Cryptographic algorithm and operation mode classification method and system based on BCAM-LGST model

Abstract

The invention discloses a cryptographic algorithm-mode classification method and system based on a BCAM-LGST model, and belongs to the technical field of information security and cryptographic analysis. Comprising the following steps: converting an original ciphertext into a fixed-length sequence and a grayscale image in parallel, and constructing complementary bimodal data representation; the method comprises the following steps: extracting high-level probability features of a sequence by adopting a LightGBM model as semantic priori, and carrying out cross-modal depth fusion on a priori-guided hierarchical dual-channel gating modulation mechanism and image structure features extracted by Swin Transform; and introducing spatial position association of a spatial perception enhancement matrix enhancement feature, and carrying out multi-scale feature modeling on a fusion feature under prior guidance by using layered window attention, so as to finally realize end-to-end joint classification. The block cipher algorithm-mode joint identification method can quickly, accurately and robustly realize block cipher algorithm-mode joint identification, and is suitable for practical engineering scenes such as network security level protection, cipher application security evaluation, digital forensics, encrypted traffic analysis and compliance auditing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and cryptography, and particularly relates to a password algorithm and operation mode classification method and system based on a BCAM-LGST model. BACKGROUND

[0002] With the expansion of the concept of network space sovereignty and the improvement of the framework of cryptographic governance, including the international standards such as China's "Information Security Technology Information System Password Application Basic Requirements" (GB / T 39786-2021), the EU NIS 2 directive, the United States NIST CSF 2.0, etc. Precise password configuration review is the compliance cornerstone. In the tasks of ciphertext analysis, digital forensics, security audit and traffic identification in the encrypted communication environment, reliably identifying block cipher algorithms (such as AES128, AES256, Camellia256, SM4) and their operation modes (such as CBC, CFB, CTR, ECB, OFB) has become a key technical prerequisite for effectively carrying out related work.

[0003] Although existing block cipher identification research has made some progress, there are still some obvious limitations. For example, based on the assumption that the password operation mode is known and the same, Li et al. [1] in 2025 used a random forest model with general statistical characteristics (such as NIST SP 800-22 test, entropy and byte distribution) to classify four password algorithms in ECB mode, but the accuracy rate was only 38.80%; In 2025, Xie et al. [2] proposed a CNN-Transformer model for 8-class algorithm classification under ECB, with an accuracy rate of 70.00%, but simple vector splicing limits the discriminant ability of the model. Under the assumption that the password algorithm is known and the same, Ji et al. [3] in 2021 used a decision tree to classify four operation modes under SM4, with an accuracy rate of only 26%. In 2024, Yuan et al. [5] introduced a multi-layer composite identification architecture (MCICA), which identifies algorithms and modes through statistical features in a hierarchical manner, but the error propagation across layers results in a low overall "algorithm-mode" accuracy rate of 23.90%. In summary, existing password classification research has the following limitations: limited task assumptions and method architecture, insufficient feature extraction and fusion mechanism, and insufficient spatial multi-scale modeling. SUMMARY

[0004] In view of this, the purpose of the present application is to provide a BCAM-LGST model-based password algorithm and operation mode classification method and system to solve the problem of low joint classification accuracy and weak generalization ability caused by idealized task assumption, insufficient feature extraction and fusion mechanism, and spatial multi-scale modeling defects in the prior art. The present application extracts complementary heterogeneous dual-modal features of ciphertext (including probability vectors based on ciphertext sequences from LightGBM and structural element vectors from ciphertext images), combines a priori guided hierarchical dual-path gated modulation (PG-HDGM) cross-modal fusion mechanism and a spatial perception enhancement matrix, and realizes end-to-end joint classification of password algorithms and operation modes. The method has an accuracy of 98.33% in 20-class joint classification tasks, significantly better than the prior art, and has the important advantages of high classification accuracy, high reasoning efficiency, and strong generalization ability.

[0005] The technical solution adopted by the embodiment of the present application to solve its technical problems is:

[0006] A BCAM-LGST model-based password algorithm and operation mode classification method, comprising:

[0007] Step S1, constructing a data set: selecting multiple source data, using different password algorithms and operation modes to encrypt and generate ciphertext, forming a standardized password classification data set, and further dividing it into a training set, a validation set, and a test set;

[0008] Step S2, constructing a BCAM-LGST model and training the model using the data set:

[0009] In the BCAM-LGST model: the preprocessing module parallel processes the ciphertext into 1D sequences and 2D grayscale images of fixed length; the LightGBM model extracts a probability feature vector from the 1D ciphertext sequence as a high-level semantic prior; to adapt to the SwinTransformer input, the 2D grayscale image is flattened into a structured image element vector in row optimization order; after cross-modal fusion and perception enhancement processing of the probability feature vector and the structured image element vector, the enhanced fusion features are input into a four-stage SwinTransformer encoder for hierarchical modeling, and local and global features are captured through fixed window attention and shift window attention mechanisms; after global average pooling, the joint classification results of the password algorithm and the operation mode are output through a fully connected layer;

[0010] Step S3, using the trained BCAM-LGST model to perform joint classification of the password algorithm and the operation mode on the ciphertext.

[0011] Preferably, in the step S1, the multi-source data includes at least one of image data sets, network traffic data, video data, text data and audio data, the supported encryption algorithms include at least one of AES128, AES256, Camellia256 and SM4, and the supported operation modes include at least one of CBC, CFB, CTR, ECB and OFB.

[0012] The preprocessing of the data set is divided into two paths of a LightGBM branch and a Swin Transformer branch:

[0013] The LightGBM branch: the ciphertext is uniformly sampled into a 4KB fixed-length sequence. If the length of the ciphertext exceeds 4KB, 15% of the head and tail are reserved and 70% of the middle part is sampled equidistantly. If the length is less than 4KB, the center is zero-padded to 4KB.

[0014] The Swin Transformer branch: the ciphertext is converted into a 256x256 grayscale image, the ciphertext is adjusted to 65,536 bytes through cyclic replication or truncation, and is mapped into a pixel matrix in row priority order. The mean and variance of the pixels are calculated from the training set, and the mean and variance are applied to the entire image data set. All pixels are globally normalized and standardized.

[0015] Preferably, in the step S2, the LightGBM model extracts a probability feature vector as a high-level semantic prior from a 1D ciphertext sequence, including:

[0016] LightGBM model training: the preprocessed 1D ciphertext sequence is used to train a LightGBM classifier, the model parameters are optimized through five-fold cross-validation and early stopping strategy, and a BestF1 classifier is generated.

[0017] Probability feature extraction step: the trained LightGBM classifier is used to convert the 1D ciphertext sequence of each sample into a corresponding 20-dimensional classification probability feature vector.

[0018] Preferably, in the step S2, the 2D grayscale image is converted into a structured pixel element vector to adapt to the input of the Swin Transformer, including:

[0019] Each 2D ciphertext image is divided into 4x4 non-overlapping patches, converted into a 16-dimensional pixel element vector in row priority order, and mapped to a 76-dimensional structured pixel element vector using a linear fully connected layer.

[0020] Preferably, in the step S2, the probability feature vector and the structured pixel element vector are cross-modal fused and perceptually enhanced, including:

[0021] Cross-modal fusion, the hierarchical dual-path gating modulation mechanism fuses the probability feature vector and the structure feature vector through prior guidance:

[0022] Feature alignment extension: 20-dimensional probability feature vector as prior feature, self-replicated to the same number of entries as the structured pixel element vector;

[0023] Vector-level modulation: learnable gating weights are generated for each structured pixel element vector and probability feature vector respectively, and element-wise modulation is performed; vector-level gating modulation is realized through two independent feedforward networks, and the formula is: ; ;

[0024] In the formula, is the structure feature vector, is the probability feature vector, , , , is the learnable weight matrix, is the learnable bias term, is the hidden layer dimension, is the sigmoid function, is the structured pixel element vector dimension, is the probability feature dimension;

[0025] Matrix-level modulation: all 76-dimensional structured pixel element vectors and 20-dimensional probability features of a modulated sample are respectively composed into matrices and , and spliced into a 96-dimensional matrix , After layer normalization processing, the fusion feature matrix is obtained: ; ;

[0026] Among them is a linear layer: ;

[0027] The final output , L is the number of image blocks, , which integrates structure perception, statistical semantic probability prior and cross-modal fusion representation, and can be used for subsequent processing stages.

[0028] Perception enhancement processing, the learnable position perception enhancement matrix is realized by element-wise addition of the trainable position embedding matrix and the fusion feature matrix : ;

[0029] In the formula, is the patch sequence length, is the feature dimension, , is the row and column coordinates of each element in the respective matrix, is the spatial perception enhanced fusion feature matrix.

[0030] Preferably, the step S2 of joint classification of the cryptographic algorithm and the operation mode based on the enhanced fusion feature includes:

[0031] The multi-scale modeling step under prior guidance: using a four-stage Swin Transformer encoder to perform hierarchical multi-scale modeling on the enhanced fusion feature matrix with probability prior, each stage capturing local and global features through fixed window attention and shift window attention mechanism, the multi-scale modeling using a four-stage Swin Transformer encoder, each stage configured as:

[0032] First stage: input dimension 96, output dimension 96, spatial downsampling multiple 4 times compared to the input image;

[0033] Second stage: input dimension 96, output dimension 192, spatial downsampling multiple 2 times compared to the previous stage;

[0034] Third stage: input dimension 192, output dimension 384, spatial downsampling multiple 2 times compared to the previous stage;

[0035] Fourth stage: input dimension 384, output dimension 768, spatial downsampling multiple 2 times compared to the previous stage;

[0036] Incorporating query-key modulation guided by probability prior in window attention mechanism of each stage: ;

[0037] wherein are query, key, and value matrices respectively, is the sequence length, is the attention head dimension, is the part of the probability prior feature from LightGBM in the fusion feature, , is a learnable projection matrix, denotes element-wise multiplication, is a relative position bias matrix;

[0038] A classification output step: globally average pooling the encoder output, outputting a 20-dimensional classification result through a fully connected layer, realizing joint classification of the cryptographic algorithm and the operation mode.

[0039] Preferably, the model optimization in step S2 comprises:

[0040] The four-stage Swin Transformer encoder optimization adopts a CrossEntropyLoss loss function, an AdamW optimizer, and a ReduceLROnPlateau learning rate scheduler; the secondary machine learning LightGBM model adopts a multiclass logloss loss function, a Gradient Boosting optimizer, and a fixed learning rate, and the training is ended when the F1 score of the validation set no longer improves.

[0041] A cryptographic algorithm and operation mode classification system based on a BCAM-LGST model, comprising:

[0042] A data set construction module for constructing a data set, selecting multi-source data, and generating ciphertext by using different cryptographic algorithms and operation modes to form a standardized cryptographic classification data set;

[0043] A model establishment module for constructing a BCAM-LGST model;

[0044] A model training module for training the model using the data set: a preprocessing module parallelly processes the ciphertext into 1D sequences and 2D grayscale images of fixed length; a LightGBM model extracts a probability feature vector from the 1D ciphertext sequence as a high-level semantic prior; a 2D grayscale image is flattened into a structured image element vector in row priority order; after cross-modal fusion and perception enhancement processing of the probability feature vector and the structured image element vector, the enhanced fusion features are input into a four-stage Swin Transformer encoder for hierarchical multi-scale modeling under the guidance of the prior, local and global features are captured through window attention and shift window attention mechanisms; after global average pooling, the joint classification results of the cryptographic algorithm and the operation mode are output through a fully connected layer; the model optimization adopts a loss function and an optimizer;

[0045] A ciphertext joint classification module for classifying the ciphertext by using the trained BCAM-LGST model to realize joint classification of the cryptographic algorithm and the operation mode.

[0046] Preferably, it further comprises:

[0047] A feature decoupling analysis module for visualizing the internal composition structure of the key / IV-algorithm-mode joint features through t-SNE projection:

[0048] The fusion features obtained before global average pooling are visualized by t-SNE The visual decoupling analysis is performed on the (fourth stage output)

[0049] The intersection of the five operation modes under the same algorithm is taken to obtain the key / IV-algorithm feature ;

[0050] The intersection of the four algorithms under the same operation mode is taken to obtain the key / IV-operation mode feature ;

[0051] The intersection of the five operation modes under the same algorithm is taken to obtain the key / IV-algorithm feature ; The intersection of the four algorithms under the same operation mode is taken to obtain the key / IV-operation mode feature ;

[0052] The difference set operation is performed on the and to obtain the algorithm feature ; The difference set operation is performed on the and to obtain the operation mode feature ;

[0053] The difference set operation is performed on the and to obtain the operation mode feature ; The difference set operation is performed on the and to obtain the operation mode feature ;

[0054] Thus, the joint and individual visual features of each algorithm and operation mode are obtained.

[0055] It can be known from the above technical solution that the password algorithm and operation mode classification method and system based on the BCAM-LGST model provided by the embodiments of the present application can convert original ciphertext into a fixed-length sequence and a grayscale image in parallel, construct complementary bimodal data representation, extract high-level probability features of the sequence as semantic priori by using a LightGBM model, perform cross-modal deep fusion on the image structure features extracted by the Swin Transformer through a hierarchical dual-channel gate modulation mechanism guided by the priori, introduce a spatial perception enhancement matrix to strengthen the spatial position association of the features, and use a hierarchical window attention to model the multi-scale features of the fusion features under the guidance of the priori, so as to finally realize end-to-end joint classification. The present application can quickly, accurately and robustly realize the joint identification of the algorithm-mode of block cipher, and is suitable for network security level protection, password application security evaluation, digital forensics, encrypted traffic analysis and compliance audit and other actual engineering scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 The figure is a whole architecture diagram of the BCAM-LGST model of the present application.

[0057] Figure 2 The figure is a data flow schematic diagram of the BCAM-LGST model of the present application.

[0058] Figure 3 The training curve of the model on the validation set in the ablation experiment.

[0059] Figure 4 The model performance under different sampling lengths and image sizes.

[0060] Figure 5 The model performance under different training sample sizes.

[0061] Figure 6 The visualization result of decoupling the characteristics of the cryptographic algorithm and the operation mode. DETAILED DESCRIPTION

[0062] The technical solutions and technical effects of the present application are further described in detail below in combination with the accompanying drawings of the present application.

[0063] REFERENCE Figure 1 As shown in the overall architecture diagram of the model (BCAM-LGST) of the present application, the overall architecture includes six core modules: ciphertext data preprocessing ①, high-level probability feature extraction based on LightGBM ②, structural element vector conversion ③, hierarchical double-path feature modulation mechanism guided by priori ④, spatial perception enhancement matrix (SAEM) ⑤, and fusion feature modeling and classification based on SwinTransformer ⑥.

[0064] REFERENCE Figure 2 As shown in the data flow diagram of the model (BCAM-LGST) of the present application, the original ciphertext is processed in parallel in module ①: the Swin Transformer branch converts it into a 256x256 grayscale image, and the LightGBM branch standardizes it into a fixed-length 4KB sequence through adaptive sampling. Subsequently, module ② uses the BestF1_LightGBM classifier to map the sequence into a 20-dimensional class probability vector, forming a high-level semantic priori. At the same time, module ③ divides the image into image blocks and embeds them into 76-dimensional structural element vectors. These two feature streams are then fused in module ④ through the PG-HDGM mechanism, which performs vector-level gate modulation, concatenates the features into a 96-dimensional vector, and applies matrix-level modulation through linear fusion and layer normalization. The resulting fusion feature matrix is then enhanced by SAEM in module ⑤ to enhance spatial perception ability. Finally, module ⑥ processes the matrix through the Swin Transformer encoder, utilizes its hierarchical architecture for priori-guided multi-scale modeling, thereby realizing end-to-end "algorithm-mode" joint classification.

[0065] Based on Figure 1 Based on the architecture shown, the present application provides a cryptographic algorithm and operation mode classification method based on the BCAM-LGST model, and the specific implementation steps are as follows:

[0066] Step S1, constructing a data set: selecting multi-source data, using different cryptographic algorithms and operation modes to encrypt and generate ciphertext, forming a standardized cryptographic classification data set. The first 70% of each type of data in the total data set is used as the training set, the middle 15% is used as the validation set, and the last 15% is used as the test set; Randomly select samples from multi-source data types (image, video, audio, text, network traffic) to construct a plaintext data set, use the OpenSSL tool to encrypt the plaintext, generate 20 types of ciphertext samples containing 4 cryptographic algorithms (AES128, AES256, Camellia256, SM4) and 5 operation modes (CBC, CFB, CTR, ECB, OFB), form a standardized cryptographic classification data set (BCCD).

[0067] Step S2, constructing a BCAM-LGST model, and training the model using the data set:

[0068] In the BCAM-LGST model: the preprocessing module processes the ciphertext into fixed-length 1D sequences and 2D grayscale images in parallel; the LightGBM model extracts a probability feature vector from the 1D ciphertext sequence as a high-level semantic prior; to adapt to the input of the SwinTransformer, the 2D grayscale image is flattened into a structured image element vector in row optimization order; After cross-modal fusion and perception enhancement processing of the probability feature vector and the structured image element vector, input the enhanced fusion features into the four-stage SwinTransformer encoder for hierarchical modeling, capture local and global features through fixed window attention and shift window attention mechanism; After global average pooling, the joint classification results of the cryptographic algorithm and the operation mode are output through the fully connected layer;

[0069] In step S2, the preprocessing of the data set is divided into two paths of LightGBM branch and Swin Transformer branch. LightGBM branch: the ciphertext is uniformly sampled into 4KB fixed length sequence. If the length of the ciphertext exceeds 4KB, the first and last 15% are retained and 70% is sampled equidistantly from the middle; if it is less than 4KB, it is zero-filled to 4KB. Swin Transformer branch: the ciphertext is converted into a 256x256 grayscale image. Through cyclic replication or truncation, the ciphertext is adjusted to 65,536 bytes, and mapped to a pixel matrix in row priority order. The mean and variance of the pixels are calculated from the training set, and they are applied to the entire image data set. All pixels are globally normalized and standardized.

[0070] The BCAM-LGST model comprises two sub-models: a main deep learning Swin Transformer model optimized using a CrossEntropyLoss loss function, an AdamW optimizer, and a ReduceLROnPlateau learning rate scheduler; and a secondary machine learning LightGBM model using a multiclass log loss loss function, a Gradient Boosting optimizer, and a fixed learning rate of 0.05, which ends training when the F1 score of the validation set no longer improves.

[0071] The LightGBM model in step S2 extracts a probability feature vector from the 1D ciphertext sequence as a high-level semantic prior, comprising:

[0072] LightGBM model training: The LightGBM classifier is trained using the preprocessed 1D ciphertext sequence, and the model parameters are optimized through five-fold cross-validation and early stopping strategy to generate the BestF1 classifier; the parameter settings are: the number of trees is 120, the number of leaf nodes is 68, the maximum depth is 10, and the learning rate is 0.05, and the model parameters are optimized through five-fold cross-validation and early stopping strategy to generate the BestF1 classifier.

[0073] Probability feature extraction step: the trained LightGBM classifier is used to convert the 1D ciphertext sequence of each sample into a corresponding 20-dimensional classification probability feature vector, which serves as a high-level semantic prior and provides clear classification confidence information.

[0074] In step S2, the 2D grayscale image is converted to a structured pixel element vector to adapt to the input of the Swin Transformer, comprising:

[0075] Each 2D ciphertext image is divided into 4x4 non-overlapping patch blocks, converted to a 16-dimensional pixel element vector in row priority sequence, and mapped to a 76-dimensional structured pixel element vector using a linear fully connected layer to preserve the structural features of the algorithm and pattern. A 256x256 grayscale image will be converted to a structured pixel element matrix with a size of 4096x76.

[0076] The probability feature vector and the structured pixel element vector in step S2 are subjected to cross-modal fusion and perception enhancement processing, comprising:

[0077] Cross-modal fusion: the probability feature vector and the structural feature vector are fused through a prior-guided hierarchical dual-path gated modulation mechanism (PG-HDGM):

[0078] Feature alignment and expansion: the 20-dimensional probability feature vector (prior feature) is self-replicated to the same number of entries (4096) as the structured pixel element vector;

[0079] Vector-level modulation: Learnable gating weights are generated for each structured pixel element vector and probability feature vector, and element-wise modulation is performed. Vector-level gating modulation is implemented through two independent feedforward networks, as shown in the following formula: (1) (2)

[0080] In the formula, For structural feature vectors, For probabilistic eigenvectors, , , , For learnable weight matrix, As a learnable bias term, For the hidden layer dimension, For the sigmoid function, For the structured pixel element vector dimension, For probabilistic feature dimensions;

[0081] Matrix-level modulation: The 76-dimensional structured pixel element vectors and 20-dimensional probabilistic features of a modulated sample are respectively combined into a matrix. and And concatenate them into a 96-dimensional matrix (4096×96). The matrix was then subjected to layer normalization to obtain the fused feature matrix. : (3) (4)

[0082] in For a linear layer: .

[0083] Final output The number of image patches, It integrates structure awareness, statistical semantic probabilistic priors, and cross-modal fusion representations, which can be used in subsequent processing stages.

[0084] Perceptual enhancement processing, learnable position-aware enhancement matrix through trainable position embedding matrix With fusion feature matrix This is achieved through element-wise addition, enhancing spatial structure perception and compensating for the loss of positional information during feature fusion. (5)

[0085] In the formula, For the length of the patch sequence, is the feature dimension, , is the row and column coordinates of each element in the respective matrix, is the spatial perception enhanced fusion feature matrix.

[0086] The joint classification of the cryptographic algorithm and the operation mode based on the enhanced fusion features in step S2 includes:

[0087] The multi-scale modeling step under prior guidance: using a four-stage Swin Transformer encoder to perform hierarchical multi-scale modeling on the enhanced fusion feature matrix with probability prior, each stage captures local and global features through fixed window attention and shift window attention mechanism, the multi-scale modeling uses a four-stage Swin Transformer encoder, and each stage is configured as:

[0088] The first stage: the input dimension is 96, the output dimension is 96, and the spatial downsampling multiple is 4 times compared with the input image; the output is ;

[0089] The second stage: the input dimension is 96, the output dimension is 192, and the spatial downsampling multiple is 2 times compared with the previous stage; the output is ;

[0090] The third stage: the input dimension is 192, the output dimension is 384, and the spatial downsampling multiple is 2 times compared with the previous stage; the output is ;

[0091] The fourth stage: the input dimension is 384, the output dimension is 768, and the spatial downsampling multiple is 2 times compared with the previous stage; the output is ;

[0092] The spatial perception enhancement step: adding a learnable absolute position encoding to the fusion feature matrix, which is implemented by element-wise addition of the learnable position embedding matrix and the fusion feature matrix . The query-key modulation guided by the probability prior is integrated into the window attention mechanism of each stage, which guides the model to focus on the structural patterns related to the high confidence class, and its formula is: (6)

[0093] where are the query, key, and value matrices, is the sequence length, is the attention head dimension, is the part of the probability prior feature from LightGBM in the fusion feature, , is the learnable projection matrix, denotes element-wise multiplication, is a relative position bias matrix;

[0094] Classification output step: Global average pooling is performed on the encoder output, and a 20-dimensional classification result is output through a fully connected layer to realize joint classification of the cryptographic algorithm and the operation mode:

[0095] Classification output step: Global average pooling is performed on the encoder output, and a 20-dimensional classification result is output through a fully connected layer to realize joint classification of the cryptographic algorithm and the operation mode:

[0096] Model optimization step: Cross-entropy loss function and AdamW optimizer are used for end-to-end training, ReduceLROnPlateau learning rate scheduler and mixed precision training strategy are adopted, and when the F1 score of the validation set no longer improves, the learning rate is reduced by a factor of 0.5, and the patience is set to 2.

[0097] After the model classification is completed, in order to analyze the internal composition of the features learned by BCAM-LGST, we use t-SNE to visualize the decoupling analysis of the fusion features obtained before global average pooling. (t-distributed Stochastic Neighbor Embedding) is a nonlinear dimensionality reduction method, which is particularly suitable for revealing the potential clustering distribution and boundary structure in complex classification tasks.

[0098] By using set operations (intersection and difference) layer by layer:

[0099] Taking the intersection of the five operation modes under the same algorithm, we obtain the "key / IV-algorithm" feature .

[0100] Taking the intersection of the four algorithms under the same operation mode, we obtain the "key / IV-operation mode" feature .

[0101] Taking the intersection of and , we obtain the "key / IV" feature .

[0102] Performing difference set operation on and , we obtain the "algorithm" feature .

[0103] Performing difference set operation on and , we obtain the "operation mode" feature .

[0104] Thus, we obtain the joint and individual visualized features of each algorithm and operation mode.

[0105] Step S3, using the trained BCAM-LGST model to perform joint classification of the ciphertext on the cryptographic algorithm and operation mode.

[0106] Further, the present application provides a BCAM-LGST model-based cryptographic algorithm-mode classification system, which can be used to implement the aforementioned method, comprising:

[0107] A data set construction module for constructing a data set, selecting multi-source data, and generating ciphertext by using different cryptographic algorithms and operation modes to form a standardized cryptographic classification data set;

[0108] A model establishment module for constructing a BCAM-LGST model;

[0109] A model training module for training the model using the data set: a preprocessing module parallel processes the ciphertext into fixed-length 1D sequences and 2D grayscale images; a LightGBM model extracts a probability feature vector from the 1D ciphertext sequence as a high-level semantic prior; a 2D grayscale image is flattened into a structured image element vector in row priority order; after cross-modal fusion and perception enhancement processing of the probability feature vector and the structured image element vector, the enhanced fusion features are input into a four-stage Swin Transformer encoder for hierarchical multi-scale modeling under prior guidance, local and global features are captured through window attention and shift window attention mechanisms; after global average pooling, the joint classification results of the cryptographic algorithm and operation mode are output through a fully connected layer; the model optimization uses a loss function and an optimizer;

[0110] A ciphertext joint classification module for using the trained BCAM-LGST model to perform joint classification of the ciphertext on the cryptographic algorithm and operation mode;

[0111] A feature decoupling analysis module that visualizes the internal structure of the "key / IV-algorithm-mode" joint features through t-SNE projection, supporting feature importance analysis.

[0112] The following examples are provided to illustrate the specific implementation of the method of the present application.

[0113] Example 1: Data set construction

[0114] The plaintext dataset is constructed from five data types: Caltech-256 image dataset, CICIoT2024 network traffic data, CMU-MOSI video data, THUCNews text data, and Common Voice audio data, with 1000 samples randomly selected from each type, for a total of 5000 samples. The plaintext is encrypted using the OpenSSL tool, with PKCS#7 padding, covering four encryption algorithms (AES128, AES256, Camellia256, SM4) and five operation modes (CBC, CFB, CTR, ECB, OFB).

[0115] Key and IV management adopts five configuration strategies:

[0116] Configuration 1: All ciphertext samples use the same 1 key and IV;

[0117] Configuration 2: Each algorithm uses 1 same key, and each mode uses 1 same IV;

[0118] Configuration 3: Each algorithm-mode combination uses 1 same key and IV;

[0119] Configuration 4: Each ciphertext sample uses a different key, and each mode uses 1 same IV;

[0120] Configuration 5: All ciphertext samples use 1 same key, and different ciphertext samples use random IVs.

[0121] The final BCCD dataset contains 500,000 ciphertext samples, with each configuration sub-dataset containing 100,000 samples.

[0122] Example 2: Model training and evaluation

[0123] The ciphertext preprocessing adopts a double-path strategy. The LightGBM branch unifies the ciphertext into a 1D sequence of 4KB length: for ciphertext shorter than 4KB, it is padded with zeros in the middle, and for ciphertext longer than 4KB, it retains the first and last 600 bytes and equally samples the middle 2800 bytes. The Swin Transformer branch converts the ciphertext into a 256x256 grayscale image, adjusts it to 65536 bytes by repeating or truncating, and maps it in row-major order.

[0124] The LightGBM model training parameters are set as: n_estimators=120, num_leaves=68, max_depth=10, learning_rate=0.05, with five-fold cross-validation and early stopping strategy (patience=5), and LightGBM uses multi_logloss loss function,

[0125] The GBDT optimizer is used, and the multi-classification log loss is used as the evaluation index.

[0126] The Swin Transformer model parameters are set as follows: embed_dim=76, depths=[2, 2, 6, 2], num_heads=[3, 6, 12, 24], window_size=7, mlp_ratio=4, drop_rate=0.1, attn_drop_rate=0.05, drop_path_rate=0.2. The AdamW optimizer is used for training, the CrossEntropyLoss loss function is used, the learning rate is 1e-4, the batch size is 20, mixed precision training and ReduceLROnPlateau learning rate scheduler are used.

[0127] The data set is divided into training set, validation set and test set according to the ratio of 70%-15%-15%, and the distribution of samples of each category is balanced. In the training process, LightGBM and Swin Transformer are optimized respectively, and finally the overall performance is improved through end-to-end fine tuning.

[0128] Example 3: Performance verification experiment (description of the graph)

[0129] Ablation experiment design six configurations to verify the contribution of each module:

[0130] LG: baseline LightGBM model

[0131] LG-AD: LightGBM+adaptive sampling

[0132] ST: baseline Swin Transformer model

[0133] STLG-PG: Swin Transformer+LightGBM probability guide

[0134] STLG-PG-HDGM: increase hierarchical double-path gating modulation

[0135] STLG-PG-HDGM-SM: superimposed spatial perception matrix

[0136] Figure 6 The experimental results show that the complete model reaches an accuracy of 98.33%, and each module brings performance improvement, among which the probability guide and hierarchical modulation mechanism contribute most significantly.

[0137] Figure 3 The parameter optimization experiment of the complete model verifies the optimality of the 4KB sampling length and 256x256 image size, and performance will decrease if the parameters are higher or lower than this.

[0138] Figure 5 Robustness test was conducted under five key / IV configurations, and the model maintained an accuracy rate of more than 98% under all configurations, proving that it is not sensitive to changes in encryption parameters.

[0139] Figure 4 The data efficiency experiment of the BCAM-LGST model shows that the model can achieve an accuracy rate of more than 90% with 500 samples per class, and still maintain an accuracy rate of 77.67% with 50 samples per class, demonstrating excellent few-shot learning ability.

[0140] Embodiment 4: Practical application scenarios

[0141] After the BCAM-LGST model of the present application completes training on ciphertext samples generated under a certain key / IV (both of which can be randomly generated) configuration, it can accurately identify the encryption algorithm and operation mode used for any ciphertext generated based on the same key / IV, without relying on any auxiliary information other than the ciphertext. In actual deployment, the target system can be guided to use a pre-defined audit key / IV to encrypt test data, and then use the BCAM-LGST model that has been perfectly trained for this key / IV to analyze the output ciphertext, thereby objectively determining the encryption algorithm and mode actually used. This method can provide evidence-based judgment for whether the encryption strategy is strictly followed during data transmission, and is helpful in discovering configuration drift, policy violation or malicious encryption degradation behavior in a timely manner under the premise of normal operation of the non-perturbed system, thereby providing technical support for the rapid reinforcement of information systems.

[0142] Specific applications include:

[0143] Network security level protection and commercial cryptographic application security assessment: In the process of network security level protection and commercial cryptographic application security assessment, the BCAM-LGST model is used to analyze the ciphertext by requiring the evaluated system to encrypt the test data using a pre-defined audit key / IV, accurately identifying the actual use of the cryptographic algorithm and operation mode, and verifying whether it conforms to the established cryptographic configuration strategy.

[0144] Digital forensics analysis: In the context of encrypted data forensics, the BCAM-LGST model is used to analyze the ciphertext file non-invasively, identify the encryption algorithm and mode configuration, and provide key information support for evidence chain construction and cryptographic recovery.

[0145] Cloud data center security monitoring: In the monitoring of encrypted traffic in cloud platforms, the BCAM-LGST model is used to identify the encryption configuration used by different service or user data streams, detect configuration drift, policy violation or potential malicious behavior in real time, and effectively enhance the security situation awareness capability of the cloud environment.

[0146] Technical effect verification:

[0147] The technical effects of the present application are verified through systematic experiments:

[0148] Accuracy verification: Achieved 98.33% accuracy in 20 joint classification tasks, significantly better than 14 baseline models, including 7 mainstream machine learning models (average improvement of 12.42%), 2 operation mode classification methods (average improvement of 50.07%), 4 cryptographic algorithm classification models (average improvement of 43.01%) and 1 existing joint classification method (improvement of 74.43%).

[0149] Generalization verification: The average accuracy is 94.71% in six data type tests, proving strong generalization ability across data types, with an accuracy of 97.74% on network traffic data.

[0150] Robustness verification: Stable performance under multiple key / IV configurations, with accuracy fluctuations less than 0.2% under five configurations.

[0151] Efficiency verification: Single-sample inference time is 20.9ms, throughput is 766 samples / sec, meeting actual engineering requirements.

[0152] Interpretability verification: Feature decoupling visualization reveals the composition of "key / IV-algorithm-mode" joint features, confirming the dominant role of keys in feature representation and providing in-depth understanding for cryptographic analysis.

[0153] Compared with the prior art, the present application has the following beneficial effects:

[0154] 1. Breakthrough classification performance: Achieved 98.33% joint classification accuracy on BCCD dataset containing 500,000 ciphertext samples, improved by 6.31% and 6.64% compared with baseline LightGBM and Swin Transformer models, and improved by 74.43% compared with existing joint classification methods.

[0155] 2. Innovative architecture design: Proposed prior-guided hierarchical dual-path gated modulation mechanism, effectively solving the problem of heterogeneous feature fusion, achieving semantic alignment and adaptive calibration of probabilistic and structural features, and modeling of fused features under prior guidance.

[0156] 3. Strong generalization ability: The pre-trained model achieved an average accuracy of 94.71% in tests on six different types of datasets (images, videos, audio, network traffic, text), proving that the method is not sensitive to plaintext content and effectively learns the essential features of cryptographic configurations.

[0157] 4. Key configuration robustness: Maintains classification accuracy of more than 98% under five different key / IV distribution strategies, with fluctuations less than 0.2%, suitable for actual encryption environments.

[0158] 5. Data efficiency advantage: Achieving an accuracy of 77.67% in a small sample scenario with only 50 training samples per class, significantly better than the random guess level (5%), with strong data utilization efficiency.

[0159] 6. Engineering practical value: First to realize the end-to-end joint classification of cryptographic algorithms and operation modes, eliminating the idealized dependence of traditional methods on "algorithm known and same" or "mode known and same", providing reliable technical means for cryptographic application security evaluation, digital forensics and encrypted traffic analysis.

[0160] 7. Feature decoupling explainability: Confirmed by t-SNE visualization that the model can effectively decouple the "key / IV-algorithm-mode" joint feature, providing in-depth feature-level understanding for cryptographic analysis and revealing the dominant role of the key in feature representation.

[0161] The BCAM-LGST model proposed by the present application effectively solves the key technical problems in the joint classification of cryptographic algorithms and operation modes through the innovative prior-guided cross-modal learning mechanism. A large number of experiments have proved that this method is significantly better than the existing technology in terms of accuracy, generalization, robustness and practicality, providing a reliable solution for the engineering application of cryptographic analysis technology. The present application has been verified in practical scenarios such as cryptographic application security evaluation, digital forensics and encrypted traffic analysis, and helps to promote the technological progress and standardization construction in the field of cryptographic analysis.

[0162] According to the disclosed embodiments of the present application, the present application also discloses an electronic device, a readable storage medium and a computer program product. The electronic device is intended to represent various forms of digital computers, including a computing unit, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) or a computer program loaded into a random access memory (RAM) from a storage unit. In the RAM, various programs and data required for device operation can also be stored. The ROM and the RAM of the computing unit are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus. Various components in the device are connected to the I / O interface, including: an input unit, such as a keyboard, a mouse, etc.; an output unit, such as various types of displays, a speaker, etc.; a storage unit, such as a magnetic disk, an optical disk, etc.; and a communication unit, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit allows the device to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks. The computing unit can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit performs various methods and processes described above, such as the BCAM-LGST model-based cryptographic algorithm and operation mode classification method. For example, in some embodiments, the BCAM-LGST model-based cryptographic algorithm and operation mode classification method can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via the ROM and / or the communication unit. When the computer program is loaded into the RAM and executed by the computing unit, one or more steps of the BCAM-LGST model-based cryptographic algorithm and operation mode classification method described above can be performed. Alternatively, in other embodiments, the computing unit can be configured to perform the BCAM-LGST model-based cryptographic algorithm and operation mode classification method by any other appropriate means (e.g., by means of firmware).

[0163] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a load programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0164] Program code to implement the methods disclosed herein can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or the block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0165] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0166] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0167] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0168] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server is generally established by computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0169] The above disclosure is only the preferred embodiment of the present application, of course, cannot be limited by this, those skilled in the art can understand that the implementation of all or part of the above-mentioned processes, and according to the equivalent changes made by the claims of the present application, still belong to the scope covered by the present application.

[0170] [1] Li, J., Sun, H., Du, Z., Wang, Y., Yuan, K., & Jia, C. (2025). A generic cryptographic algorithm identification scheme based on ciphertext features. Journal of Information Security and Applications, 89, 103984. https: / / doi.org / 10.1016 / j.jisa.2025.103984 ;

[0171] [2] Xie, R., Chen, X., Zhang, X., & Shi, G. (2025). Block cipher algorithm identification based on CNN-Transformer fusion model. In Lecture Notes in Computer Science (Vol. 15041, pp. 97–110). Springer. https: / / doi.org / 10.1007 / 978-981-97-8795-1_7

[0172] [3] Ji Wen-tao, Li Yuan-yuan, Qin Bao-dong. Block cipher algorithm identification based on decision tree [J]. Computer Engineering, 2021, 47(08): 157-161+169. DOI:10.19678 / j.issn.1000-3428.0058608.

[0173] [4] Chi Yaping, Yue Ziyi, Lin Yuheng. Block cipher algorithm identification based on Transformer [J]. Computer Engineering, 2023, 49(09): 109-117. DOI:10.19678 / j.issn.1000-3428.0065750.

[0174] [5]Yuan, K., Huang, Y., Du, Z., Li, J., & Jia, C. (2024). A multi-layer composite identification scheme of cryptographic algorithm based on hybrid random forest and logistic regression model. Complex & Intelligent Systems, 10, 1131–1147. https: / / doi.org / 10.1007 / s40747-023-01212-2.

[0175] [6]Liu Z, Lin Y, Cao Y, et al. Swin Transformer: Hierarchical visiontransformer using shifted windows[EB / OL]. (2021-03-25) [2025-10-11]. https: / / arxiv.org / abs / 2103.14030.

[0176] [7]Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., Ye, Q., & Liu, T.-Y. (2017). LightGBM: A highly efficient gradient boosting decision tree. In Advances in Neural Information Processing Systems 31 (NIPS 2017). Curran Associates.

Claims

1. A cryptographic algorithm and operation mode classification method based on the BCAM-LGST model, characterized in that, include: Step S1, constructing the dataset: Select multi-source data, encrypt it using different cryptographic algorithms and operation modes to generate ciphertext, form a standardized cryptographic classification dataset, and further divide it into training set, verification set and test set; Step S2: Construct the BCAM-LGST model and train it using the dataset. In the BCAM-LGST model: the preprocessing module processes the ciphertext in parallel into a fixed-length 1D sequence and a 2D grayscale image; the LightGBM model extracts probabilistic feature vectors from the 1D ciphertext sequence as high-level semantic priors; to adapt to the SwinTransformer input, the 2D grayscale image is flattened into structured pixel element vectors according to the row optimization order; after cross-modal fusion and perceptual enhancement processing of the probabilistic feature vectors and structured pixel element vectors, they are input into a four-stage SwinTransformer encoder to perform hierarchical modeling of the enhanced fused features, and capture local and global features through fixed window attention and shift window attention mechanisms; After global average pooling, the joint classification result of the cryptographic algorithm and operation mode is output through a fully connected layer; Step S3: Use the trained BCAM-LGST model to jointly classify the ciphertext based on the cryptographic algorithm and operation mode.

2. The cryptographic algorithm and operation mode classification method based on the BCAM-LGST model as described in claim 1, characterized in that, In step S1, the dataset construction step, the multi-source data includes at least one of image datasets, network traffic data, video data, text data, and audio data. The supported cryptographic algorithms include at least one of AES128, AES256, Camellia256, and SM4. The supported operation modes include at least one of CBC, CFB, CTR, ECB, and OFB. The dataset preprocessing is divided into two paths: the LightGBM branch and the Swing Transformer branch. LightGBM branch: The ciphertext is uniformly sampled into a 4KB fixed-length sequence. If the ciphertext length exceeds 4KB, 15% of the first and last parts are retained and 70% is sampled from the middle at equal intervals. If it is less than 4KB, the center is zero-padded to 4KB. The Swin Transformer branch converts the ciphertext into a 256×256 grayscale image, adjusts the ciphertext to 65,536 bytes by cyclic copying or truncation, and maps it to a pixel matrix in row-major order. It calculates the mean and variance of pixels from the training set and applies the mean and variance to the entire image dataset, performing global normalization and standardization on all pixels.

3. The cryptographic algorithm and operation mode classification method based on the BCAM-LGST model as described in claim 1, characterized in that, In step S2, the LightGBM model extracts probabilistic feature vectors from the 1D ciphertext sequence as high-level semantic priors, including: LightGBM model training: The LightGBM classifier is trained using a preprocessed 1D ciphertext sequence. The model parameters are optimized through five-fold cross-validation and early stopping strategy to generate the BestF1 classifier. Probabilistic feature extraction steps: Use the trained LightGBM classifier to transform the 1D ciphertext sequence of each sample into a corresponding 20-dimensional classification probability feature vector.

4. The cryptographic algorithm and operation mode classification method based on the BCAM-LGST model as described in claim 3, characterized in that, The step S2, which converts the 2D grayscale image into a structured pixel element vector, includes: Each 2D encrypted image is divided into 4×4 non-overlapping patch blocks, which are then converted into 16-dimensional pixel element vectors according to row priority. A linear fully connected layer is then used to map these patches to 76-dimensional structured pixel element vectors.

5. The cryptographic algorithm and operation mode classification method based on the BCAM-LGST model as described in claim 4, characterized in that, The cross-modal fusion and perceptual enhancement processing of the probabilistic feature vector and structured pixel element vector in step S2 includes: Cross-modal fusion is achieved by fusing probabilistic and structural feature vectors through a priori-guided hierarchical dual-path gating modulation mechanism. Feature alignment expansion: Using the 20-dimensional probabilistic feature vector as prior features, it self-replicates the same number of entries as the structured pixel element vector; Vector-level modulation: Learnable gating weights are generated for each structured pixel element vector and probability feature vector, and element-wise modulation is performed. Vector-level gating modulation is implemented through two independent feedforward networks, as shown in the following formula: ; ; In the formula, For structural feature vectors, For probabilistic feature vectors, , , , For learnable weight matrix, For learnable bias terms, For the hidden layer dimension, For the sigmoid function, For the structured pixel element vector dimension, For probabilistic feature dimensions; Matrix-level modulation: The 76-dimensional structured pixel element vectors and 20-dimensional probabilistic features of a modulated sample are respectively combined into a matrix. and And concatenate them into a 96-dimensional matrix. , The fused feature matrix is ​​obtained after layer normalization. : ; ; in For a linear layer: ; Final output L is the number of image patches. It integrates structure perception, statistical semantic probability priors, and cross-modal fusion representations, which can be used in subsequent processing stages; Perceptual enhancement processing, learnable position-aware enhancement matrix through trainable position embedding matrix With fusion feature matrix Element-by-element addition implementation: ; In the formula, For the length of the patch sequence, For feature dimension, , These are the row and column coordinates of each element in its respective matrix. This is the fusion feature matrix after spatial perception enhancement.

6. The cryptographic algorithm and operation mode classification method based on the BCAM-LGST model as described in claim 5, characterized in that, The joint classification of cryptographic algorithms and operation modes based on the enhanced fusion features in step S2 includes: Prior-guided multi-scale modeling steps: A four-stage Swin Transformer encoder is used to perform hierarchical multi-scale modeling on the enhanced fused feature matrix with probabilistic priors. Each stage captures local and global features through fixed-window attention and shift-window attention mechanisms. The multi-scale modeling uses a four-stage Swin Transformer encoder, and the configuration of each stage is as follows: Phase 1: Input dimension 96, output dimension 96, spatial downsampling factor of 4 times relative to the input image; Second stage: Input dimension 96, output dimension 192, spatial downsampling factor of 8 times relative to the input image; Third stage: Input dimension 192, output dimension 384, spatial downsampling factor of 16 times relative to the input image; Fourth stage: Input dimension 384, output dimension 768, spatial downsampling factor of 32 times relative to the input image; The window attention mechanism at each stage incorporates query-key modulation guided by probabilistic priors: ; in These are query, key, and value matrices, respectively. For sequence length, For the attention head dimension, This refers to the portion of the fused features derived from the probabilistic prior features from LightGBM. , For learnable projection matrices, This represents element-wise multiplication. This is the relative position offset matrix; Classification output steps: Global average pooling is performed on the encoder output, and a 20-dimensional classification result is output through a fully connected layer to achieve joint classification of cryptographic algorithms and operation modes.

7. The cryptographic algorithm and operation mode classification method based on the BCAM-LGST model as described in claim 6, characterized in that, The model optimization in step S2 includes: The four-stage Swin Transformer encoder optimization uses the CrossEntropyLoss loss function, AdamW optimizer, and ReduceLROnPlateau learning rate scheduler; the sub-machine learning LightGBM model uses the multiclass log loss function, Gradient Boosting optimizer, and a fixed learning rate, and training ends when the validation set F1 score no longer improves.

8. A cryptographic algorithm and operation mode classification system based on the BCAM-LGST model, characterized in that, For implementing the method according to any one of claims 1-7, comprising: The dataset construction module is used to build datasets, select data from multiple sources, encrypt them using different cryptographic algorithms and operation modes to generate ciphertext, and form a standardized cryptographic classification dataset. The model building module is used to construct the BCAM-LGST model; The model training module is used to train the model using the dataset: the preprocessing module processes the ciphertext in parallel into a fixed-length 1D sequence and a 2D grayscale image; the LightGBM model extracts probabilistic feature vectors from the 1D ciphertext sequence as high-level semantic priors; the 2D grayscale image is flattened in row-major order into structured pixel element vectors; after cross-modal fusion and perceptual enhancement processing of the probabilistic feature vectors and structured pixel element vectors, they are input into a four-stage Swin Transformer encoder to perform hierarchical multi-scale modeling of the enhanced fused features under prior guidance, capturing local and global features through window attention and shifted window attention mechanisms; after global average pooling, the joint classification result of the cryptographic algorithm and operation mode is output through a fully connected layer; model optimization uses a loss function and an optimizer. The ciphertext joint classification module is used to perform joint classification of cryptographic algorithms and operation patterns on ciphertext using a trained BCAM-LGST model.

9. The cryptographic algorithm and operation mode classification system based on the BCAM-LGST model as described in claim 8, characterized in that, Also includes: The feature decoupling analysis module visualizes the internal structure of the key / IV-algorithm-mode joint features through t-SNE projection: The fusion features obtained before global average pooling are obtained using t-SNE. (Fourth-stage output) Perform visual decoupling analysis: The key / IV—algorithm feature—is obtained by taking the intersection of five operation modes under the same algorithm. ; The key / IV-operation mode feature is obtained by taking the intersection of four algorithms under the same operation mode. ; Pick and The intersection of these features yields the key / IV characteristics. ; right and Perform the difference operation to obtain the algorithm characteristics. ; right and Perform the difference operation to obtain the operation mode characteristics. ; This allows us to obtain the combined and individual visual features of each algorithm and operation mode.

10. A computer-readable storage medium having program instructions stored thereon that, when executed by a processor, implement the method as described in any one of claims 1-7.

Images