{'fraction_non_alphanumeric': 0.02584838636535409, 'fraction_numerical': 0.010732370947018366, 'mean_word_length': 5.08367816091954, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Analysis of cryptosystem recognition scheme based on Euclidean distance feature extraction in three machine learning classifiers

In reality, many cryptographic analysis techniques are based on a specific cryptographic system or a large number of encrypted ciphertext. The identification and detection of cryptographic system is of great significance for evaluating the security of the algorithm and guiding the design and improvement of the algorithm. In this paper, we transcode each character in ciphertext into a decimal number, construct these numbers into one-dimensional arrays, and obtain the Euclidean distance between these one-dimensional arrays. Then we use these distances as features and input them into three machine learning classifiers: random forest, logistic regression and support vector machine to recognize cryptosystem and compare their recognition accuracy. The subjects include 8 common block ciphers (DES, 3DES, AES-128, AES-256, IDEA, SMS4, Blowfish, Camellia-128). The experimental results show that using the feature extraction scheme not only shortens the experimental time, reduces the computational cost, but also improves the recognition accuracy of eight typical block cipher algorithms. The classification accuracy of the ECB mode in the random forest classifier is 75%, which is higher than the existing published literature experimental results. The classification accuracy rate of CBC mode is higher than 13.5%, which is higher than the accuracy of random classification.


Introduction
Usually we call the process of distinguishing and identifying the original information encryption algorithm as cryptosystem recognition. In modern cryptography, cryptanalysis is usually carried out on the premise of a large number of ciphertext obtained. It is of great significance to classify and detect cryptosystem for evaluating the security of cryptosystem. At present, the classification method based on machine learning is the main method of cryptosystem recognition [1].The cryptosystem recognition scheme based on machine learning regards the cryptographic system as a classification problem, and the extracted feature values are tagged into a neural network classifier for classification. The cryptosystem recognition scheme based on machine learning technology has remarkable effect. It is simple in design, stable in performance and can deal with the complex relationship between data. Therefore, the prospect is very promising. Nowadays, many machine learning algorithms are applied to cryptosystem recognition schemes.
In 2006, Dileep [2] and others proposed a block cipher recognition scheme based on support vector machine (SVM) with the help of text categorization and counting. This paper compared the recognition performance of SVM and K-nearest neighbor methods, and adopt multi-cryptosystem including fixed-length document vector and variable-length document vector. In this article, the author mainly discussesd the distinction between five cryptosystems including AES, DES, 3DES, Blowfish, and RC5, and studied the cryptosystem identification under different conditions such as fixed key and variable key, ECB mode and CBC mode. In 2008, Nagileddy et al. [3] considered that cryptosystem identification was a preliminary cryptographic attack and can be used to evaluate the security of a cryptosystem. At the same time, the literature also identified five cryptosystems such as AES, DES, 3DES, Blowfish and RC5. The conclusions showed that the block cipher system in ECB mode was easier to identify, and the CBC mode can resist this cryptosystem identification. At the same time, AES had lower recognition accuracy than other cryptosystems. In the same period, Caurav Saxena et al. gave a distinction between classical and modern cryptosystems, and carried out recognition experiments on cryptosystems such as Blowfish, Camellia and RC4 through support vector machines and other pattern methods. According to the results of the predecessors, it can be found that different classification techniques had different ability to distinguish various algorithms. In 2010, Suhaila et al. [4] [5] used pattern recognition method to compare cryptosystem recognition classifiers constructed by eight classification algorithms (Naive Bayesian, Support Vector Machine, Neural Network, Instance Based Learning, Bagging, AdaboostM1, Rotaion Forest and C4.5 Decision Tree), block cipher algorithms in four ECB modes (56-bit DES, 64-bit IDEA, 128, 192, 256-bit AES and 42, 84, 128-bit RC2)was used as recognition objects. The experimental results showed that the RoFo classification algorithm had a relatively high classification accuracy rate, and the success rate of the 8 types of data sets reached 30.83%. It can successfully distinguish 74 out of 240 files, and can distinguish 240 in 4 types of data sets. In the four types of data sets, 128 of the 240 can be distinguished, the success rate was 53.33%, and the IBL had the worst performance, with only 12.5% success rate for 8 data sets and 30.42% for 4 data sets.
All of the above methods used binary analysis code, which often required reverse analysis of the encryption program, resulting in its poor applicability in non-cooperative application environment.In this paper, we propose a feature extraction scheme based on Euclidean distance. The ciphertext encrypted by eight block cipher algorithms (DES, 3DES, AES-128, AES-256, IDEA, SMS4, Blowfish, Camellia-128) is used as training. After that, we use three machine learning classifiers to conduct experiments and compare the experimental results. Firstly, we find that random forests have better classification effect based on the same training data. Secondly, we use the feature extraction scheme based on Euclidean distance proposed by us, which greatly reduces the dimension of feature vectors, reduces the scale of experiments and reduces the running time of experiments. Compared with the previous work, the accuracy of this experiment has been greatly improved.

Brief Introduction to Block Ciphers
Block cipher is one of the important systems in modern cryptography [6], which is an important part of many cryptosystems.As a basic construct, the versatility of block ciphers can also constitute components such as random number generation, sequence ciphers, message authentication, and hash functions [7]. Block cipher usually refers to a kind of cipher algorithm that can only deal with a piece of data of a certain length at a time. Here, the "piece" is called a block. The number of bits in a block is called the block length. Specifically, the principle of block cipher is to divide the plaintext message

Two working modes of block cipher
The ECB (Electronic Codebook) mode is the simplest encryption mode, which divides plaintext messages into fixed-length blocks.Each block is individually encrypted. All blocks use the same method for encryption and decryption of encryption and are independent of each other, so parallel computing can be performed [9].

Figure 2. Electronic Codebook Operation working mode
In the CBC (Cipher Block Chaining) mode, the plaintext message is still first divided into fixed blocks, and each block is XORed with the ciphertext encrypted by the previous block, and then encrypted. Thus each ciphertext block is associated with all plaintext blocks before the block. To ensure that each ciphertext block is unique, the first plaintext block needs to be XORed with the defined initial vector before being encrypted. Because the encryption process is contiguous, it cannot be processed in parallel. Similar to ECB, the plaintext block length must be padded to an integer multiple of the block size.

Common Distance Measurement Methods in Machine Learning
Euclidean distance refers to the distance between two points in n-dimensional space.

Experiments and Result Demonstration
During the data collection phase, we use the data from the Caltech-256 dataset [8]

2)
Transpose the matrix to get the ciphertext matrix after disturbing the original sequence.
Then standardize it as a feature of the ciphertext.

Building a classifier model
We paste the extracted feature vector with the encryption algorithm tag of the file source it belongs to.The labeled experimental data are divided into training set and test set by cross-over method. The training set and test set are input into Machine learning classifier, and the total accuracy is equal to 10 average values. The human interference is eliminated to the maximum extent, and the rationality of the model is determined. The specific process is shown in Figure 3 below.  Figure 4. Flow chart of cipher system recognition based on maching learning classifier

Classification results of cryptosystem based on random forest
Random forest is composed of several CART (Classification and Regression Tree). For each tree, the training set they use is sampled from the total training set. When training the nodes of each tree, the features they use are randomly extracted from all the features according to a certain proportion without playback. In this experiment, the ratio is 1/2 sqrt (255*1001). The training process is shown below. 1) Given training set S, test set T and feature dimension F. Determine parameters: the number of CARTs used t, the depth of each tree d, the number of features used by each node f, termination conditions: the minimum number of samples s on the node, the minimum information gain m on the node, for the (1-t)th tree, i 1 t.

2)
From S, there is a training set S(i) with the same size as S, and as a sample of the root node, training is started from the root node.
3) If the termination condition is reached on the current node, the current node is set as a leaf node. In the classification problem, the predicted output of the leaf node is the most c(j) of the current node sample set, and the probability p is c(j). The proportion of the current sample set. If the current node does not reach the termination condition, the f-dimensional feature is randomly selected from the F-dimensional features without being put back. Using this f-dimensional feature, the one-dimensional feature k with the best classification effect and its threshold θ are searched. The sample with the k-th dimension of the sample on the current node less than θ is divided into the left node, and the rest is divided into the right node. Continue to train other nodes.
The experimental results are as follows:  Figure 5. Histogram of experimental results based on random forest classification

Classification results of cryptosystem based on SVM
The support vector machine method is based on the VC dimension theory and structural risk minimization principle of statistical learning theory. According to the limited sample information, the complexity of the model and learning ability in order to get the best promotion ability (or generalization ability).The experimental process can be simplified by selecting two alphas in each iteration (where alpha is a hyperparameter that can be adjusted to get the optimal results) for optimization. Once you find a suitable pair of alpha, increase one and decrease the other. The "suitable" here means that the two alphas must meet certain conditions. The first condition is that the two alphas must be outside the interval boundary. The second condition is that the two alphas have not been intervalized. Or not on the border. The experimental results are as follows.

Classification results of cryptosystem based on logistic regression
In multi-category logistic regression, dependent variables are predicted by a series of independent variables (i.e. the characteristics and observation variables we call them). Specifically, after linear combination of independent variables and corresponding parameters, a probability model is used to calculate the probability of obtaining a certain result in the predictive dependent variables. The parameters corresponding to independent variables are calculated by training data. Sometimes these parameters become regression coefficients. The experimental steps can be summarized as follows: training N classifiers with one class as a positive example and other classes as a negative example. If only one classifier is predicted to be positive in the test, the corresponding classes are marked as the final classification results. If more than one classifier is predicted as an example, the data after logical regression is used as the criterion to select the maximum value. The experimental results are as follows: Table 3. Experimental results based on logistic regression classification

Conclusions
By comparing the results of previous work, we get the following table4. in ECB mode is 75%, which is higher than other existing work. The recognition accuracy rate in CBC mode is 13.5%, which is higher than that of random classification.
In future research, we will design better classification features based on different working modes of block cipher encryption algorithm to identify current slow-moving cryptosystem schemes, such as CBC mode. At the same time, we can also study the stream cipher and the public key cipher to increase the applicability, robustness and universality of the scheme.