm for a set number of rounds to generate a multiset ciphertext sample, pair each ciphertext pair, calculate the difference value between the ciphertext pairs, and form the input data. The input filtering module is configured to compress the input data based on the impact of each half-byte unit on the accuracy of the neural network discriminator; The cryptanalysis module is configured to input compressed input data into a pre-trained neural network discriminator to extract differential-linear cryptographic features implied in multiple sets. The neural network discriminator introduces a residual structure containing a multi-head attention layer and a fully connected residual module. By adding the output of the multi-head attention layer to its input, skip connections are achieved to enhance gradient propagation and feature reuse capabilities. The fully connected residual module extracts potential fine-grained correlations in the ciphertext differential sequence to enhance the neural network discriminator's learning and representation capabilities for cryptographic features.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, complete the steps of the method according to any one of claims 1-7.

10. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the steps of the method according to any one of claims 1-7.

Images