Research on Cryptographic Algorithm Recognition Based on Behavior Analysis

Fei Yan,Yunlong Xing,Shiwei Zhang,Zhihan Yue,Yamin Zheng
DOI: https://doi.org/10.1007/978-981-10-7080-8_25
2017-01-01
Abstract: Due to the abuse of cryptography technology and the difficulty to break encryption algorithm, ransomware has a huge threat to cyberspace. So how to detect the cryptographic algorithm in the recognition program plays an important role in the protection of information security. However, existing cryptographic algorithm identification and analysis technology has the disadvantages of low recognition efficiency, single analysis strategy, and they cannot identify program variants effectively. In view of these problems, this paper presents a cryptographic algorithm based on behavior analysis. Based on the behavior analysis, combined with the static structure and dynamic statistical characteristics of the key data, the subroutine of the target program is gradually screened, and the execution logic of the subroutine is analyzed. Finally, the cryptographic algorithm in the binary code of the program is obtained. Compared with the traditional signature-based technology, our technology has a better recognition rate with less resource occupation. What’s more, this technology can identify the program variants accurately, so it has a good application prospects.
What problem does this paper attempt to address?